Privacy policy

1. Purpose

This policy explains what personal information we collect, why, how we use, disclose, protect and retain it, and what your rights are, in accordance with the Act respecting the protection of personal information in the private sector (Quebec) and applicable laws. It applies to the Mia portal, the Mia extension and related services. The Mia extension has no separate policy: this policy also covers the information it processes.

2. Person in charge of the protection of personal information

Alexandre Laroche, person in charge of the protection of personal information at Mia Technologies inc.

support@bonjourmia.com · 353 rue Blanchard, Rosemère, Quebec J7A 1Y7

Send any question, access or rectification request, or complaint about your personal information to this person.

3. Our role

3.1 Your own information (the broker, agency or team using Mia): we are the organization responsible for this information.

3.2 Information about your clients and counterparties (sellers, buyers, other persons appearing in the documents you entrust to us): we process it on your behalf and under your instructions, as a service provider. You remain the organization responsible for that information in respect of the persons concerned and must have obtained the necessary consents. Persons concerned who write to us directly will, where appropriate, be redirected to you.

4. Information we collect

• Account and profile: name, email, phone, agency or team, subscription plan, information about your licence, roles and preferences.
• Billing: billing and payment information, processed by a third-party payment processor (we do not keep your full card number).
• Centris access (GED plan only): the authorization data associated with the delegated access you grant to Mia through Centris's official mechanism. With the base plan, you log in yourself and we keep no access to your Centris account.
• Customer Content: documents and data processed by Mia for a listing, including names and contact details of sellers or contacts, addresses, property information, tax bills, assessment roll, land registry documents, bills, brokerage contracts, seller declarations.
• Technical data: IP address, device and browser type, connection and activity logs, access dates and times, error diagnostics.
• Communications: your messages to support and to us.

Sources. We collect this information from you, from the persons or organizations that manage your access (agency, team), from the documents and photos you upload and, when you launch a feature, from the third-party services queried for the selected file (public registries, municipalities, school boards, etc.).

5. Why we use it

• to provide, operate and support Mia (processing listings, Centris entry, GED deposit);
• to manage your account, billing and communications with you;
• to ensure the security of the service, prevent fraud and abuse, and fix errors;
• to comply with our legal obligations;
• to improve the service, using aggregated, de-identified data.

We do not use your information for other purposes without your consent, unless the law allows it. We do not sell your personal information or use it for targeted advertising. Any new material purpose will be communicated to you and subject to the consent required.

6. Consent

You consent to this processing by creating an account and using Mia. For information about your clients and counterparties, you confirm that you have obtained their consent or have another legal basis. You may withdraw your consent at any time by writing to us, subject to legal or contractual restrictions; withdrawal may, however, prevent us from providing the service.

7. Who we share your information with

We share information only to the extent necessary, with service providers bound by confidentiality obligations:

• Google Cloud, for hosting and storing our data;
• Google and OpenAI (artificial intelligence services), which process documents to extract and structure information;
• Stripe (payment processor), for billing;
• Centris and your GED, where Mia enters or deposits information there on your behalf;
• professional advisors (legal, accounting) and authorities, where the law requires or to protect our rights;
• a potential acquirer of the business, subject to a confidentiality agreement.

Our providers may use the information only for the purpose of providing their services to us. We use the OpenAI API under its commercial terms, which provide that data sent through the API is not used to train its models. When you trigger a retrieval or an interaction with a third-party site or service (registry, municipality, etc.), the necessary information may be exchanged with that service.

8. Artificial intelligence and automated decisions

Mia uses artificial intelligence models to read documents and extract information from them. Mia makes no decision about a person based exclusively on automated processing. The broker validates the results before any use. AI responses are aids to be reviewed, not final decisions; they may be inaccurate or incomplete. Submit only information you are authorized to process in this context. If you wish to know how information about you was processed, write to the person in charge of the protection of personal information.

9. Where your information is stored

Your information is hosted on Google Cloud infrastructure, in the Montréal (Quebec) region. Some information may, however, be disclosed, processed or accessible outside Quebec, including elsewhere in Canada or in the United States, by our providers (for example for artificial intelligence processing, technical support or billing by Stripe). In particular, documents sent to OpenAI for an AI feature may be processed outside Quebec, including in the United States. Before any disclosure outside Quebec, we assess the privacy factors, including the sensitivity of the information, the purposes, the protection measures and the legal regime applicable in the receiving jurisdiction, and we ensure it would receive adequate protection, including by written agreement.

10. How long we keep it

We keep information for as long as necessary for the purposes described above:

• during the subscription: as long as your account is active;
• after the subscription ends: thirty (30) days to retrieve your data, then deletion or anonymization of Customer Content, and end of the delegated access to your Centris account with deletion of the associated authorization data;
• error diagnostics: diagnostics received by Mia's servers expire after 90 days;
• billing and legal obligations: for the period required by law.

Your record-keeping obligations as a broker are your responsibility; documents deposited in your GED are not affected by our deletion.

11. Security

We apply reasonable security measures appropriate to the sensitivity of the information: access control limited to personnel who need it, protection of the cloud infrastructure, technical measures to protect the authorization data of the delegated access to Centris, and confidentiality obligations toward our providers. As no system is infallible, we cannot guarantee absolute security.

12. Confidentiality incidents

We keep a register of confidentiality incidents. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information du Québec and the persons concerned with diligence, and, where you are the organization responsible for the information affected, we notify you without delay so that you can meet your own obligations.

13. Your rights

Subject to the exceptions provided by law, you may:

• access the personal information we hold about you;
• request its rectification if it is inaccurate, incomplete or equivocal;
• request that its dissemination cease or that it be de-indexed, where the law permits;
• withdraw your consent;
• request deletion of information that is no longer necessary;
• request to receive your information in a structured, commonly used technological format (portability);
• request clarification on the processing of your information.

To exercise these rights, write to the person in charge at support@bonjourmia.com. We respond within 30 days of receiving your request. If your request concerns information provided by a broker or an organization, we may need to coordinate it with that person or organization. We may ask you to confirm your identity. If you are not satisfied, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

14. Cookies and local storage (portal and extension)

The portal uses cookies and similar mechanisms necessary for the session, authentication, language and interface preferences. The Mia extension may store locally, on your device, an access key, a browser identifier, the selected file, preferences and certain diagnostics pending transmission. Disabling these essential mechanisms may prevent use of the service. Any audience-measurement or tracking cookie is activated only with your consent, and you may refuse or withdraw it.

15. Changes

We may amend this policy. We will post the current version on our website with its effective date and, for any material change, notify you by email at least 30 days in advance. If a change requires new consent or acceptance, we will ask for it.

16. Language

The parties have required that this policy be drawn up in French and English. In case of interpretive discrepancy, the French version prevails.

17. Contact

Mia Technologies inc. · 353 rue Blanchard, Rosemère, Quebec J7A 1Y7 · support@bonjourmia.com