Privacy policy
We keep the bare minimum. This policy explains what personal information we collect, why, who sees it, where it is kept, for how long and how to exercise your rights, under Quebec’s Loi sur la protection des renseignements personnels dans le secteur privé (Act respecting the protection of personal information in the private sector, as amended by Law 25, or “Loi 25”). No artificial intelligence reads a review on its own: it steps in only when a person asks for it, as explained below.
Last updated: November 7, 2026
Person in charge of the protection of personal information
The person below sees to the application of this policy and of the law. Your requests go to them.
- contact@lebonpro.ca
To write to them, use the contact details in the “Contact us” page.
If you visit the site without an account
Searching for a contractor and viewing a profile do not require an account, and we do not ask you for any personal information.
- No third-party traffic analytics tool, no advertising and no tracker is used. The site does not install any cookie until you are signed in.
- Like any site, our host receives the network address (IP address) and technical information from your browser to answer your requests and protect the site against abuse. These technical logs are kept by the host, under its own rules.
- When you create an account, sign in, ask for a link, file a review or a file, or use the writing help, we count your attempts by network address (for an IPv6 address, by network prefix) to limit abuse. For sign-ins, this counter is tied to the email address tried. These counters are erased after one day at most.
- For each profile and each day, we count how many times it is opened and how many times its phone number, its email address or the “Write a review” button are clicked. These are totals, with no identifier, no network address and no account: they do not say who looked. So as not to count the same visit twice within 30 minutes, the abuse counter keeps, for one day at most, a one-way fingerprint of your network address and of the profile. The company sees the totals for its own profile.
What we collect
If you have an account
- Your email address, and your first name if you give it (optional).
- A fingerprint of your password (hashed and salted): we neither know nor keep the password itself.
- The dates the account was created and confirmed.
- For each signed-in device: a random session identifier (we keep only its fingerprint), a label such as “Firefox · Linux” that helps you recognize your devices, and the start and expiry dates. We do not keep your browser’s full identification.
- The links sent by email (confirmation, new password): we keep only their fingerprint, until they expire.
If you write a review
- Your five ratings from 1 to 5, the text of the review and the date of the work.
- The first three characters of the postal code of the job site (for example G1R). Neither the job site’s address nor your home.
- Optional: invoices as proof (PDF or photo, 5 MB at most, three per review), kept private. They may contain your name and address: attach only what is useful.
- Optional: the company’s email address, only if its public profile has none. It is only a hint for our team: the site never sends anything to it, and the company is notified only at the address on its public profile or its claimed profile. It is erased when the review is published or removed.
- The review’s history: filing, edits, decisions by our team, with the dates.
- Your rejoinder, if you reply to the company, and the “Problem solved” mention if you tick it.
If you represent a company
- The same account (email, first name, hashed password), the number of the licence whose profile you hold and the date of the claim.
- If the public profile has no email, or if the profile is disputed: the text you write to prove your connection with the company.
- The company’s plan (replies, writing help) and the writing-help credits used.
- Your replies to reviews.
- For the writing help: a metadata log only (date, type of help, review concerned, credits and tokens used). Neither the draft you write nor the AI’s reply is kept there.
If you write to us
- Your message and your email address, kept for the time needed to reply and follow up on your request.
What our team records
- Each action by an administrator (publication, removal, suspension, request for an AI opinion, etc.) is recorded with identifiers, a reason and an internal note, with no review text and no email address.
Why we use it, and on what basis
We use your information only for the purposes below, which are those for which you entrust it to us. We do not sell it, do not use it for advertising and do not disclose it for prospecting purposes.
- Managing your account: identifying you, confirming your address, signing you in, resetting your password, writing to you about your account. Basis: the contract you enter into by creating an account, and your consent.
- Publishing and moderating reviews: showing your review without your name, notifying the company, checking that the rules are respected, handling reports. Basis: your consent, given by filing the review after reading this policy.
- Weighting reviews: the date of the work and the presence of an invoice are used to calculate the displayed average. Basis: the same consent.
- Serving companies: letting them claim their profile, reply and, with the plan that includes it, use the writing help. Basis: the company’s contract.
- Protecting the site: limiting abuse (sign-in attempts, email sends, review filings) and keeping the service you use secure. Basis: the contract, limited to what is necessary.
- Responding to your requests and your reports. Basis: your request.
- Complying with the law, for example responding to a court order.
