Privacy policy
This policy explains what personal information TandemPhone, a service of TonBusiness.ai, collects, why, and how you exercise your rights, under Québec’s Act respecting the protection of personal information in the private sector and the federal law (PIPEDA).
Person in charge
The person in charge of the protection of personal information is Mathieu Germain, founder of TonBusiness.ai. You can reach them at [email protected].
Who is responsible for what
For information about client businesses and their members, TonBusiness.ai is responsible. For information about the people who call or text a client business, that business is responsible and we act on its behalf, following its instructions. Address your requests to that business first.
Information collected
Members’ mobile number, name, business name and language. The line’s emergency address. Call and text history of the line, text content, attachments and voicemails. The public part of passkeys. Billing information handled by Stripe (we never see the card number). Technical logs (IP address, device) kept for security.
Why
To provide the service (route calls, texts and emergency calls, share the team’s history), authenticate you, bill, prevent fraud and meet our legal obligations. Nothing else, never advertising or selling information, and no automated decision about you.
Sharing with providers
Only with our providers, for these purposes and under written agreements. Twilio (calls, texts, 911 and sign-in codes), Stripe (payment), Cloudflare (secure access to the site) and OVHcloud (hosting). When 911 is called, the emergency address and the number are sent to emergency services.
Outside Québec
Our servers and your data are hosted in Québec, at OVHcloud. Twilio, Stripe and Cloudflare process some information outside Québec, notably in the United States, which is needed to route calls, texts and payments. A privacy impact assessment covers these transfers.
Retention
An account’s data is kept while it is active. After it closes, calls, texts, attachments and voicemails are destroyed within 90 days, and our backups are erased within the following 35 days. Invoices and tax records are kept 6 years, as tax laws require, with the usage record behind them (numbers of minutes and texts and their cost, no phone number nor content), even after a call or a conversation is deleted for good.
Security
Sign-in with a passkey or a code sent by text, no password. Encryption in transit. Access to data limited to the people who need it.
Your rights
You can ask to access, correct, port or delete your information, or withdraw your consent, by writing to [email protected]. We answer within 30 days. You can also complain to the Commission d’accès à l’information du Québec or, outside Québec, to the Office of the Privacy Commissioner of Canada.
Cookies
A single essential cookie keeps your session open. No advertising cookies, tracking or profiling tools.
Privacy incidents
If an incident presents a risk of serious injury, we notify the people concerned and the Commission d’accès à l’information, and we keep a register of incidents.
Changes
We publish any change to this policy here, with its date. For a significant change, we notify you in the app or by email.