PipeGears Privacy Policy

1. Who we are

PipeGears is a B2B integration platform operated by Towerlogic Inc., a corporation incorporated under the laws of Quebec, Canada, with its principal place of business in Montreal, Quebec. References to "PipeGears", "we", "us", and "our" in this policy refer to Towerlogic Inc. operating under the PipeGears brand.

This policy explains what personal information we collect, why we collect it, who we share it with, where it is stored or transmitted, how long we keep it, and what rights you have under applicable privacy law, including the Quebec Act respecting the protection of personal information in the private sector (RLRQ c. P-39.1, as modernized by Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

2. Privacy Officer

The Person in Charge of the Protection of Personal Information for Towerlogic Inc. and PipeGears (Personne responsable de la protection des renseignements personnels), as required by section 3.1 of the Quebec Act, can be reached at privacy@pipegears.com.

3. What this policy covers

This policy covers the personal information we process through:

• The PipeGears website at pipegears.com, our public marketing website (referred to in this policy as "the Website"). Visitors can browse content and submit a contact form to reach us.
• The PipeGears Product, our paid integration platform (referred to in this policy as "the Product"). The Product is delivered through multiple URLs, including subdomains of pipegears.com (such as the customer-facing console, preview environments, and developer documentation) and other domains we operate from time to time. Some parts of the Product require authentication; some parts (such as public documentation) do not.

Where the treatment of personal information differs between the Website and the Product, or between authenticated and unauthenticated parts of the Product, we say so explicitly.

4. Personal information we collect, and why

4.1 On the Website

We do not run third-party analytics, advertising pixels, marketing trackers, session-replay tools, or chat widgets on the Website. We do not set any cookies on the Website.

4.2 Within the Product

When you are authenticated on the Product (for example, logged in to the customer console to configure and operate integrations), we collect:

When you access unauthenticated parts of the Product (for example, public documentation), we collect only the server access log information described in section 4.1.

We do not run third-party analytics, advertising pixels, marketing trackers, or session-replay tools on any part of the Product.

5. Sub-processors and where your information is stored

To deliver the service, PipeGears uses a small number of third-party service providers ("sub-processors"). The current list is:

We require each sub-processor to be bound by a written agreement that includes confidentiality, security, purpose limitation, and breach notification obligations. We review the list periodically and update this policy when it changes.

We do not sell personal information. We do notshare personal information with third parties for those parties' own marketing purposes.

6. Transfers outside Quebec

Some of the sub-processors listed above store or process personal information outside Quebec, including in the United States. Specifically:

• Google Workspace processes data in the United States
• AWS SES transactional email is processed in the United States (us-east-1)
• AWS hosting of the Product and of the Website (pipegears.com) is located in the Montreal area of Canada; certain AWS operational metadata may transit U.S. infrastructure

Before transferring personal information outside Quebec, we conduct a privacy impact assessment as required by section 17 of the Quebec Act. The assessment considers the legal regime of the destination jurisdiction, the safeguards in the contract with the recipient, and the sensitivity of the information. We retain those assessments on file and can describe them on request.

By using PipeGears, you understand that your personal information may be subject to the legal regime of jurisdictions outside Quebec, including the United States. Where you have entered into a Data Processing Agreement with us as a customer, the safeguards that apply to data we process on your organization's behalf are set out in that agreement.

7. How long we keep personal information

We document and review these retention periods at least annually.

8. Cookies and similar technologies

• The Website (pipegears.com): no cookies are set, including by third parties. No analytics, no marketing pixels, no session-replay, no chat widgets.
• The Product: a single strictly-necessary session cookie is set when you log in, and is used solely to keep you authenticated for the duration of your session. No other cookies are set on the Product.

Because the Product's session cookie is strictly necessary to deliver the service you have logged in to use, we do not present a separate consent banner for it, in line with section 8.1 of the Quebec Act. The cookie is disclosed here for transparency.

9. Automated processing of personal information

PipeGears does not currently make decisions about you exclusively through automated processing of personal information. If we do so in the future, we will provide the disclosures required by section 12.1 of the Quebec Act on or before the decision is communicated.

10. Your rights

Under the Quebec Act and other applicable law, you have the right to:

1. Access the personal information we hold about you and obtain a copy.
2. Rectify information that is inaccurate, incomplete, or ambiguous.
3. Erase information whose collection is not authorized by law, or de-index information whose dissemination causes serious injury and is disproportionate to the public interest.
4. Withdraw consent to processing where consent is the legal basis.
5. Object to a decision based exclusively on automated processing.
6. Receive your information in a structured, commonly used technological format (data portability), where applicable.
7. File a complaint with us, and with the Commission d'accès à l'information du Québec (CAI).

To exercise any of these rights, contact the Privacy Officer at privacy@pipegears.com. We will respond within 30 days of receiving your request, as required by section 32 of the Quebec Act. If we need more time, we will tell you why and when you can expect a response. We may need to confirm your identity before acting on a request.

11. How to file a complaint

If you believe we have not handled your personal information appropriately:

1. Contact our Privacy Officer first at privacy@pipegears.com. We take complaints seriously and will work to resolve them.
2. If you are not satisfied with our response, you have the right to file a complaint with the Commission d'accès à l'information du Québec:
   • Web: https://www.cai.gouv.qc.ca
   • Mailing address: 2045, rue Stanley, bureau 900, Montréal (Québec) H3A 2V4
3. If you are outside Quebec, you may also have the right to complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or the privacy regulator in your province.

12. Security

We protect personal information using reasonable technical and organizational safeguards. If we experience a confidentiality incident that creates a risk of serious injury to you, we will notify you and the Commission d'accès à l'information du Québec with diligence, as required by sections 3.5 to 3.8 of the Quebec Act.

13. Languages

This policy is published in English and in French. Each version has equal authority.

14. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top and notify customers of material changes through the console or by email.

15. Contact

Privacy Officer (Personne responsable de la protection des renseignements personnels): privacy@pipegears.com

Mail: Towerlogic Inc., 6500 Trans-Canada Hwy, Suite 400, Pointe-Claire (Québec) H9R 0A5, Canada