Who sees what
The public
Everyone sees the number of published reviews of a company and their average. Subscribers also read the text of each review, its ratings by criterion, the month of the work, the job site’s area (three characters of the postal code), its trust level and the company’s reply. Ratings by criterion are shown only from three published reviews. No one there sees your name, your email, your account or the exact day of the work.
The company
When a review is filed, the company is notified by email, at the address on its public profile from the Régie du bâtiment du Québec or, failing that, at the address the author gave. It can read the review for free, with a private link, even without an account or subscription. It sees the text, the ratings, the month of the work and the trust level. It does not see the job site’s area, or the author’s name or email. It is notified as soon as the review is filed, with no added delay: the time of the email it receives therefore tells it roughly when the review was written. The review is published only after an email has actually been sent to it, at an address that belongs to it: if we cannot reach it, a person on our team decides what happens next.
Be careful: the content of a review can, on its own, let a company guess which customer it comes from (the job, the date, the details). Write nothing you do not want it to know.
Invoices attached as proof are never shown to the company or to the public.
Our team
The people on our team who do moderation and support see the content of a review, its history, the account that wrote it and the attached invoices, only to do that work. Their actions are recorded.
Others
We neither sell nor rent your information. We disclose it only to our service providers (below) and when the law or a court requires it.
If we give third parties access to the site’s data through an application programming interface (API), the identity of review authors is never included.
Our providers and where data is stored
We use the following providers. Each receives only what its role requires.
- Cloudflare (United States): network and hosting of the site, running the code, storage of proof files and sending of the site’s emails. The site’s code runs in the Cloudflare data centre closest to the person visiting, including outside Quebec and Canada.
- PlanetScale (United States): the database (accounts, reviews, history), hosted in Montréal, Canada.
- Proof files: kept in Cloudflare’s R2 storage, configured for eastern North America. We cannot guarantee that they stay in Canada.
- Anthropic (United States): artificial intelligence, only at a person’s request, explained below.
The site’s emails (account confirmation, new password, notices to companies, moderation decisions) are sent from the address contact@lebonpro.ca. The text of a review is never in the email that notifies the company: only a private link.
Information may therefore be processed outside Quebec. Before entrusting any to a provider, we assess the risks and we limit what we send it.
Artificial intelligence (Anthropic): only on request
No artificial intelligence (AI) reads a review on its own. When a review is filed, edited or published, no AI analyzes it: there is no automatic filter and no automatic analysis. The AI steps in only when a person asks for it, in the two cases below.
For this we use the application programming interface of Anthropic, a company based in the United States.
- At the request of an administrator on our team, on a specific review, only when useful: the AI’s opinion on an exchange. This is possible only if the company has replied to the review. The following are then sent to Anthropic: the text of the review, that of the company’s reply and that of the rejoinder if there is one, the overall rating, the review’s trust level and the number of attached invoices. Your name, your email, the company’s name, the date and the area of the job site are not added, and the invoices are never sent. The AI gives advice. A person decides.
- At the request of a company that has the plan with AI: writing help for its reply (fixing its text, suggesting a reply). The help starts only when the company clicks the button. What is sent is the draft and the intent that the company wrote or chose and, for a suggested reply, the text of the review concerned and its overall rating. The site checks that the company’s text contains no contact details before sending it.
These texts are sent as data to examine, never as instructions. For the opinion on an exchange, the model replies only with a closed-choice verdict, which the site checks. For the writing help, it replies with a draft that the company rereads.
The AI never decides on its own: it does not publish, remove or refuse any review or any reply. Anthropic processes these texts to answer us, under its own terms, and may do so outside Quebec. Without a request, nothing is sent. When the AI is not available, nothing is sent either and a person decides.
Automated decisions
No decision about you, your review or a reply is made solely by automated processing, and the AI decides nothing. It is people on our team who read the reviews that are set aside, who decide on removals and who publish the exchanges.
A few simple rules of the site apply by themselves, without AI. The site refuses a text that contains personal information (email, phone, web address, full postal code, street address) and tells you right away, so that you can correct it. A review that contains certain abusive or threatening words, or that arrives in large numbers about the same company, waits for a person to read it before the company is notified. A review the company does not reply to is published 48 hours after it has actually been notified. None of these rules removes a review.
You can ask a person to review any decision that concerns you: see “Your rights”.
