Privacy policy

1. Who we are and to whom this policy applies

Kitobiz (“we”) is a Québec online service for self-employed workers and small businesses: business card, quote and appointment requests, quotes, invoices, payments, reminders, cash flow and phone assistant.

The person in charge of the protection of personal information is Marie-Andrée Aubergiste, person in charge of the protection of personal information. You can reach this person at info@kitobiz.com.

This policy applies to five groups of people:

• users who have a Kitobiz account;
• users' clients (invoices, quotes, payments, reminders);
• visitors of a public business card;
• people who fill out a form, request a quote or book an appointment;
• people who call the number of a user's phone assistant;
• a user's clients whom their assistant calls about an unpaid invoice.

2. Information we collect

We collect only what is necessary for the service. Payment card data is entered with Stripe and does not pass through our servers.

3. Why we use it

We use this information to provide the service, never to sell it nor for advertising.

• Create and secure accounts (mandatory two-step verification, detection of unusual sign-ins).
• Produce and send the documents the user prepares: quotes, invoices, receipts, reminders, appointment confirmations.
• Collect online payments on the user's Stripe account and manage the Kitobiz subscription.
• Pass on to the user the requests, appointments, messages and calls received through their card or their number.
• Measure the traffic of a card for its owner, in anonymized form.
• Troubleshoot and improve the service.

Consent. By creating an account, the user accepts this policy; the date and the version accepted are recorded. A person who fills out a form or books an appointment consents to their information being passed on to the business concerned. Text messages (SMS) are sent only to clients who have not objected to them, and each client can unsubscribe from them.

Tester questionnaire. Kitobiz invites its testers to fill out a questionnaire at the end of their trial. The answers are used to improve the application and to adapt the plans. The last questions (age group, gender, membership in a visible minority) and the question on revenue are optional and always offer the choice "I prefer not to answer"; answering or not changes nothing to the trial. Membership in a visible minority is sensitive information: we collect it only with the express consent given by a voluntary answer. These answers are used only to produce overall statistics on the people who use Kitobiz, for example in an application for funding or for a support program, never in a way that identifies a person. They are seen only by the Kitobiz team, are neither sold nor used for advertising, and the tester can ask at any time to see, correct or delete them (section 9).

4. Our role depending on the data

For the data of their own clients, visitors, respondents and callers, it is the user who decides why they collect it; Kitobiz processes it on their behalf, according to their instructions. For users' account data, Kitobiz is responsible.

In practice, a person who wants to exercise their rights over the data a business keeps in Kitobiz first contacts that business; Kitobiz helps the business respond. Each business sees only its own data: access is limited by organization, in the application as well as in the database.

Kitobiz's obligations toward the businesses that use it are set out in the Personal information processing agreement, accepted by each business.

5. Providers and communications outside Québec

We entrust certain tasks to providers, who receive only the information necessary for their task. Several are located outside Québec and Canada, in particular in Europe and the United States. Before entrusting information outside Québec, we conduct a privacy impact assessment and make sure it receives adequate protection.

Google Calendar. If the user connects their Google Calendar, Kitobiz adds their confirmed appointments to it: the service, date, time, location and client contact details, with a Google Meet link for video calls. Kitobiz also reads the start and end of the user's events, to know whether they are marked “Busy”, so as not to offer those times for booking. When the user opens their own calendar in Kitobiz, Kitobiz also reads the title and location of these events, only to show them to the user when they click a busy time; they are never shown to their clients, nor on their booking page, nor sent to an artificial intelligence service. Kitobiz reads neither the description nor the guests of these events, and keeps neither these times, titles nor locations: they are looked up when displayed, then forgotten. Data received from Google is used only for these features; it is never sold or used for advertising. The user can disconnect Google Calendar at any time in Settings › Integrations.

Replies suggested by artificial intelligence. When the user clicks “Suggest a reply” in Messages, Kitobiz sends OpenAI the recent exchanges with that client or lead, their name and language, their open quotes, invoices and appointments, and the business's services and opening hours, to write a draft. Nothing is sent without that click, and never banking details, tax numbers or internal notes. OpenAI does not use this data to train its models and keeps it no longer than 30 days. Kitobiz does not keep the draft: the user reviews it, edits it if needed, and alone decides to send it.

Appointment notes. The user can record an appointment, upload a recording or paste notes, to get a summary and follow-ups. A recording is only possible after confirming that the participants agreed to be recorded. The audio is sent to OpenAI for transcription, then deleted by Kitobiz as soon as it is transcribed; the transcript and summary stay in the appointment's record until the user deletes them or the account is closed. Nothing is sent to the client.

Receipt photos. When the user uploads a photo of a receipt or supplier invoice in Expenses, Kitobiz sends it to OpenAI to read the supplier, date, amounts and taxes. Only the photo is sent; it shows only what is printed on the receipt. OpenAI does not use this data to train its models and keeps it no longer than 30 days. The amounts read fill in the expense, which the user checks before saving it; the photo stays in Kitobiz's private storage with the expense.

