Privacy Policy

Version 1.0 — In effect on April 28, 2026

Last updated: 22 May 2026 — vocabulary simplification (« Tenant » replaced by « Salon »). No substantive change to rights or obligations.

1. Who we are

Les Logiciels Cygsoft Inc. (« Cygsoft », « we »), a Canadian company registered in Quebec, operates the Clairgest platform (« the Service »), a management software (point of sale, appointment booking, invoicing, communications) for esthetics, hair and massage therapy professionals in Canada.

Address: PO Box 1281, Sept-Îles (Quebec) G4R 4X7, Canada.

For any question regarding this policy or to exercise your personal information protection rights, contact the Privacy Officer by email: privacy@clairgest.ca.

2. Who this policy applies to

This policy covers the personal information we collect:

• From Salons: professionals and businesses that subscribe to Clairgest to manage their activity.
• From End Clients of Salons: individuals who book appointments, purchase products or receive services through the Clairgest platform.
• From Visitors: individuals who visit Clairgest's public pages without creating an account.

Important note: for End Clients, the Salon that registers them is their primary point of contact regarding data. Cygsoft acts as a service provider (sub-processor within the meaning of Law 25), and the Salon acts as the controller of the data it has collected from its own clients.

3. Personal information we collect

3.1 From Salons

• Identity: last name, first name, business name, NEQ or business number.
• Contact details: postal address, email, phone number.
• Login data: username, password (protected by cryptographic hashing), login history, IP address.
• Billing data: payment information processed by our provider (card numbers are never stored on our servers).
• Usage data: event logs, aggregated usage statistics.

3.2 From End Clients of Salons

The following information is collected and managed by the Salon through the platform:

• Identity and contact details (name, email, phone).
• Appointment and transaction history at this Salon.
• Notes added by the Salon (free text — see section 3.3).

3.3 Sensitive information

Clairgest does not request and does not actively collect health information, allergies or medical conditions. However, the Salon may, in the course of practicing its profession, record such information in the « notes » field of the client record. When this occurs:

• This data remains the exclusive responsibility of the Salon (which must obtain the informed consent of its End Client).
• Cygsoft applies the same technical protections as for any other personal data.
• Cygsoft does not analyze, aggregate or consult this data for any purpose other than the technical provision of the Service.

4. Purposes of collection

We use personal information to:

1. Provide, maintain and improve the Service.
2. Authenticate users and secure accounts.
3. Issue invoices and process subscription payments.
4. Communicate with Salons about the Service (technical notifications, support, contract changes).
5. Provide technical support and resolve incidents.
6. Comply with our legal obligations (accounting, mandatory legal disclosures).
7. Protect our rights, those of our Salons and the public (fraud prevention, security).

Commercial communications (CASL): we do not send any commercial electronic communication to a Salon or an End Client without their prior explicit consent. Every commercial email includes an unsubscribe option processed within 10 days.

5. Legal bases

Depending on the context, the collection and use of personal information rely on:

• Performance of the contract between Cygsoft and the Salon (terms of service).
• The explicit consent of the person concerned (notably for commercial communications and sensitive information).
• Legal obligation (accounting and tax obligations, court orders).
• Cygsoft's legitimate interest in security, fraud prevention and improving the Service, where it does not infringe the rights of the persons concerned.

6. Sub-processors and sharing with third parties

To provide the Service, Cygsoft uses carefully selected sub-processors:

Category	Type of data processed	Location
Infrastructure hosting	All Service data	Canada (OVH Canada)
Email infrastructure (admin mailboxes)	Emails received and sent	Canada (VD Informatique)
Transactional email sending	Email addresses, notification content	United States (SendGrid)
Transactional SMS sending	Phone numbers, message content	United States (Twilio)
Payment processing (upcoming)	Payment information, transaction identifiers	United States and/or Canada

Out-of-Quebec transfer: some sub-processors (SMS, transactional emails, payments) are based in the United States. In accordance with Law 25, we conduct a privacy impact assessment for these transfers, and we ensure that the sub-processors offer equivalent protection. The up-to-date detailed list of our sub-processors is available on request at privacy@clairgest.ca.

