Privacy
Privacy Policy — GoContrôle CRM
Last updated: 2026-10-26
1. Who we are
GoContrôle (the "Publisher", "we", "our") operates the GoContrôle CRM platform at crm.gocontrole.com.
Data Controller: GoContrôle
Privacy email: contact@crm.gocontrole.com
Showcase site: https://gocontrole.com
2. Data collected
2.1 Account data (provided by you)
- Email address (login identifier)
- Password (PBKDF2-SHA256 hashed, never stored in plaintext)
- Preferred language (fr / en)
2.2 Platform usage data (generated by your activity)
- Contacts you create or import: name, company, phone, email, address, notes, tags, pipeline status
- Pipeline: opportunities, stages (New → In progress → Qualified → Won), values, dates
- Tasks and follow-ups: title, description, due date, status
- Activity history: logins, modifications, exports
2.3 Technical data (logs)
- IP address (hashed for anonymous analytics, retained 30 days raw for security)
- User-Agent, timestamps, pages visited, errors
- Session identifier (cookie
sha_session, HttpOnly, SameSite=Lax, 7 days)
2.4 Billing data (managed by Paddle)
We store no credit card data. Paddle (merchant of record) collects and processes:
- Name, billing address, email
- Payment method (card)
- Invoice and payment history
See Paddle's privacy policy: https://paddle.com/privacy
2.5 Form data
Requests sent from the contact page (name, email, company, number of seats, currency, message) are stored in our database so we can handle the request.
2.6 Third-party data (sub-processors)
- Cal.com: appointment data (slot, guest, notes) — see
https://cal.com/privacy - Chatwoot: chat conversations, visitor metadata — see
https://www.chatwoot.com/privacy-policy - Cloudflare: security logs, performance, hosting — see
https://www.cloudflare.com/privacypolicy/
3. Purposes and legal bases (Law 25 / PIPEDA)
| Purpose | Legal basis | Data involved |
|---------|-------------|---------------|
| Provide the service (account, pipeline, contacts, tasks) | Contract performance (Law 25 art. 12 / PIPEDA) | Account, contacts, pipeline, tasks |
| Billing, invoices, taxes | Legal obligation + contract | Paddle data (we access read-only) |
| Security, abuse/fraud detection | Legitimate interest (Law 25 art. 13) | IP, logs, session |
| Product improvement (aggregated, anonymous) | Legitimate interest | Aggregated usage (no identifiable data) |
| Customer support (respond to requests) | Explicit consent / contract | Email, request content |
| Transactional emails (invoices, alerts, renewals) | Contract / legal obligation | Billing email |
No profiling for commercial segmentation, no data resale, no cross-site tracking.
4. Hosting and data locality
All Platform data (accounts, contacts, pipeline, tasks, logs) is hosted on Cloudflare infrastructure, in Canada.
- D1 database:
nam-eastregion (Eastern North America) — physically in Canada - Pages / Workers / R2: same region
- No data transfer outside Canada performed by the Publisher
Sub-processors (Paddle, Cal.com, Chatwoot) may process data outside Canada under their own policies — DPAs (Data Processing Agreements) are signed with each.
5. Retention periods
| Data | Duration | Deletion |
|------|----------|---------|
| Active account (email, password hash) | Subscription duration + 30 days post-cancellation | Automatic at D+30 post-cancellation |
| Contacts, pipeline, tasks, notes | Subscription duration + 30 days post-cancellation | Automatic at D+30 post-cancellation |
| Contact page requests | 24 months | Automatic |
| Raw technical logs (IP, User-Agent) | 30-day rolling | Automatic |
| Security logs (failed logins, alerts) | 90 days | Automatic |
| Paddle invoices | Per Paddle policy (7 years accounting) | Managed by Paddle |
On erasure request (right to be forgotten): we delete within 30 days, except overriding accounting or tax obligations.
6. Your rights (Law 25 Quebec / PIPEDA Canada)
You have the right to:
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure: request deletion (right to be forgotten)
- Portability: receive your data in structured format (JSON/CSV)
- Objection: object to legitimate-interest processing
- Restriction: pause processing pending verification
- Withdraw consent: for consent-based processing
Exercise: email contact@crm.gocontrole.com — response within 30 days.
Complaint: CAI (Quebec) or OPC (Canada).
7. Security
- Encryption in transit: TLS 1.3 (Cloudflare)
- Encryption at rest: Cloudflare D1 / R2 (AES-256)
- Passwords: PBKDF2-SHA256, 100,000 iterations, unique salt per user
- Sessions: HttpOnly, Secure, SameSite=Lax cookies, HMAC-signed, 7-day TTL
- Rate limiting: application limits (IP address and user)
- Admin access: SSH key-only, fail2ban, no passwords
8. Sub-processors
| Sub-processor | Role | Location | DPA |
|---------------|------|----------|-----|
| Paddle.com Market Ltd | Billing, payment, merchant of record | UK / International | ✅ |
| Cal.com (Cal.com Inc.) | Online booking | US / Worldwide | ✅ |
| Chatwoot (Chatwoot Inc.) | Live chat | US / Worldwide | ✅ |
| Cloudflare Inc. | Hosting, DNS, security, Workers, D1, R2 | Canada / Worldwide | ✅ |
9. Cookies and similar technologies
9.1 What a cookie is
A cookie is a small text file placed on your device (computer, phone, tablet) when you visit a website. It allows the site to recognize your device on subsequent visits.
9.2 Cookies used on crm.gocontrole.com
GoContrôle CRM uses only strictly necessary cookies for the service to function.
| Cookie | Type | Duration | Purpose |
|--------|------|----------|---------|
| sha_session | Necessary (session) | 7 days | User authentication (HttpOnly, Secure, SameSite=Lax) |
| __cf_bm | Necessary (Cloudflare) | 30 min | Bot management & security |
| cf_clearance | Necessary (Cloudflare) | Session | Proof of passing the security challenge |
9.3 Why these cookies are strictly necessary
They let us identify you during your session, protect the platform against automated attacks and unlawful content, and keep the service available. Under Article 82 of the French Data Protection Act and Article 5.3 of the ePrivacy Directive, consent is not required for cookies strictly necessary to provide an online communication service explicitly requested by the user.
9.4 No third-party cookies
- No audience analytics tool (GA4 or equivalent)
- No tracking pixel
- No commercial-segmentation cookie
- No cross-site tracking cookie
9.5 Cookie management
You can configure your browser to block or delete these cookies, but the Platform will not work (unable to log in, Cloudflare security errors).
- Chrome:
chrome://settings/cookies - Firefox:
about:preferences#privacy→ Cookies and Site Data - Safari: Preferences → Privacy → Manage Website Data
- Edge:
edge://settings/content/cookies
9.6 Contact
For any cookie-related question: contact@crm.gocontrole.com
10. Minors
The Platform targets professionals (B2B). We do not knowingly collect data from minors under 14 (Law 25 threshold). If you discover that a minor provided data, contact us for immediate deletion.
11. Changes
Material changes are notified by email (billing address) at least 30 days before taking effect. The current version is dated in the header.
12. Contact
GoContrôle — Data Protection Officer
Email: contact@crm.gocontrole.com
Website: https://gocontrole.com