1. Data controller
The data controller is:
Carl Frenee, sole proprietor
3725, rue de la Provence
Trois-Rivières (Quebec) G9B 0R2, Canada
Email: carl@carlusone.com
No Data Protection Officer (DPO) has been formally designated at this time. Any request regarding this policy may be sent directly to the controller at the address above.
2. Scope
This policy covers:
- The showcase website carlusone.com (portfolio, blog, information pages);
- The five web applications published by CarlusOne:
3. Data collected
The data collected varies depending on the application used and the user's role.
3.1 Data common to all applications
- User account: email address, password (hashed, never stored in plain text) and, where applicable, display name.
- Technical data: IP address, device type, browser, preferred language, connection timestamps (for security and fraud prevention).
- Cookies and analytics: see section 8 below.
3.2 Data specific to each application
- GestTaches: tasks, public holidays, availability, absences, display preferences.
- GestBudget: categories, transactions, amounts and labels entered by the user. No direct bank connection.
- Jeu de Mots (Jeudemots): teacher side — account, pedagogical preferences (pupils' first names entered freely for practice, custom word lists); pupil side — no account, no email address, no personal data. Only a free-form first name is entered during a live session and then erased.
- GestReserve: customer contact details (name, phone, email), schedules and booking details entered by the operator.
- TranscriptIA: uploaded audio files and generated transcripts. All AI features (transcription, summary, rewriting) run on a dedicated local server (worker) and are never sent to third-party APIs such as OpenAI or Anthropic.
No sensitive data within the meaning of the GDPR (health, political/religious/sexual orientation, biometric data) is collected intentionally. If a user enters such data in a free-text field, they do so under their own responsibility.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|
| Provide the requested service (account, user data, application features) | Performance of a contract (art. 6.1.b) |
| Ensure security (authentication, logs, fraud prevention) | Legitimate interest (art. 6.1.f) |
| Invoice a paid subscription (Stripe) | Performance of a contract and legal obligation (accounting, VAT) |
| Respond to contact or support requests | Legitimate interest |
| Measure audience (Google Analytics, cookies) | Consent (art. 6.1.a) |
5. Processors and recipients
Data is neither sold nor rented to third parties. It is shared only with technical processors strictly required for the services to operate:
- Google Ireland Limited (Firebase Authentication and Firestore) — hosts most application data in the europe-west1 region (Belgium). Certified ISO 27001/27017/27018, SOC 1/2/3, GDPR DPA signed.
- Supabase Inc. (United States) — database and authentication for GestTaches. Transfers outside the EU are covered by the European Commission's standard contractual clauses.
- Netlify Inc. (United States) — web page and serverless function hosting. Global CDN with European points of presence. Non-EU transfers covered by standard contractual clauses.
- Stripe Payments Europe Limited (Ireland) — subscription payment processing. No card data ever transits or is stored on CarlusOne servers.
- Google (Google Analytics, Google Tag Manager) — anonymized audience measurement on the carlusone.com showcase website only, subject to consent.
No external cloud AI API (OpenAI, Anthropic, etc.) is used. TranscriptIA runs its models on a dedicated local server.
6. International transfers
Some processors (Netlify, Supabase, Stripe, Google) may process data from the United States. These transfers are covered by:
- Standard contractual clauses (SCCs) from the European Commission;
- Applicable certifications (SOC 2, ISO 27001, EU-US Data Privacy Framework where available);
- Strict minimization of transferred data.
For users located in Quebec, Law 25 requires a prior assessment of transfers outside Quebec: the controller has determined that these providers offer an equivalent level of protection.
7. Retention periods
- Active user account: for the entire duration of service use.
- Inactive account: deleted after 24 months of inactivity, following a warning email.
- Deletion on request: erasure within 30 days of receipt of the request.
- Billing data (Stripe): retained 6 to 10 years depending on applicable accounting and tax obligations.
- Technical logs: 12 months maximum.
- Jeudemots sessions: pupils' first names entered during a live session are automatically erased at the end of the session.
8. Cookies and similar technologies
Two categories of cookies are used:
- Strictly necessary cookies: authentication session, language and theme preferences. No consent required.
- Analytics cookies: on the carlusone.com showcase website, Google Analytics and Google Tag Manager measure traffic. These cookies are enabled only with your consent, which may be withdrawn at any time.
No advertising cookies or commercial trackers are used. The applications themselves do not display any advertising.
9. Your rights
Under Quebec Law 25, the Canadian federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the EU GDPR, you have the following rights:
- Right of access: obtain a copy of the data concerning you.
- Right to rectification: correct any inaccurate data.
- Right to erasure ("right to be forgotten"): delete your data, subject to legal retention obligations.
- Right to portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interest.
- Right to withdraw consent: withdraw your consent at any time (analytics, communications).
- Right to lodge a complaint: with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), the Office of the Privacy Commissioner of Canada (priv.gc.ca), or the competent data protection authority in your country of residence (CNIL in France, ICO in the UK, FDPIC in Switzerland, etc.).
To exercise these rights, write to carl@carlusone.com specifying your request and the application concerned. A response will be sent within 30 days at most.
10. Data security
- All communications encrypted in transit (HTTPS/TLS).
- Data at rest encryption (managed by Google Firestore and Supabase).
- Passwords stored as hashes (never in plain text).
- Two-factor authentication available as an option.
- Regular backups performed by infrastructure providers.
- Administrative access logging.
Despite these measures, no system is infallible. In the event of a data breach likely to result in a risk to your rights and freedoms, you will be informed without undue delay, in accordance with applicable legal obligations.
11. Children and minors
The Jeu de Mots (Jeudemots) service is intended for classroom educational use. On the pupil side, no personal data is collected: the session is anonymous and ephemeral. On the teacher side, an account requires digital majority (16 years old in the EU, 14 years old in Quebec unless parental authorization).
The other applications (GestTaches, GestBudget, GestReserve, TranscriptIA) are intended for professional or adult users.
12. Changes to this policy
This policy may evolve to reflect technical, legal or functional changes. Any substantial change will be notified by email to users with an account, at least 30 days before it takes effect. The update date is shown at the top of this page.
13. Contact
For any question regarding this policy or the exercise of your rights:
Carl Frenee
3725, rue de la Provence, Trois-Rivières (Quebec) G9B 0R2, Canada
Email: carl@carlusone.com