Privacy Policy

TimingFlow is operated by Vision Synergie Inc., a company based in Québec, Canada. This policy explains how TimingFlow ("we") collects, uses, communicates, retains and destroys personal information, in accordance with Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and PIPEDA.

Two roles. For TimingFlow account holders, we are the enterprise responsible for their information. For the sites and apps our clients publish with TimingFlow, the client is responsible for its visitors' information and we act as its processor (mandatary) on its instructions: for that information, contact the site concerned first.

1. Person in charge of the protection of personal information

The person in charge of the protection of personal information at Vision Synergie Inc. (TimingFlow) is Richard Tanguay. He can be reached at [email protected]. Their title and contact information are also shown in the Privacy center of your account. They answer access and rectification requests and complaints, and keep the register of confidentiality incidents.

2. Information we collect

• Account: name, email address, password (stored only as an Argon2id hash), language, preferences.
• Proof of consent: at signup, we record when you accepted the terms and this policy and confirmed you meet the minimum age.
• Billing: processed by Stripe; we do not store full card numbers.
• Security: login and audit logs (IP address, device, date) used to protect accounts.
• Content: the projects, pages, files and data you create. This content belongs to you.

3. Purposes

We use this information to provide the service, authenticate and protect accounts, bill, communicate with you about your account and meet our legal obligations. Promotional emails are sent only with your express consent, which you can withdraw at any time in the Privacy center. We do not sell your personal information.

4. Cookies and tracking technologies

• TimingFlow app and website: we load no advertising scripts and no third-party analytics tools. Browser storage is used only to operate the service (session, preferences).
• Sites published by our clients: TimingFlow's built-in analytics are off by default in the sense of the law: without the visitor's "analytics" consent they use only an identifier limited to the browsing session and store no persistent identifier. Session recording (replay) starts only after that consent.
• Consent banner: every optional category is unchecked by default, a "Reject all" button is shown by default next to "Accept all", and each choice is logged as proof, without the IP address.

5. Communication to third parties and outside Québec

We communicate information only to the processors needed to provide the service. Core data is hosted by AWS in Canada (ca-central-1). Some processors, including AI providers for voice, image, video and transcription, process data outside Québec, mainly in the United States, only for the features you choose to use. These providers process it under their API terms; some keep API inputs for a limited period, for example for abuse monitoring. We do not use your content to train AI models. Health data is never sent to them. The complete list, with purpose, data and processing location, is published on our Sub-processors page.

We may communicate information when required by law (for example, in response to a court order).

6. Automated decisions

TimingFlow makes no decision about you based exclusively on automated processing, except security measures: temporary lockout after failed login attempts and bot verification. You can ask the person in charge to review such a decision and to know the main factors that led to it.

7. Your rights

• Access and portability: download your information in a structured format (JSON or CSV) from the Privacy center.
• Rectification: edit your profile at any time, or write to us.
• Withdrawal of consent: promotional emails, from the Privacy center.
• Deletion: delete your account from the Privacy center (immediate, irreversible).
• Cessation of dissemination and de-indexing: on request to the person in charge.
• Complaint: write to [email protected]. You may also contact Québec's Commission d'accès à l'information.

We answer requests in writing within 30 days.

8. Retention and destruction

• Account data is kept while the account is active. When the account is deleted, it is deleted immediately; backup copies expire at the end of their retention period (at most 35 days).
• Workspaces and projects moved to the trash can be restored for 30 days, then are permanently deleted.
• Proof of cookie consent on published sites is kept for 3 years.

9. Security and confidentiality incidents

Our security measures, with their automated verification, are described on our Security page. We keep a register of confidentiality incidents. When an incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the persons concerned; when the information belongs to a client, we notify the client so it can meet its own obligations.

10. Minors

TimingFlow accounts are reserved for people aged 16 and over (confirmed at signup). Clients who collect information about minors under 14 on their sites must obtain the consent of the person having parental authority.

11. Changes

We will publish any change on this page with its date and notify you by email of material changes before they take effect.

12. Contact us

• Privacy: [email protected]
• Support: [email protected]
• Company: Vision Synergie Inc. (TimingFlow), Québec, Canada