Legal

Privacy Policy

Effective date: September 13, 2026 · Last updated: October 11, 2026

Fruxal Technologie inc. (“Fruxal,” “we,” “us,” or “our”), a Montréal company, reviews the financial documents of businesses each month to find cash to collect, credits to recover and tax items to resolve, and operates the Fruxal platform for existing accounts. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Clients in the United States should also read section 9.

By using Fruxal, you consent to the collection and use of your information as described in this policy. If you do not agree, do not use our service.

1. Information we collect

We collect information in two ways: information you provide directly, and information we collect automatically.

Information you provide:

• Account information: name, email address, business name when you register
• Business profile data: industry, province or state, revenue band, employee count, business structure
• Financial diagnostic data: the revenue, payroll, margin, and other financial figures you enter into the intake form; the diagnostic findings, health scores, and task history generated from that data
• Documents for a review: the contracts, invoices, statements and records you send us for a review, with personal information masked as described on our data-handling page
• Uploaded documents: files you choose to upload to the Fruxal platform
• Contact form details: the name, email, phone and company you enter when you ask for a call, and what you tell us about what you want to look at first
• Communications: when you contact us by email or through the platform
• Account deletion reason: if you voluntarily provide one when deleting your account

Information collected automatically:

• Usage data: pages visited, features used, diagnostic run frequency, login timestamps
• Device and browser information: browser type, operating system, IP address (used for security and abuse prevention)
• Cookies: session cookies required for login; product analytics from PostHog, loaded only after you accept analytics cookies
• Email engagement data: whether emails we send were opened or links were clicked (through Resend)

We do not collect payment card numbers. All payment processing is handled by Stripe, a PCI DSS Level 1 service provider.

2. Why we collect this information

• To provide our services: reviewing the documents you send, analyzing the figures you enter, and producing findings and recommendations
• To tailor your review: matching findings, filing dates and the documents we ask for to your industry, province or state, and business size
• To send transactional communications: email verification, receipts, diagnostic results, and account-security notices. These are required to operate your account and are sent regardless of marketing preferences
• To send commercial electronic messages (with your consent): monthly briefs, deadline reminders, program updates, and promotional messages are sent only if you provided express opt-in consent at sign-up or in Settings, in compliance with Canada's Anti-Spam Legislation (CASL). Every such message includes an unsubscribe link that takes effect within 10 business days
• To process payments: collecting fees set out in a signed engagement letter, through Stripe
• To improve the platform: understanding how features are used to make Fruxal better
• To comply with legal obligations: maintaining records required by applicable law

CASL record of consent. When you opt in to commercial emails, we record the date, time, IP address, and wording shown to you so we can demonstrate consent if required. You may withdraw consent at any time through the unsubscribe link in any commercial message or in Settings → Email preferences.

3. Who we share your information with

We share your information only with service providers who process it for us. The main ones are below; the complete list, with what each does and where it processes, is on our data-handling page.

• Anthropic: Your financial inputs are processed by Anthropic's Claude API to generate diagnostic findings. Anthropic does not use your inputs to train their models. See Anthropic's privacy policy at anthropic.com.
• Stripe: Payment processing. Stripe handles all card data. See stripe.com/privacy.
• Resend: Transactional email delivery (diagnostic results, monthly briefs, account notifications). See resend.com/privacy.
• Supabase: Database hosting, on Amazon Web Services in the United States. Supabase holds a SOC 2 Type II report. See supabase.com/privacy.
• Vercel: Application hosting, in the United States. See vercel.com/legal/privacy-policy.
• Google: Email and meeting scheduling. See policies.google.com/privacy.
• PostHog: Product analytics, only after you accept analytics cookies. See posthog.com/privacy.
• Plaid: Read-only bank connection, only if you choose to connect a bank account. You enter your banking credentials on Plaid's screen; Fruxal never sees them. See plaid.com/legal.
• Intuit: QuickBooks connection, only if you choose to connect QuickBooks, authorized on Intuit's own screen. See intuit.com/privacy.

We do not sell your data to third parties. Ever. We do not share it for advertising. We share it with a partner firm only when you ask us to, and only what you authorize.

We may disclose your information if required by law, court order, or to protect the rights and safety of Fruxal, our users, or the public.

4. Your rights under PIPEDA

As a Canadian resident, you have the following rights with respect to your personal information:

• Right to access: You may request a copy of the personal information we hold about you
• Right to correct: You may request that we correct inaccurate or incomplete information
• Right to delete: You may delete your account from Settings, which removes your profile and diagnostic data at once. Anything that remains, such as uploaded files and email logs, is removed on written request within 30 days
• Right to withdraw consent: You may withdraw consent to specific uses (such as marketing emails) at any time without affecting the lawfulness of prior processing
• Right to complain: If you believe we have not handled your information appropriately, you may lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise these rights, contact us at privacy@fruxal.ca. We will respond within 30 days.

