Privacy Policy

Last updated: October 1, 2026

This English version is a translation provided for convenience. The French version is the official version and prevails in case of discrepancy: Version française.

1. Who we are

ConformQ is a software-as-a-service (SaaS) for food safety and restaurant operations management, operated by Enrick Gatien, an individual (“we”, “our”). ConformQ and MomentumQ are brands used by Enrick Gatien. The Service is provided by subscription to client restaurant franchises, which manage their own authorized users in an isolated space. It is not intended for the general public and collects no data about end customers or consumers.

2. Person in charge of the protection of personal information

In accordance with Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), the person in charge of the protection of personal information is Enrick Gatien. For any question or to exercise your rights, you can reach him by email at enrickgatien@groupegtl.com.

3. Information we collect

The Service processes only the information necessary for its operation:

• User account: name, email address, role (administrator, manager, collaborator) and assigned location(s). Accounts are created by invitation from the Customer.
• Operational data entered: production, waste and inventory entries, food safety logs (temperatures, pH, cooling, sanitation, communications) and photos uploaded by users.
• Notifications: device token (push) if you enable notifications, in order to send you operational alerts. This token and the text of the notification (for example, the name of the location and the logs to be completed) pass through Expo’s notification service (see section 6).
• Technical data: error and diagnostic logs (technical identifier, device type, error messages) to ensure the stability and security of the service. These logs are sent to Sentry, our error monitoring service (see section 6). In the mobile application, they are associated with your identifier, your email address and your role. Sentry may also receive the IP address of the device that encounters the error.
• Security: IP address of the device and, at sign-up, email address, recorded to limit abusive attempts on certain sensitive operations (sign-up, code request, acceptance of an invitation, administration).

The Service does not collect precise geolocation data, biometric data or information about consumers.

4. Purposes

• provide and secure access to the Service (authentication, role management);
• enable the operational tracking of locations (production, waste, inventory, logs);
• produce reports and dashboards for management;
• send relevant alerts and notifications;
• diagnose incidents, prevent fraud and ensure security.

5. Basis and consent

The processing is based on the performance of the subscription contract between the Customer and the Provider and on the legitimate interests of managing operations. Acceptance of the terms of use at subscription constitutes acknowledgment of this policy.

6. Hosting and transfers outside Quebec

The data is hosted by our cloud infrastructure providers, whose servers may be located outside Quebec, notably in the United States:

• Supabase (database, authentication, storage) — United States region.
• Vercel (web interface hosting).
• Sentry (technical error monitoring; receives the logs described in section 3).
• Stripe (payment processing).
• SMTP2Go (transactional email delivery).
• Expo (delivery of push notifications to the mobile application; receives the device token and the text of the notification).

These providers offer contractual and technical protection safeguards. Since some information may be communicated outside Quebec, it may be subject to the laws of other jurisdictions. We limit these communications to what is necessary for the service.

7. Disclosure to third parties

We do not sell or rent your information. It is disclosed only to the service providers listed above, strictly to operate the service, or where required by law.

8. Retention period

The information is retained as long as the account is active and for as long as necessary for the purposes described or to meet our legal and accounting obligations, after which it is destroyed or anonymized.

9. Security

We implement reasonable security measures: encryption in transit (HTTPS), role-based access control and isolation by location (row-level security policies), authentication, logging of sensitive access and a strong password policy.

10. Your rights

Subject to applicable law, you may:

• access the information concerning you and obtain a copy of it;
• request the correction of inaccurate information;
• withdraw your consent (which may limit access to the Service);
• file a complaint with the Commission d’accès à l’information du Québec (CAI).

To exercise these rights, write to enrickgatien@groupegtl.com.

11. Cookies

The web interface uses only cookies that are strictly necessary to maintain your authentication session. No advertising or tracking cookies are used.

12. Changes

We may amend this policy. The update date above indicates the version in effect; material changes will be communicated to users.

13. Contact us

For any privacy question, you can reach Enrick Gatien at the following address: enrickgatien@groupegtl.com.