Privacy Policy

This privacy policy of 9553-6785 Québec Inc. (“Meo”, “we”) describes how Meo collects, uses, discloses, retains and protects personal information through its website and software. It applies to the activities described below, subject to applicable Canadian privacy laws.

For the purposes of this policy, personal information is any information that makes it possible to identify a person, directly or indirectly. When Meo processes information about visitors, prospects or account holders for its own activities, Meo determines the purposes of that processing. When a customer uploads or manages information in Meo about its own clients, employees or other individuals, that customer determines the purposes of the processing and Meo processes the information on its instructions and under our Data Processing Agreement. This policy does not describe each customer's own privacy practices.

Effective date: September 11, 2026

We have designated a privacy officer. If you have questions about how we handle your personal information, or if you wish to exercise your rights, you may contact our privacy officer:

We may collect personal information directly from you, automatically when you use our Services, or from a customer that uses Meo to manage information on its own instructions, including through:

• Creating an account in the software
• Documents, forms and records that a customer uploads or manages in Meo
• Booking an appointment through our website
• The contact form and support exchanges, including through Intercom
• The exposure calculator, our privacy-practice assessments and related report requests
• Cookies, pixels and similar technologies used on the website

Types of information collected:

• Account information: Name, email address, phone number, company
• Customer-managed content: Documents, forms and other personal information that a customer uploads or manages in Meo
• Requests and assessments: Email address, sector, answers, results, representative client count, and operational indicators supplied or calculated through our tools
• Payment information: Processed by Stripe. We do not store your credit card data
• Technical and usage data: IP address, browser, operating system, pages visited, referral source, date and time, usage events, cookie or device identifiers, and consent choices
• Communications: Name, contact details and content of contact, sales or support requests and emails

We collect and use your personal information solely for the following purposes:

We seek valid consent where required by law. The form of consent depends on factors including the sensitivity of the information, reasonable expectations and the context. Certain processing necessary to provide the Services, maintain security, process billing, or otherwise permitted or required by law may occur without separate express consent. Using the Services is not blanket consent to every activity described in this policy.

Withdrawal of consent: Where processing is based on your consent, you may withdraw it for future activities by contacting us at conformite@documeo.ca, subject to applicable legal or contractual restrictions and reasonable notice. Withdrawal may limit or prevent the delivery of certain Services.

Minors: Our Services are not intended for persons under 14 years of age. Where applicable law requires consent or authorization from a parent or guardian, the person providing the information must obtain it.

We retain your personal information only for the period necessary for the purposes for which it was collected, or as required or permitted by law.

Access to your personal information is strictly limited to authorized personnel of 9553-6785 Québec Inc. who need it to carry out their duties. We apply the principle of least privilege: each person has access only to the data necessary to carry out their responsibilities.

We may disclose your personal information in the following circumstances:

• Vendors: Our service providers (see section 8) who help us deliver the Services, subject to applicable contractual terms and safeguards.
• Analytics and advertising: Providers may receive technical, usage or attribution data as described in section 10, including according to your consent choices where consent is required.
• Authorities: Where the law requires it, for example to respond to subpoenas, warrants or court orders.
• Business transactions: In the event of an acquisition, reorganization or financing of our business, in compliance with applicable laws.

Documents managed by our customers and primary account data are stored in Canada, in the AWS Canada (Central) region (ca-central-1).

Some of our providers (see section 8) may process personal information elsewhere in Canada or outside Canada, including in the United States. When a transfer is considered:

• We put in place appropriate contractual and security measures based on the service and information involved. See our Data Processing Agreement
• We assess the nature and sensitivity of the information, the purpose, destination and safeguards, and carry out a privacy impact assessment where required by law
• Information processed in another jurisdiction may be subject to that jurisdiction's laws and legally valid access requests

To keep our services secure, web requests pass through Cloudflare, a global security network. Cloudflare may process requests at points of presence in North America before routing them to our primary infrastructure in Canada. All data remains encrypted in transit (TLS 1.3).

To see our practices, the controls we have in place, and to submit a privacy request, visit our public privacy portal.

The following principal providers may process limited personal information to help us deliver, secure, support and measure our Services. We limit disclosed information to what is needed for their function and apply appropriate contractual or security measures based on the context.

Providers and their processing locations may change. More detailed documentation about our security measures and providers is available on request.

Google Tasks connection (optional)

If you connect your Google account to Meo, we access your Google Tasks lists and tasks through the Google Tasks API for the sole purpose of synchronizing tasks you already have in Meo. Meo creates a list named Meo in your account, adds your open tasks to it, updates their title, due date and status, and brings back the completion state you change on the Google side. Meo does not read your other lists for any other purpose, creates no calendar events, and shares no Google data with third parties.

The authorization token is stored encrypted in our database hosted in Canada and is never sent to your browser. You can disconnect at any time under Settings, Account, Integrations. Meo then revokes the authorization with Google and deletes the token along with the identifiers that map your Meo tasks to your Google tasks.

Meo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Depending on the applicable law and context, you may have the following rights. Their availability, scope, conditions and exceptions may vary:

Our website uses cookies (called “témoins” in French), pixels, local storage and similar technologies to operate the site, protect forms, analyze use and measure the effectiveness of our communications.

These technologies may store or read information on your device, or transmit technical signals such as your IP address, the page viewed, usage events, and browser or device identifiers.

You may change your cookie preferences at any time by clicking the button below or through the “Manage cookies” link in the site footer.

Meo currently uses no fully automated decision-making process that would produce legal or significant effects on the persons concerned.

If we implemented such a process, we would update this policy and provide the information and mechanisms required by applicable law.

We have put in place physical, technical and administrative measures to protect your personal information against destruction, loss, unauthorized modification, disclosure and unauthorized access.

When we disclose personal information to our providers, we require safeguards appropriate to the nature of the information and the service provided.

We maintain the privacy incident records required by applicable laws and assess each incident against the relevant notification thresholds.

We may change this privacy policy from time to time, for example to reflect new laws or changes in the way we handle personal information.

In the event of a significant change, we will inform you by email or through a notice in our software. The last-updated date and, where different, the effective date are shown on this page. Superseded versions remain available in our archives.

For any question about this privacy policy, or to exercise your personal information rights:

If you believe your rights have not been respected, you may file a complaint with the privacy authority responsible under applicable law.