Assessment of communications outside Québec
Last updated: October 18, 2026
This English version is provided for convenience. In case of any discrepancy, the French version prevails. Read the French version
1. Purpose
Before communicating personal information outside Québec, the law requires that a privacy impact assessment be conducted (section 17 of the Act respecting the protection of personal information in the private sector). This document presents the assessment made by Kitobiz for each of its providers. It supplements the Privacy policy and the Processing agreement.
2. Method
For each provider, we considered the four factors provided for by the law:
- the sensitivity of the information communicated;
- the purpose for which it is to be used;
- the protection measures, contractual and technical, that apply to it;
- the legal framework applicable in the State in which it is communicated, including the protection principles recognized there.
The communication takes place only if the assessment concludes that the information receives adequate protection, in particular in light of generally recognized protection principles. Each provider is bound by a written data processing agreement that governs the use, confidentiality, security and deletion of the information.
3. Assessment by provider
Supabase
- Purpose
- Database, authentication, file storage (always)
- Location
- Ireland (European Union)
- Information
- All of the service's data (accounts, clients, documents, files)
- Sensitivity
- High
- Legal framework
- European Union: General Data Protection Regulation (GDPR), a regime recognized as offering protection comparable to Québec's.
- Protection measures
- The provider's data processing agreement (DPA); encryption at rest and in transit; access partitioned by business (row-level security on all tables); public data API closed; integration tokens encrypted by Kitobiz.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
Vercel
- Purpose
- Hosting of the application (always)
- Location
- Ireland (European Union); pages delivered through a global network
- Information
- Data processed for the duration of a request; technical logs
- Sensitivity
- Medium
- Legal framework
- European Union: General Data Protection Regulation (GDPR), a regime recognized as offering protection comparable to Québec's.
- Protection measures
- The provider's DPA; processing set to run in Dublin; encrypted exchanges (HTTPS); no data kept outside the technical logs.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
Sentry
- Purpose
- Reporting of technical errors (always)
- Location
- Germany (European Union)
- Information
- Technical error messages, with no name, email, phone number, cookie or form content
- Sensitivity
- Low
- Legal framework
- European Union: General Data Protection Regulation (GDPR), a regime recognized as offering protection comparable to Québec's.
- Protection measures
- The provider's DPA; emails, phone numbers and tokens scrubbed before sending; no session recording; data in the European Union.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
Resend
- Purpose
- Sending of emails (always)
- Location
- United States
- Information
- Recipient's address, name, content of the emails (quotes, invoices, reminders, appointments)
- Sensitivity
- Medium
- Legal framework
- United States: no general federal law on the protection of personal information; state laws (e.g. California); possible access by U.S. authorities under laws such as the CLOUD Act or FISA.
- Protection measures
- The provider's DPA; encrypted transmission; content limited to what the user sends; links to the documents rather than the documents themselves.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
Stripe
- Purpose
- Kitobiz subscription; online payments on the user's Stripe account (online payment enabled)
- Location
- United States and Canada
- Information
- Amounts, payer's email; card data is entered directly with Stripe
- Sensitivity
- High
- Legal framework
- United States: no general federal law on the protection of personal information; state laws (e.g. California); possible access by U.S. authorities under laws such as the CLOUD Act or FISA.
- Protection measures
- The provider's DPA; PCI DSS Level 1 certification; no card data passes through Kitobiz; signature verification of every event received.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
Cloudflare (Turnstile)
- Purpose
- Anti-bot protection of public forms (public forms)
- Location
- United States
- Information
- Technical characteristics of the browser, IP address
- Sensitivity
- Low
- Legal framework
- United States: no general federal law on the protection of personal information; state laws (e.g. California); possible access by U.S. authorities under laws such as the CLOUD Act or FISA.
- Protection measures
- The provider's DPA; no data entered in the form is transmitted; service designed without advertising tracking.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
Twilio
- Purpose
- Text messages (SMS) and the assistant's phone numbers (sms or phone assistant enabled)
- Location
- United States
- Information
- Phone numbers, content of text messages, call routing
- Sensitivity
- Medium
- Legal framework
- United States: no general federal law on the protection of personal information; state laws (e.g. California); possible access by U.S. authorities under laws such as the CLOUD Act or FISA.
