PlanSST is committed to protecting the privacy of its users. This policy explains how we collect, use, and protect your personal information.
The person in charge of the protection of personal information at PlanSST is Alisher Khakimov, founder. You can reach him through our contact form for any question or request about your information.
Directly from you: the account email address and (encrypted) password; the business name, contact details, NEQ, sector, number of employees and the name of the liaison officer; your questionnaire answers and the hazards and measures of your plan. On a free download: your email address, your sector and your consent to receive emails. Automatically: a hashed, non-reversible fingerprint of the IP address (abuse limiting), the browser type and aggregated visit statistics. Payment card data is entered directly with Stripe and never passes through our servers.
Your information is used to provide and improve the Service, generate your action plan and documents, communicate with you about your account or purchase, send you OHS tips by email with your consent (one-click unsubscribe in every message), prevent abuse and meet our legal obligations.
We do not sell or rent your information. It is processed by providers acting on our behalf: Supabase (database and authentication, servers located in the United States), Vercel (site hosting and performance metrics, United States), Stripe (payment and invoicing), Resend (email delivery) and Google Analytics (traffic statistics). Your information is therefore stored outside Quebec; this transfer is covered by a privacy impact assessment, and each provider is bound by confidentiality and security commitments. We do not disclose your information to anyone else unless required by law.
Your data is encrypted in transit (TLS) and at rest. Access is restricted by row-level security policies (RLS): each organization can only access its own data. Administrative access is limited to the person named above.
Account data is kept as long as the account exists, then deleted within 30 days of your request. Addresses collected for a free download are kept until unsubscription or at most 24 months after the last email. Email delivery logs are kept for 24 months. Invoicing records are kept for the period required by tax law.
Under Quebec's Act respecting the protection of personal information in the private sector (Law 25), you may access your information, have it corrected, request its deletion, withdraw your consent to emails at any time and obtain your computerized information in a structured, commonly used format. Send your request through the contact form; we answer within 30 days. You may also file a complaint with the Commission d'accès à l'information du Québec.
We use essential cookies (authentication, language) and traffic-measurement tools (Google Analytics, Vercel Analytics) that produce aggregated statistics. We do not use advertising cookies and do not profile users. You can block measurement cookies in your browser without losing any functionality.
In the event of a confidentiality incident presenting a risk of serious injury, we notify the Commission d'accès à l'information and the persons concerned, and we keep an incident register as required by Law 25.
We may change this policy; the update date appears at the top of the page. For any questions about this policy, contact us at: