01 — Selection principles
A provider receives only what its service requires.
Before assigning processing, we consider the nature and purpose of the information, confidentiality commitments, safeguards, incident handling, deletion, and possible processing locations. Contractual obligations are adapted to the provider’s role and risk.
Information may be processed in Canada, the United States, or another jurisdiction. Before processing outside Quebec, we assess relevant privacy factors and use reasonable contractual or organizational protections.
02 — Service categories
Functions that may rely on specialized providers.
| Category | Purpose | Possible information |
|---|---|---|
| Service operations | Provide accounts, retain records, process requested operations, and maintain availability. | Account, company, file, and technical information necessary for the service. |
| Artificial intelligence — Anthropic | Provide Ask Flow, coaching, document extraction, optional import mapping, lead qualification, and unclear appointment-reply assistance after explicit, versioned permission. For automated lead processing, the company owner must confirm authority to share the listed company, lead, and customer data. | Depending on the enabled feature: prompts and messages; permitted company, customer, lead, project, estimate, schedule, workforce, and financial context; explicitly attached documents; or lead identity, contact details, conversation, and appointment context. Permission can be declined or revoked without disabling non-AI features. The customer company remains responsible for its legal basis, required notices, and any consent required by applicable law. Anthropic privacy policy. |
| Communications | Deliver SMS, email, or notifications and report status. | Contact details, message content, status, time, and delivery information. |
| Booking and calendar — Google Appointment Schedule, Calendar, and Meet | Embed or open Google’s public schedule, display availability, confirm the selected appointment, and provide Calendar and Meet details. | Technical request information and, when entered in Google’s form, name, contact details, time zone, responses, and selected time. |
| Mapping and address search | Suggest an address, display a place, and support jobsite functions associated with a location. | Address search, selected address, technical identifiers, and—only when the feature requires it and permission is granted—approximate or precise location. |
| Connected accounting — Intuit QuickBooks Online | Authorize and verify the selected accounting company and, after explicit user review and confirmation, transfer selected customers, finalized invoices and recorded payments one way from Fondation Flow to QuickBooks. | QuickBooks company identity, country, currency and configuration; selected customer identity, contact details and billing address; finalized invoice and recorded payment details; and limited Intuit entity identifiers and synchronization results. Limited webhook metadata is collected only if a separately reviewed provider-event workflow is enabled. OAuth access and refresh credentials are stored server-side and removed after the authorized user completes the in-app disconnect cleanup. |
| Subscription payment — Helcim | Securely collect the payment method, verify an authorized payment, administer the Fondation Flow subscription, and process future scheduled charges. | Billing contact and address, plan amount, payment method and card data entered directly in Helcim’s protected fields, transaction/subscription identifiers, status, and billing dates. Fondation Flow does not receive or store the complete card number or security code. |
| Public website and security | Deliver the website, maintain availability, and prevent abusive use. | IP address, request, device, browser, and security event information. |
The identity and processing location of an active provider may be disclosed to a Customer with a legitimate compliance need, subject to applicable confidentiality and security measures.
03 — Customer-connected services
Some information moves because the Customer enables a connection.
An advertising platform, calendar, payment service, or other business tool may provide or receive information when the Customer connects it to Fondation Flow. The external service may act as a separate organization and its own terms continue to apply. The Customer is responsible for fields, notices, access, and consent.
QuickBooks Online is provided by Intuit. Fondation Flow uses Intuit’s authorization and accounting services only after an authorized Customer user connects a QuickBooks company. The initial integration is user-confirmed and one way from Fondation Flow to QuickBooks; it does not continuously or bulk-import the Customer’s QuickBooks file. Intuit’s processing is governed by the Intuit Privacy Statement and applicable terms.
Fondation Flow’s subscription checkout uses Helcim’s protected payment fields. Helcim’s processing is governed by its Privacy Policy and applicable terms.
Fondation Flow uses Google Maps Platform APIs, including Places SDK for iOS, for address search and selection. Use of those features is also governed by the Google Maps Platform Terms and the Google Privacy Policy.
04 — Changes and continuity
A material provider change is documented.
We may replace or add a provider to improve security, reliability, or functionality. The page date is updated when a material change affects personal information processing. Where an agreement requires it, the Customer receives notice and may exercise the stated remedy.
Privacy requests
A question, complaint, or access request?
Write to Fondation Flow about a privacy question or request. We may need to confirm your identity before disclosing or correcting information.
9572-9026 QUÉBEC INC.
Registered office
555 Rue Chabanel O, Suite 1541
Montréal, QC H2N 2J2
Canada