Privacy policy

Who is responsible

What we collect, and why

If you are a yard (with an account)

• Your name, your email address and your password, kept only as a hash nobody can read back: to open and protect your account.
• Your yard's name, telephone, address and position on the map: to show them on its public storefront, and to check the yard before publishing it.
• Its OPC permit number, if you give it: for that check only. It is never shown to the public.
• The name and email address of the people you add to your yard, and the password you give them, hashed like yours: to give them access.
• Your vehicles and their photos: to show them on your storefront. A photo loses its metadata on upload, the phone's GPS position included.
• The browser or device of each sign-in, as it names itself, with when it was opened and when it was last used: for the security of your account.

If you are looking for a part (no account)

• Nothing is asked to search.
• If you ask for an arrival alert: your email address, the page's language, the car you are looking for and, only if you shared it, your position rounded to about 110 metres, with the search radius. Then, for each mail, the car it announced and its date. They are used to write to you in your language when a matching car arrives, and never twice about the same one.
• If you press “Find me”: your position, rounded to about 110 metres, limits the search to the yards nearby and gives the distance to each. It is not kept. Your exact position stays in your browser, which centres the map on it and so asks Mapbox for the map of that area.

For everyone's security and to limit abuse: the record of each sign-in, sign-up or change of password or address, with the email address and the IP address; the email address and the IP address of each password reset request, even when no account matches it; the IP address of each alert request. The web server also logs the IP address and the page requested on each visit, without a search's position or the links sent by email.

The record of sensitive actions, which is never changed or erased: the approval or suspension of a yard, with its reason and the administrator's IP address, and the reuse of a former employee's account, with the identifier of that account and, where there is one, of the yard hiring them. It is used to know who did what, and when.

Each vehicle's views are counted without identifying anyone: the count holds only a vehicle, a day and a number.

How long we keep it

An account: name, email address, hashed password

Until its deletion is requested (see Your rights)

A yard, its storefront and its vehicles

With no time limit: a yard and its vehicles are never erased, only taken out of public view, for example when the yard's only member has their account deleted. A photo replaced by another is erased.

The record of sensitive actions

With no time limit: it is never changed or erased

A sign-in session

Ends at most 30 days after it was last used

An ended session

Deleted 30 days later

A session closed by signing out

Deleted 90 days after

The record of a sign-in, a sign-up or a change of password or address, with the email address and the IP address

7 days

A password reset request, with the email address typed, or an address confirmation link

30 days

The IP address of a password reset or alert request

1 day

An alert never confirmed

7 days

A stopped alert, with the list of its mails

Deleted 90 days after it stopped

A confirmed alert

Stopped after 365 days without a single mail, then deleted like a stopped alert

The web server's log: IP address, page requested

Each file, replaced by the next one when it is full, is deleted 7 days later

The database backups

30 days, except the most recent, kept until the next one

The daily copy of the server's whole disk, made by the hosting provider: database, files, logs and backups

Kept 24 hours by OVHcloud

Where the data is, and who can see it

The data is hosted in Quebec, by OVHcloud, in its Beauharnois data centre. OVHcloud also keeps a daily copy of the server there. OVHcloud accesses the data only to provide its service.

Mapbox draws the maps. Your browser loads them from Mapbox's servers, which then receive, as any website does, your IP address and the name and version of your browser, as well as the area of the map shown and the identifier described below. Mapbox is a United States company: this information may therefore be processed outside Quebec.

An email you write to the person in charge first passes through Cloudflare, which forwards it to their mailbox, so Cloudflare receives your email address and what you wrote. Cloudflare is a United States company: this information may therefore be processed outside Quebec.

Piezia sells no information and runs no targeted advertising.

Cookies and browser storage

Two cookies, both needed for the site to work, and neither used for tracking:

• Your session cookie, while you are signed in. The page's scripts cannot read it.
• Your language cookie, which holds only its code, fr or en, for your browsing session.

The yards' space, on the site and in the app, keeps on your device who is signed in, their yard, and a sign-out waiting for the network. The app also keeps there the cars and photos not sent yet, and the sheet being filled in.

Mapbox's maps keep an anonymous identifier in your browser, renewed every day, which Mapbox receives with each map load to count them.

No audience measurement or advertising tool.

Your rights

You can ask for access to your information, for its correction or a copy in a common format, for the deletion of your account, and withdraw your consent. A yard's information can be corrected, but is not erased (see above). We answer within 30 days.

To exercise these rights, write to the person in charge:

If our answer does not satisfy you, you can turn to the Commission d'accès à l'information du Québec.

Privacy incident

If an incident presents a risk of serious injury, we notify the people concerned and the Commission d'accès à l'information, as the law requires.