5. Data retention

• Active accounts: Data is retained for as long as your account is active
• Deleted accounts: Profile and diagnostic data are removed when you delete your account; uploaded files and email logs are removed on written request within 30 days. We keep a deletion log holding a one-way hash of your account ID, not your data
• Diagnostic reports: Retained for the lifetime of your account and deleted with your account
• Email logs: Retained until you ask us to delete them
• Uploaded documents: Retained for the lifetime of your account or until you request deletion
• Review documents: Files uploaded for a review are kept in private storage, reachable only by the representative assigned to it and an authorized administrator of Fruxal Technologie inc., until the review ends, and are then deleted; documents you email stay in our mailbox until the review ends. Findings and their supporting evidence are kept for 12 months after the report

6. Security

• All data transmitted between your browser and Fruxal is encrypted using TLS 1.2 or higher
• The database refuses the public key; it is reachable only through Fruxal's own server
• Payment card data is handled entirely by Stripe. We never see or store card numbers
• We fix identified vulnerabilities as a priority

No system is 100% secure. If you become aware of a security concern, please contact us at privacy@fruxal.ca.

7. Cookies

• Session cookies: Required for you to stay logged in. Without these, the service cannot function
• Analytics cookies: PostHog records how pages and features are used, and loads only after you accept analytics cookies. When you are signed in, this activity is linked to your account

We do not use advertising cookies, retargeting pixels, or third-party tracking. See our Cookie Policy for full details.

8. Quebec residents: Law 25 (Act respecting the protection of personal information in the private sector)

If you reside in Quebec, the following additional rights and disclosures apply to you under Quebec's Act respecting the protection of personal information in the private sector (commonly referred to as “Law 25”), as amended by An Act to modernize legislative provisions as regards the protection of personal information.

Privacy Officer

Fruxal Technologie inc. has designated its Privacy Officer as the person in charge of the protection of personal information. You may contact the Privacy Officer directly at privacy@fruxal.ca for any question, request, or complaint concerning the handling of your personal information.

Your Law 25 rights

• Right of access: Obtain confirmation that we hold personal information about you and a copy of that information
• Right of rectification: Have inaccurate, incomplete, or equivocal information corrected
• Right to de-indexation and cessation of dissemination: Request that we stop disseminating your personal information or de-index it where the law allows
• Right to data portability: Receive the computerized personal information you provided to us in a structured, commonly used technological format, or have it transmitted directly to another organization where technically feasible
• Right to be informed about automated decisions: Be informed when a decision about you is based exclusively on automated processing, and obtain information about the principal factors and parameters used; you may submit observations to a Fruxal employee for a review of such decisions
• Right to withdraw consent: Withdraw your consent to the use or disclosure of your personal information at any time, subject to legal and contractual limits

Automated processing disclosure

Fruxal uses automated processing (including large-language-model analysis through Anthropic's Claude API) to generate diagnostic findings, health scores, and recovery recommendations from the financial data you provide. These outputs are informational. They are not binding financial, legal, or tax decisions, and a human Fruxal reviewer is available on request to examine any finding you wish to contest.

Storage and transfers outside Quebec

Your personal information is stored on infrastructure operated by Vercel, Supabase and Amazon Web Services in the United States, outside Quebec. Before transferring personal information outside Quebec, Fruxal conducts a privacy impact assessment to confirm that the information will receive adequate protection, having regard to the sensitivity of the information, the purpose of its use, the protective measures in place, and the legal framework of the destination jurisdiction.

Confidentiality by default

Parameters that involve the disclosure of your personal information are, by default, set to provide the highest level of confidentiality, without any intervention required from you.

Complaints to the CAI

If you are not satisfied with our response to a privacy request, you may lodge a complaint with Quebec's Commission d'accès à l'information (CAI) at cai.gouv.qc.ca.

9. Clients in the United States

For a business client in the United States, Fruxal processes the personal information in your documents as your service provider: only to perform the review you engaged us for, under your instructions and these terms. We do not sell or share it, as those terms are used in US state privacy laws such as the California Consumer Privacy Act, and we do not combine it with information from other clients.

If you live in a state with a consumer privacy law, you may ask us to access, correct or delete your personal information, or to confirm that we do not sell or share it, by writing to privacy@fruxal.ca. We answer within 30 days and do not treat you differently for asking. Where we hold information on behalf of a business client, we forward the request to that business and act on its instructions.

Information about clients in the United States is stored in the United States, with the providers listed in section 3.

10. Contact us

For privacy questions, data access requests, or to exercise your privacy rights:

• Email: privacy@fruxal.ca
• Response time: 30 days
• Fruxal Technologie inc., Montréal, Québec

This Privacy Policy was last updated on October 11, 2026. We will notify active users of material changes by email before they take effect.