Privacy Policy

Who this policy applies to

This policy applies to everyone who uses Tramavia, operated by 9524-2426 Québec Inc. It is written to comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Québec's Loi 25 (Act respecting the protection of personal information in the private sector).

What we collect

• Account data — email, name, password hash, language preferences, theme preferences, editor preferences
• Content you create — manuscripts, characters, places, events, notes
• Technical logs — IP address, browser type, page timestamps (retained 30 days for security monitoring)
• Payment data — if you subscribe, we store the last 4 digits of your card and a customer ID from our payment processor. Full card details are handled by our payment processor and never touch our servers.

What we do NOT do

• We do not sell your data. Ever.
• We do not use your manuscripts to train AI models. Neither ours nor third-party models. When our optional AI features (Scribe) are used, the content is sent to a third-party AI provider solely to fulfill your request, with contractual guarantees against training use.
• We do not track you across the web. No third-party analytics, no advertising cookies, no social pixels.

How we use your data

• To provide the service — storing, displaying, and editing your content
• To communicate with you — account emails, service announcements, transactional notifications
• To operate our business — processing payments, preventing fraud, providing support
• To comply with legal obligations when required

Where your data is stored

Our infrastructure relies on established third-party providers located in Canada and the European Union. Content you create is hosted on servers located in the European Union. Transactional email is handled by a commercial provider with Canadian data centers. Payment processing is delegated to PCI-DSS-compliant processors; full card details never touch our servers.

The full list of subprocessors is available on written request to our Data Protection Officer.

Your rights

Under GDPR, Loi 25, and similar frameworks, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Delete your account and associated data
• Export your content in portable formats (PDF, ePub, DOCX, Markdown, HTML)
• Object to certain processing
• Lodge a complaint with a supervisory authority

To exercise any of these rights, write to support@tramavia.com. We respond within 30 days.

Cookies

We use strictly necessary cookies for authentication and CSRF protection. We do not use tracking or advertising cookies.

Data retention

We keep your content for as long as your account is active. Upon account deletion, content is removed within 30 days. Invoices and financial records are retained for the period required by Canadian tax law (6 years).

Children

Tramavia is not intended for users under 13. We do not knowingly collect data from children.

Contact

Data Protection Officer: support@tramavia.com