Who we are and scope
Fidrel AB, a Swedish company identified in the company details below, operates fidrel.com and the Fidrel service and is accountable for the personal information it controls about website inquiries, accounts, security and its own customer relationships. For project content that a customer controls, the customer decides how it is used, and Fidrel processes it on the customer’s behalf as a service provider under the customer agreement; contact the project owner first about that content. This notice is intended to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) and the Personal Information Protection Acts of Alberta and British Columbia. As a company established in Sweden, Fidrel also complies with the EU General Data Protection Regulation (GDPR).
Information we collect and sources
From you: name, email address, professional role, organization, inquiries and quote details. From your organization: an administrator may invite you and assign your role. From your use of the service: documents, versions, metadata, reviews, comments and activity in projects. From payments: subscription, billing references and payment status, not full card numbers. Automatically: IP address, browser and device details, and security and error logs. From sign-in providers: the details described below.
Purposes and consent
We collect and use personal information only for purposes a reasonable person would consider appropriate: to provide, secure and support the service; create and manage accounts; process orders, payments and renewals; answer inquiries; detect and prevent fraud, abuse and security incidents; keep tax and accounting records and meet other legal obligations; and maintain and improve the service. By creating an account, placing an order or contacting us, you consent to these uses. We ask for express consent before any new purpose, and for any optional tracking through Cookie settings. You may withdraw consent at any time, subject to legal or contractual restrictions; we will tell you if withdrawing means we can no longer provide part of the service.
Who receives information
Authorized project members see content under the project’s rules. Our service providers are OVHcloud (servers in London, United Kingdom) and Cloudflare for hosting and delivery; Supabase for the database, authentication, document storage and authentication emails; and Stripe for payments when its checkout is used. Stripe may also use information for its own legal obligations. Service providers must protect the information under contract and use it only for the services they provide to us. We disclose information to authorities when the law requires it, and to a successor if Fidrel’s business is reorganized, merged or sold, subject to this notice. Resend sends the service’s email, such as invitations, notifications and invoices. Google provides reCAPTCHA on the website’s forms. Map images come from OpenFreeMap and Esri, and a project’s address is sent to Komoot’s address search (Photon) when the project is placed on the map. Fidrel AI is described in its own section.
Processing outside Canada
Fidrel is based in Sweden, and our providers may process and store information outside Canada, including in the EU/EEA, the United Kingdom and the United States. While it is there, it is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities. We do not promise processing in any single country. We use contractual and other safeguards to give the information a comparable level of protection. Where Quebec law applies, a transfer outside Quebec is assessed as that law requires before it takes place. You may ask us which recipients, countries and safeguards apply. The database and documents are stored with Supabase in Stockholm, Sweden.
Retention
Account information is kept while the account is in use; project content and versions follow the agreed project and retention periods. The recycle bin is not immediate deletion. Inquiries are kept for as long as they need handling and for potential legal claims; tax and accounting records are kept for the period the law requires. Personal information used to make a decision about you is kept long enough for you to request access to it. Documents and folders in the recycle bin are deleted permanently after 30 days, as are schedules, unapproved estimates and supplier invoices in the bin; uploads that are never completed are moved there after one day. Fidrel AI conversations and drafts are deleted 180 days after they were last used, technical logs of AI calls after 30 days, and records of AI usage without content after 400 days. Invitations are valid for 7 days. Database backups are kept for 7 days and then overwritten.
Your privacy rights
You have the right to know whether we hold personal information about you, to access it and to learn how it has been used and to whom it has been disclosed, to challenge its accuracy and have it corrected, and to withdraw your consent. Residents of Quebec also have the right to receive computerized personal information they provided in a structured, commonly used technological format, to ask us to stop disseminating it or to de-index it where Quebec law allows, and to be informed of and to submit observations on any decision based exclusively on automated processing. We verify requests by matching them to your account email, and we may ask for more information when needed. We respond within 30 days, or within any shorter period the applicable law sets; where the law allows an extension, we tell you in writing within that time, with the reason and the new date.
Sign-in with Google, Microsoft or Facebook and deleting your data
If you sign in with Google, Microsoft or Facebook, we receive your name, email address and, where available, profile picture from that service. We use them only to create and recognize your account, never post anything on your behalf and do not read your contacts. You can disconnect the service under Settings in Fidrel or remove Fidrel in the service’s own app settings. To delete your account and personal information, choose Request account closure under Settings, or email [email protected] from your account’s address with the subject “Delete my data”. We confirm the request and delete the account data without undue delay, normally within one month, except what the law requires us to keep, such as tax and accounting records. Content in a customer’s project is handled under that customer’s agreement.
Fidrel AI
When you use Fidrel AI, your question, earlier messages in the same conversation, the page you are on and the project information the assistant reads to answer are sent to OpenAI, which processes them as our subprocessor. The assistant reads only what you yourself have access to, and files or images you attach. Project information may include the names of people on the project. Your name and email address are not sent; OpenAI receives a code that cannot be linked to you without our records. OpenAI does not use the information to train its models and keeps it for up to 30 days to detect abuse. OpenAI may process the information in the United States under our data processing agreement with OpenAI. Your conversations are stored in Fidrel, visible only to you, and deleted after 180 days without activity. The project’s administrator can turn Fidrel AI off for the project. Answers can contain mistakes: check what matters. If you ask Fidrel AI to read a supplier invoice, its contents are sent in the same way.
Privacy officer, requests and complaints
Fidrel’s Privacy Officer is Nikolai Parkkila, Fidrel AB. He is the person in charge of the protection of personal information under Quebec’s Act respecting the protection of personal information in the private sector (in French, the responsable de la protection des renseignements personnels) and the individual accountable for Fidrel’s compliance with PIPEDA and the other Canadian privacy laws that apply. You can reach him at [email protected] with the subject “Privacy officer”, or by mail at the address in the company details below. To make a request, use Settings in Fidrel, including Request account closure to delete your account, or email [email protected] with the subject “Privacy request”. Someone you authorize in writing may make a request for you; we may ask you to confirm your identity and the authorization directly with us. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, where provincial law applies, to the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner of Alberta or the Office of the Information and Privacy Commissioner for British Columbia. Please contact us first so that we can try to resolve your concern.
Security, breaches, children and changes
Access controls and encrypted connections protect the service, although no system is completely secure. If a breach of security safeguards creates a real risk of significant harm to you, or under Quebec law a risk of serious injury, we notify you and the relevant privacy commissioner as the law requires, and we keep a record of breaches as the law requires. The app does not make decisions based exclusively on automated processing with legal or similarly significant effects. Fidrel is a professional service and is not directed to children; we do not knowingly collect personal information from children, and in particular not from children under 14 without the consent of a parent or guardian that Quebec law requires. We will post changes to this notice here and notify account holders of material changes.
Newsletters
Newsletters are planned. A subscription requires a separate, voluntary signup explaining email use and how to unsubscribe. Accepting cookies does not subscribe you. When we send commercial electronic messages, we do so only as Canada’s Anti-Spam Legislation (CASL) allows: with your express consent, or with implied consent such as an existing business relationship, for example within two years after a purchase. Every such message identifies Fidrel, gives our contact details and contains an unsubscribe link, and we act on an unsubscribe request within 10 business days. Service messages about your account, security, orders and billing are not marketing and are sent regardless.
Read the provider’s information
Privacy commissionerContact and company details
- Company name
- Fidrel AB
- Registration number
- 559556-3593
- EU VAT ID
- SE559556359301
- Mailing address
- Paviljongvägen 2 132 40 Stockholm
- [email protected]