Privacy policy

Person in charge of personal information

9469-5947 Québec inc. (Evertrust Parts) is responsible for the personal information it holds. The person in charge of its protection under Quebec's Law 25 is the president of 9469-5947 Québec inc. (Evertrust Parts), reachable at support@truckdms.com.

Information collected

Account: name, email, password (hashed), language, IP address and sign-in logs.

Dealership: name, address, tax numbers, logo, contact details, billing information (processed by Stripe; we do not store your card number).

Data you enter about your own customers and leads (names, contact details, tax numbers, vehicles, invoices, contracts and signatures). For this data you are the controller and we act as a service provider on your behalf.

Usage data: pages viewed, actions taken, AI feature metering, to operate, secure and improve the Service.

Opening of documents sent to customers

An invoice or quote sent by a dealership contains a link to the online document, and the email contains a small image that loads when it is opened. When the customer opens the link, the email or the PDF, we record the date and time, the channel (link, email or PDF), the approximate country (derived from the IP address), the truncated IP address (the end is erased before recording: /24 for IPv4, /48 for IPv6) and the browser type, to let the dealership know the document was viewed. The dealership receives an email showing the date, the channel and the country. The city and the full IP address are not kept.

Electronic signature of contracts

When a dealership has a contract signed online, we keep as evidence of the signature: the name typed, the drawn signature, and the signer's email address, date and time and IP address, printed on the certificate added to the contract; a log of the steps (link sent, with the recipient and the dealership member who sent it; signing page opened; signature) with the date and time, the truncated IP address and the browser type; the SHA-256 fingerprint of the contract presented and that of the signed PDF, which let anyone check they were not altered. The signed contract is emailed to the signer and to the dealership.

Purposes and consent

We use this information to provide the Service, bill, offer support, ensure security and meet legal obligations. We do not sell personal information and do not profile it for advertising. Consent is given when the account is created and can be withdrawn by closing the account.

Service providers and where data is processed

We entrust some processing to the providers below, to provide the Service. Several are United States companies: some information is therefore processed or stored outside Quebec and Canada, where it may be accessible to the courts and authorities of that country under its laws.

Supabase: database and files, hosted in the Canada (Montréal, ca-central-1) region.

Vercel (US company): runs the application in its Montréal region; its global network routes and caches traffic through points of presence around the world.

Resend (US company): sends email; stores account data, including email metadata and logs, in the United States.

Anthropic (US company): AI features, for the photos, documents and text you submit to them. Anthropic stores this data in the United States, and the processing itself may take place in any region of the world (Anthropic's "global" routing). Submitted data is not used to train its models; it is deleted from its systems within 30 days, except content flagged for a violation of its usage policies (up to 2 years) or where the law requires longer.

Stripe (US company): payments; transfers the personal information of Canadian residents to its data centres in the United States.

Vapi (US company): voice assistant, off by default and used only if it is turned on for a dealership.

Retention

A dealership's data is kept while its account exists. After the subscription ends, it stays exportable (Settings) for at least 90 days. You can delete it yourself at any time (Settings, danger zone: delete the dealership or the account) or ask us in writing; we then delete it within 30 days, subject to legal retention obligations (for instance accounting records).

A dealership's activity log, document openings and signature log are kept with its data and deleted with it.

Security

Encryption in transit (TLS) and at rest, per-dealership data isolation through database-level access rules, roles and permissions, optional two-step verification, activity log. In the event of a confidentiality incident presenting a risk of serious injury, we notify the Commission d'accès à l'information and the persons concerned; an incident affecting the data of a dealership's customers is also reported to that dealership without delay.

Your rights

You can access your information, correct it, export it (the "Export my data" feature) and delete it yourself (Settings, danger zone: delete the dealership or the account) or by writing to support@truckdms.com. We answer within 30 days.

If you are a dealership's customer, contact the dealership first: it is responsible for the information it holds about you, and we help it answer.

You may also file a complaint with the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada or, in Alberta and British Columbia, your province's Information and Privacy Commissioner.

Cookies

The Service only uses cookies necessary for its operation (session, language, active dealership). No advertising or third-party tracking cookies. The document-opening tracking described above does not use cookies.

Changes

We may update this policy; the update date appears at the top of the page and material changes are announced by email.