1. Who is responsible

The person responsible for the protection of personal information is the founder of Borealmap (name, mailing address and dedicated email to be completed). Borealmap is a very small company: only one person has access to the information.

This policy covers the information Borealmap is itself responsible for. For the content that your employer or your organization places in Borealmap, that organization is responsible and Borealmap acts only on its behalf (see section 9).

2. What we collect

We collect the minimum necessary.

Sign-in identity: with Microsoft, Microsoft Entra user and tenant identifier, display name, licence group membership, profile photo if one exists, at sign-in; with the email code, the name and email address entered in the invitation.
Use of the service: sign-in times and audit log actions (who did what, when), without the content or title of your diagrams.
Technical logs: one line per request (date, route, response code, duration, pseudonymized IP address). No name, email or content.
Billing: organization name, billing contacts.
Support: your emails and attachments.
Visitors to this site: no analytics tool or tracking cookie is currently used.
We do not collect information for advertising or profiling, we sell nothing and we use no AI on your information.

3. Why (purposes)

To authenticate people and apply licences; to provide, secure and support the service; to detect abuse and incidents; to bill; to respond to your requests; to comply with the law. No other purpose without a new notice or consent.

4. Cookies and browser storage

The application uses only strictly necessary cookies: a session cookie and a sign-in binding cookie, which expire after 8 hours at most or 2 hours of inactivity (adjustable). No advertising, audience measurement or tracking cookie.

This site keeps only your theme choice (light or dark) in your browser’s local storage. It contains no cookie. If analytics tools are ever added, this policy will be updated and consent requested before they are activated.

5. How long we keep it

Sessions: 8 hours at most (2 hours of inactivity).
Technical logs: 30 days.
Audit log: adjustable by your organization’s administrator, minimum 30 days.
Backups: rolling 30 days.
Support emails: duration to be confirmed.
Invoices and accounting records: duration required by tax law.
Incident register: at least 5 years.
After the end of your organization’s contract: export for 30 days, deletion afterwards, backups expired no later than 30 days later (60 days in total, target).

6. Who we share it with

Only with our subcontractors, who help us provide the service: Amazon Web Services (hosting and emails, in Montréal), Microsoft Entra ID (authentication, if your organization uses it) and a payment provider (to be confirmed). We disclose information to an authority only if the law requires it, after verification, and by helping you to be notified when this is permitted.

7. Where it is hosted

In Canada: Amazon Web Services (AWS), Canada (Central) region, in Montréal; backup copies stay in Montréal too. Amazon is an American company; hosting in Canada does not shield you from all foreign law. Some AWS account management metadata may be processed outside Canada. We carry out a PIA (privacy impact assessment) before any new project involving personal information.

8. Your rights

You may request access to your information, its rectification, its deletion or its anonymization where the law permits, withdraw a consent, receive your information in a structured technological format (to the extent provided by law), ask us about our practices, and file a complaint with the Commission d’accès à l’information du Québec.

Write to the contact address on the Contact page. Reply within 30 days (target). Reasonable identification may be requested.

9. If your organization uses Borealmap

The diagrams, texts and images, as well as your organization’s accounts and licences, are the responsibility of that organization (the “responsible party”). To exercise your rights over this information, first contact your employer or your organization; we will assist them under the processing agreement. If you write to us directly, we pass your request on to the organization concerned without answering it ourselves.

10. Confidentiality incidents

We keep a register of all confidentiality incidents. In the event of an incident presenting a risk of serious injury involving information we are responsible for, we promptly notify the Commission d’accès à l’information and the persons concerned. For the information of a customer organization, we notify that organization no later than 24 hours after confirmation (target).

11. Security

Encryption in transit and at rest; limited access; authentication through your organization’s directory; rate limits; logs without personal information; backups. No measure is perfect; we do not claim to hold any certification to date.

12. Language, changes, contact

This policy is written in French; an English version is provided for information. We update it as needed, with the date at the top and a notice to customer organizations for any significant change.

Privacy policy