The access the user gives to Google, QuickBooks or Sage is kept encrypted. The detailed assessment, provider by provider, is published: Assessment of communications outside Québec.

6. Phone assistant and voice assistant

When a person calls the number of a business's assistant, the call is handled by an automated assistant and transcribed; a transcription and a summary are kept for the business. The caller is informed of this from the start of the call by the sentence “This call is handled by an automated assistant and transcribed to follow up on your request.” (in French: « Cet appel est traité par un assistant automatisé et transcrit pour donner suite à votre demande. »), which the business cannot remove.

Reminder calls. With the Professional and Premium plans, the business can ask its assistant to call a client about an unpaid invoice. Each call is first approved by the business; it takes place Monday to Friday, 9 a.m. to 7 p.m., never on a statutory holiday, at most three times per invoice. The assistant says from the start that it is an automated assistant and that the call is transcribed, and it only talks about the invoice after checking it is speaking with the right person. On voicemail, it leaves a neutral message with no amount. It never asks for a card number or banking information: payment is made through the invoice's link, sent by text or email if the client wishes. The transcription, the summary and the outcome (for example a promised payment date) are kept in the invoice's history, for the business. The call is handled by ElevenLabs and goes through Twilio, like incoming calls.

• The assistant gives a price, a schedule or an availability only from the business's information; an appointment is booked only in a time slot that is actually free.
• It looks up an invoice only after identity verification by a code sent to the contact information already on file.
• It never asks for or accepts a card number, a password or other sensitive data.

The voice assistant built into the application processes the user's voice to carry out their requests; any action that changes something (sending, payment, new client, automation) waits for a confirmation click from the user.

7. Retention period

We keep the information for as long as necessary for the service, then we destroy it automatically; some periods depend on the business's plan.

The business can choose a shorter period for calls. The other data (clients, quotes, invoices, payments, cards, forms and their files) is kept as long as the account is active or until the user deletes it.

When an account is closed, the subscription is cancelled and all of the business's data is deleted immediately; the user is invited to export beforehand the documents they must keep for their tax obligations. The payment information kept by Stripe follows Stripe's policy.

8. Security and incidents

We protect the information with measures suited to its sensitivity.

• Encrypted exchanges (HTTPS); mandatory two-step verification for users; new verification before sensitive actions.
• Access limited to the data of one's own business, and according to each member's role; clients' files (attachments, forms) in private spaces, opened by temporary links; public links to quotes, invoices and appointments that expire after a time.
• Access by Kitobiz staff limited by role, logged, and justified for sensitive actions.

In the event of a confidentiality incident, we take the measures to reduce the risk, we record it in a register and, if it presents a risk of serious injury, we notify the Commission d'accès à l'information and the persons concerned.

9. Your rights

Any person may request access to their information, its rectification, its deletion, its portability, or withdraw their consent; we respond within 30 days.

• Users: most data can be viewed and changed in Settings. Settings > My account lets you export all your data and close your account.
• Clients, respondents, callers: contact the business concerned, or us, and we will pass it on.
• Complaint: you can contact the Commission d'accès à l'information du Québec.

Requests are made to the person in charge named in section 1.

10. Cookies, anti-bot and visit measurement

Kitobiz uses no advertising cookie and no third-party analytics tool.

• Necessary cookies: sign-in session and proof of two-step verification, for users only.
• Anti-bot: public forms use Cloudflare Turnstile, which analyzes the browser to tell a person from a bot.
• Measurement of a card's visits: each click is counted with the device, the origin and a non-reversible encrypted fingerprint; no IP address is kept for this count.
• Referral cookie: a person who arrives through an affiliate's link (kitobiz.com/r/CODE) keeps that affiliate's code for 90 days in a cookie, so that their sign-up is attributed to the affiliate. Visits to the link are only counted per day, with no data about the person. The affiliate does not see the names of the businesses they referred; the payout details they provide (name, Interac email, GST and QST numbers) are used only to pay them their commissions. For a partner who is not a client, we also keep their name, their email, their organization and their application, in order to manage their participation and to write to them about the program.
• Origin cookie: a person who arrives through the link of a Kitobiz ad or campaign ("utm" parameters or a Google ad click) keeps the source, the campaign and the landing page for 90 days in a Kitobiz cookie. At sign-up, this information is saved with the account to know which ads bring sign-ups. It contains nothing about the person and is shared with no third party.

11. Changes and contact information

We may change this policy; the date of the update is shown at the top of the page. In the event of a significant change, users are notified by email or in the application before it comes into force.

Questions and requests: Marie-Andrée Aubergiste, person in charge of the protection of personal information, info@kitobiz.com.