Cygsoft never sells personal information to third parties for marketing purposes.

7. Retention period

Data	Duration
Active Salon account	For the entire duration of the subscription
Salon account after termination	30 days in « read-only » access for recovery, then reversible deletion
Permanent deletion	90 days after reversible deletion
Billing and tax data	6 years (Quebec and federal accounting obligation)
Technical logs (server logs, access audit)	90 days
Backups	Rolling 30-day rotation
Information for ongoing incident resolution	Until resolution + 30 days

At the request of a Salon or End Client exercising their right to be forgotten, we proceed with permanent deletion within the timeframes provided by Law 25, subject to our legal retention obligations.

8. Security

We implement technical and organizational measures to protect personal information:

• TLS encryption for all client-server communications.
• Cryptographic hashing of passwords (bcrypt).
• Strict separation of data between Salons (each Salon sees only its own data).
• Two-factor authentication (2FA) available and recommended.
• Encrypted off-site backups.
• Logging of administrative access and periodic review.
• Training and confidentiality obligations for our staff.

No system is completely infallible. In case of a confidentiality incident affecting your personal information and presenting a risk of serious harm, we will notify you without undue delay, and at the latest within 72 hours of becoming aware of the incident, in accordance with Law 25.

9. Your rights

In accordance with Quebec's Law 25 and PIPEDA, you have the following rights:

• Access: obtain a copy of the personal information we hold about you.
• Rectification: have inaccurate or incomplete information corrected.
• Deletion (« right to be forgotten »): request the deletion of your information, subject to our retention obligations.
• Portability: receive your information in a commonly used structured format (JSON or CSV export).
• Objection: object to the processing of your information for legitimate reasons.
• De-indexing: request that a link to your information no longer be accessible by a search engine, where applicable.
• Withdrawal of consent: withdraw consent previously given for commercial electronic communications.

To exercise these rights, contact privacy@clairgest.ca. We respond within 30 days of receiving a complete request. No fees are charged except in case of a manifestly abusive request.

If you believe we have not responded adequately, you may file a complaint with:

• Quebec's Commission d'accès à l'information (CAI): https://www.cai.gouv.qc.ca
• or the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca

10. Cookies and similar technologies

Clairgest uses cookies strictly necessary for the operation of the Service (authentication, session, security). These cookies do not require your prior consent.

We use two anonymous audience-measurement tools: Google Analytics 4 (with IP anonymization) and Microsoft Clarity (aggregated usage statistics). These tools run in “denied-by-default consent” mode (Google Consent Mode v2): until you accept, no cookie is stored on your device — only anonymous measurements, with no identifier or local storage, are sent to estimate traffic. Measurement cookies are placed only after your explicit acceptance via the consent banner, never before.

On our marketing website we also use the Meta (Facebook) Pixel to measure the effectiveness of our campaigns. It follows the exact same consent mechanism: until you accept, the Pixel is not loaded and no Meta cookie (e.g. “_fbp”) is stored on your device. These cookies are placed only after your acceptance.

You can configure your browser to refuse cookies, but this may affect the proper functioning of the Service.

11. Minors

Use of Clairgest by a Salon requires that the user be at least 18 years old (contractual capacity).

When a Salon registers a minor End Client in the platform:

• For End Clients under 14: parental consent or that of the holder of parental authority is required and must be collected by the Salon before any entry.
• For End Clients aged 14 and over: they may personally consent to the collection of their information for the services rendered to them.

The Salon is responsible for collecting and retaining consents for its own End Clients.

12. Changes to this policy

We may modify this policy to reflect changes in the Service or regulations. The date of the last modification appears at the top of the document.

In case of substantial changes, we will notify Salons by email and require their explicit acceptance at the next login.

The version history is available on request.

13. Contact

For any question, request or complaint:

Les Logiciels Cygsoft Inc.
Attn: Privacy Officer
PO Box 1281
Sept-Îles (Quebec) G4R 4X7
Canada

Email: privacy@clairgest.ca

---

The French version of this Privacy Policy is the official, legally binding text. This English version is provided for informational purposes only. In case of any divergence, the French version prevails.