Privacy Policy
Effective August 22, 2026. Smelter is operated by Groupe Axologique Inc., whose servers are located in Quebec, Canada.
1. Privacy officer
In accordance with Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, Quebec), the person in charge of the protection of personal information is Olivier Bérubé, for Groupe Axologique Inc..
Any question, or request for access, correction, withdrawal of consent or deletion, goes to [email protected]. We answer within 30 days.
2. Information we collect
Your IP address is used in memory, for the duration of the request, to rate-limit sign-in and sign-up attempts. It is not stored in the database.
- Account: your display name, your email address, a hash of your password (scrypt — the password itself is never stored), the creation date and the verification state of your email.
- Organization: your organization's name, your role, and the invitations you send or receive.
- Submitted content: the items (bugs, tasks, ideas), comments, documents, mockups, attached images and conversations with Pierre AI that you or your colleagues write in your workspace.
- Client registry: the information you enter about your own clients and contacts — name, email, phone, title, address details and free-form notes.
- Billing: your plan, the subscription status and the customer identifier at our payment provider Stripe. No card number ever passes through our servers.
- Usage: the number of calls and tokens consumed at Pierre AI, per organization and per user, to enforce the quotas of the plan.
- Technical access: the hashes of your API tokens and of your single-use tokens (email verification, password reset, invitation), with their issue and use dates.
3. Purposes
We use this information only to: provide the service and render your workspace, authenticate you and protect your account, have your items analyzed by Pierre AI, manage your organization and its members, enforce the quotas and the billing of your plan, send you service email (verification, invitation, reset), and meet our legal obligations.
We do no advertising profiling, and we neither sell nor rent personal information. Any other use would be the subject of separate, prior consent.
4. Artificial intelligence (Pierre AI)
Pierre AI is a service of Groupe Axologique Inc., hosted in Quebec. No data leaves Quebec for this function.
What is sent for the analysis of an item: its title, its description, its fields, the thread of human comments, and the list of items of the same organization used to detect duplicates. Pierre AI classifies, summarizes and states a hypothesis; it never decides in your place.
What is stored in the team memory is the prose written by Pierre AI — its summary, its hypothesis, the human decision and the link back — and not your raw input.
5. Hosting and disclosure to third parties
- Service data is hosted on servers located in Quebec, Canada, administered by Groupe Axologique Inc..
- Stripe (payments): billing information is processed by Stripe, whose servers are located notably in the United States.
- Cloudflare (network): traffic to the service transits Cloudflare's global network, which acts as a technical agent.
- Outbound email provider: service email (verification, invitation, reset) transits our SMTP relay.
- No other third party receives personal information, except where required by law.
6. Information about your own clients
The client registry lets you record personal information about third parties. For that information you remain responsible for the collection, the consent and the purpose; Smelter acts as an agent and processes it solely to provide you the service.
We do not consult it, we disclose it to no one, and we delete it along with your organization when you close your account.
7. Retention and destruction
Information is kept for as long as your account is active. Deleting your account, from Settings or on written request, immediately erases your profile, your memberships, your access tokens, your conversations with Pierre AI and your usage counters.
If you are the last person in your organization, all of its content is erased as well: items, comments, documents, mockups, images, client registry and subscription. Backup copies are encrypted and destroyed no later than 30 days after they are created.
8. Security
In the event of a confidentiality incident presenting a risk of serious injury, we will notify you as well as the Commission d'accès à l'information du Québec, as required by law.
- Encrypted transport (HTTPS/TLS) for every communication, with HSTS.
- Passwords hashed with scrypt; verification, invitation, reset and API tokens stored hashed — a copy of the database yields no usable secret.
- Integration keys encrypted at rest.
- Strict per-organization isolation: a request aimed at another organization is treated as non-existent.
- Rate limiting on sign-in, sign-up and password reset attempts.
9. Cookies
Smelter uses a single, strictly necessary cookie: the session cookie that keeps you signed in. It is signed, HTTP-only, sent over HTTPS only, and expires after 30 days at the latest. No advertising, analytics or tracking cookie is used.
10. Your rights
At any time you may access the information we hold about you, have it corrected, withdraw your consent, obtain a portable copy of your information, and request the deletion of your account.
Export and deletion are available directly in Settings, section “Account and personal information”. You may also write to [email protected].
If you are dissatisfied with how your request was handled, you may file a complaint with the Commission d'accès à l'information du Québec.
Settings Commission d'accès à l'information du Québec
11. Changes
Any material change to this policy will be published on this page with a new effective date, and announced to account holders.