How long we keep it
- Your account: as long as it exists. You can ask for it to be closed and your information destroyed at any time.
- Sessions: 30 days at most. They end when you sign out or change your password.
- Confirmation links: 2 days. New-password links: 1 hour. We erase their fingerprints one week after they expire.
- Abuse counters: one day at most. Account whose email address was never confirmed: destroyed after 14 days.
- Profile view totals (per profile and per day, with no personal information): 400 days.
- Reviews: as long as the site operates. You can edit one until the company has been notified of it, and cancel it until it is published (it is then deleted, with your attachments). A removed review stops being displayed; we keep a record of the decision, and its text for 90 days at most, the time to handle a challenge, after which the text is emptied.
- Attached invoices: as long as the review exists. They are destroyed when the review is removed and when their author’s account is destroyed.
- History of our team’s decisions: identifiers, codes and internal notes only.
- Emails you write to us: the time needed to reply and follow up on your request.
- AI opinions requested by our team: the verdict, the codes of the checks, the trust level, the model name and a fingerprint of the texts read are kept with the review’s history, and deleted with it if you cancel it. The short excerpts of your text that the AI quotes (160 characters at most) are erased when the review is removed or cancelled or when the account is destroyed. The text sent to Anthropic and its full reply are not kept by us. Our team’s internal notes are checked so that they contain no personal information.
- Backup copies: copies made by our database host may keep this information briefly after its destruction, until they are replaced.
If you ask for your account to be destroyed
- Your email, your first name and your password are destroyed. The account is made anonymous and can no longer be used to sign in. Your sessions, your pending links, your claim requests and the emails kept for your address are erased.
- Your attached invoices are destroyed.
- A published review that contains no personal information stays displayed, detached from your account and with no link to you: it concerns the company, it was published for the public, and the averages that others consult rely on it. We keep its text, its ratings, the month of the work and the three characters of the job site’s postal code, nothing that leads to you. If you would rather have your published reviews removed, say so in your request, or ask for the removal of each one from the “My reviews” page.
- Any other review (not yet published, or published but containing personal information) is removed, its reply too, and its text is emptied.
- For a company account: the profile is released (it becomes unclaimed again). Replies already written stay with their reviews, because they are the company’s words.
Your rights
You have the right:
- to access your information and obtain a copy of it;
- to have inaccurate, incomplete or equivocal information corrected;
- to withdraw your consent to the use of your information, subject to what the law requires us to keep and what the service entails (no account, no review);
- to ask for your information to be destroyed;
- to ask us to stop disseminating personal information about you, or to de-index it, in the cases provided by law;
- to obtain your information in a structured, commonly used technological format;
- to ask that a person review any decision that concerns you (none is made solely by automated processing);
- to cancel a review until it is published (“Cancel my review” button: the review and your attachments are deleted) and then, once the review is published, to ask for its removal from the “My reviews” page: a person on our team decides within 30 days, replies to you by email with their reason, and if they remove the review, the company’s reply is removed with it;
- to file a complaint with the Commission d’accès à l’information du Québec if you think your rights are not being respected.
How to exercise them
Write to the person in charge, at the address given in the “Contact us” page, stating what you are asking for. To be sure the request comes from you, we reply to your account’s email address and may ask you for a confirmation.
We reply within 30 days of receiving your request. If we refuse, we give you the reasons and inform you of your recourse before the Commission d’accès à l’information.
The Commission d’accès à l’information du Québec: cai.gouv.qc.ca.
Confidentiality incidents
If an incident affects your personal information (unauthorized access, use or disclosure, loss or any other breach of its protection), we take measures without delay to reduce the risk. If it presents a risk of serious injury, we promptly notify the Commission d’accès à l’information and the people affected. We keep a register of incidents.
Security
- Passwords are kept as salted fingerprints: we cannot read them.
- Exchanges with the site are encrypted (HTTPS). The session cookie cannot be read by the page’s scripts.
- Attached invoices are in private storage: no public address leads to them and only our moderation team can open them.
- Access to our team’s tools is reserved for administrator accounts, and each action is recorded.
- The site limits sign-in and sending attempts to curb abuse.
Minors
The site is aimed at adults: you must be 18 to create an account. If we learn that an account was opened by a child under 14 without the consent of the person with parental authority, we close it.
Changes to this policy
We update this policy when our practices change. The date of the version is at the top of the page. We notify you of any significant change before it applies.