- Protection measures
- The provider's DPA; SMS only to clients who have not objected, with unsubscribe; numbers released 30 days after the end of the subscription.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
ElevenLabs
- Purpose
- Voice and phone assistant: speech recognition and synthesis, transcription (assistant enabled)
- Location
- United States
- Information
- Voice and transcription of calls, name and email if the caller gives them
- Sensitivity
- High
- Legal framework
- United States: no general federal law on the protection of personal information; state laws (e.g. California); possible access by U.S. authorities under laws such as the CLOUD Act or FISA.
- Protection measures
- The provider's DPA; fixed notice to the caller from the start of the call; the assistant never asks for banking data or a password; access to invoices only after a verification code; transcriptions erased according to the duration set by the plan.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
- Purpose
- Sign-in with Google; Google Calendar and Google Meet (if the user connects them)
- Location
- United States
- Information
- Email, name and photo (sign-in); service, time, location and client contact details of confirmed appointments (Calendar); start and end of the user's busy events, read but not kept
- Sensitivity
- Medium
- Legal framework
- United States: no general federal law on the protection of personal information; state laws (e.g. California); possible access by U.S. authorities under laws such as the CLOUD Act or FISA.
- Protection measures
- Google's data processing terms; access limited to calendar events; of the user's own events, only the start, end and “busy” status are read, never the title, description or guests; access tokens encrypted by Kitobiz; can be disconnected at any time.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
OpenAI
- Purpose
- Reply drafts (“Suggest a reply”) and appointment notes (transcription and summary) written by artificial intelligence; reading of expense receipt photos (when the user asks for a suggestion or for appointment notes, or uploads a receipt photo)
- Location
- United States
- Information
- Recent exchanges with the client or lead, their name and language, their open quotes, invoices and appointments; the business's services and opening hours; an appointment's audio recording or notes, when the user provides them; a photo of a receipt or supplier invoice uploaded by the user
- Sensitivity
- Medium
- Legal framework
- United States: no general federal law on the protection of personal information; state laws (e.g. California); possible access by U.S. authorities under laws such as the CLOUD Act or FISA.
- Protection measures
- OpenAI's API data processing terms: data not used to train its models and kept at most 30 days for abuse monitoring; sent only when the user clicks; never banking details, tax numbers or internal notes (a receipt photo only shows what is printed on it); the draft is not kept by Kitobiz and only reaches the client if the user sends it themselves; an appointment recording requires confirming the participants' consent, and Kitobiz deletes the audio as soon as it is transcribed.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
Intuit (QuickBooks), Sage
- Purpose
- Accounting synchronization (if the user connects them)
- Location
- United States
- Information
- Synchronized clients, invoices, payments and expenses
- Sensitivity
- Medium
- Legal framework
- United States: no general federal law on the protection of personal information; state laws (e.g. California); possible access by U.S. authorities under laws such as the CLOUD Act or FISA.
- Protection measures
- The provider's processing terms; synchronization chosen by the user; access tokens encrypted by Kitobiz; can be disconnected at any time.
- Conclusion
- Adequate protection: the communication is authorized for this purpose only.
4. Measures common to all providers
- Minimization: each provider receives only the information necessary for its task.
- Encryption of exchanges (HTTPS) and, at the hosting provider, of data at rest.
- Main data hosted in the European Union (Ireland), under the GDPR.
- Optional services (phone, calendar, accounting) enabled only if the business chooses so, and can be disabled at any time.
- Limited retention periods and complete deletion when an account is closed.
5. Residual risk and review
For providers located in the United States, the main residual risk is access by U.S. authorities under their laws. It is considered acceptable given the sensitivity of the information, the minimization and the providers' contractual commitments, which provide in particular for challenging abusive requests and informing their customers of them where the law permits.
This assessment is reviewed each time a provider is added or changed, upon a significant change in the legal framework of a State, and at least once a year.
Person in charge: Marie-Andrée Aubergiste, person in charge of the protection of personal information, info@kitobiz.com.