Privacy Policy
Your information.
Protected in Canada.
Protected in Canada.
What we collect, why, where it is kept and how to exercise your rights. Updated: October 2026.
In short
• We collect only what we need to provide the platform.
• Our databases are hosted in Canada; your data is never sold.
• NeoAgora never uses it to train AI models.
• You can access, correct, obtain or ask us to delete it: [email protected].
• Our databases are hosted in Canada; your data is never sold.
• NeoAgora never uses it to train AI models.
• You can access, correct, obtain or ask us to delete it: [email protected].
Who is responsible for what
NeoAgora (Proweb Consultant inc.) is responsible for its clients' information: account, billing, support. For the data a client organization entrusts to the platform (its members, its contacts, its website visitors, its agents' conversations), the organization remains responsible for that information; NeoAgora processes it on its behalf, according to its instructions and this policy.
What information we collect
What you give us: name, email address, information about your organization, content you upload. And the usage data needed for the service to work and stay secure.
Why we collect it
• Running the platform: creating and maintaining your account, authenticating you, processing payments, providing the features you use.
• Communicating with you: confirmations, security alerts, support answers, notices of significant changes.
• Improving the service: measuring quality and finding issues, from aggregated usage data.
• Security and legal obligations: preventing fraud and abuse, meeting legal requirements.
• Communicating with you: confirmations, security alerts, support answers, notices of significant changes.
• Improving the service: measuring quality and finding issues, from aggregated usage data.
• Security and legal obligations: preventing fraud and abuse, meeting legal requirements.
Where your data is and how we protect it
Our databases and your files are hosted in Canada, on redundant infrastructure with a standby copy kept up to date continuously. It is backed up several times a day; backups are encrypted and stored in Canada, and restoring them is tested.
All connections are encrypted. Each organization's data is kept separate from other clients' data, and each person sees only what their role allows. Staff access follows the principle of least privilege.
All connections are encrypted. Each organization's data is kept separate from other clients' data, and each person sees only what their role allows. Staff access follows the principle of least privilege.
Who may have access
Your information is never sold or used for advertising. Some technical tasks are entrusted to specialized providers: hosting, database, file storage, backups, artificial intelligence, email delivery, network protection and payment. They receive only what their task requires and are bound by confidentiality and security commitments. Some may process information outside Quebec.
Our main providers hold recognized certifications, verified in October 2026:
• data centres hosting our servers: ISO/IEC 27001;
• intranet database: SOC 2 Type II and ISO/IEC 27001;
• off-site backups: SOC 2 Type II;
• web application firewall and network protection: SOC 2 Type II, ISO/IEC 27001, 27018 and 27701;
• main artificial intelligence service: SOC 2, ISO/IEC 27001 and ISO/IEC 42001 (AI management);
• payment processing: PCI DSS and SOC 2.
Our main providers hold recognized certifications, verified in October 2026:
• data centres hosting our servers: ISO/IEC 27001;
• intranet database: SOC 2 Type II and ISO/IEC 27001;
• off-site backups: SOC 2 Type II;
• web application firewall and network protection: SOC 2 Type II, ISO/IEC 27001, 27018 and 27701;
• main artificial intelligence service: SOC 2, ISO/IEC 27001 and ISO/IEC 42001 (AI management);
• payment processing: PCI DSS and SOC 2.
Artificial intelligence
In written conversations (your website's agent, the portal assistant, the intranet assistants), in support ticket answers and in newsletters, the personal information we detect is masked before it is sent to the AI model. It is put back in the answer you receive.
Your data is used only to provide the service you asked for: we do not sell it, do not use it for advertising and do not use it to train AI models. Our conversational agents, assistants, ticket answers, the writing of articles, posts and newsletters, and translation go through a professional AI service whose contract excludes using your texts to train models. If that service is down, a backup service may take over, with personal information already masked.
Details are in our AI Disclosure.
Your data is used only to provide the service you asked for: we do not sell it, do not use it for advertising and do not use it to train AI models. Our conversational agents, assistants, ticket answers, the writing of articles, posts and newsletters, and translation go through a professional AI service whose contract excludes using your texts to train models. If that service is down, a backup service may take over, with personal information already masked.
Details are in our AI Disclosure.
How long we keep it
As long as your account is active and the law requires. At the end of the contract, the organization can obtain its data, which is then deleted from our systems; backup copies then expire on their own according to their retention cycle, within twelve months at most.
Your rights
You may at any time request access to your information, its correction, its release in a structured technological format or its deletion, or withdraw your consent. Write to [email protected]; we answer within 30 days.
If you are not satisfied with our answer, you may contact the Commission d'accès à l'information du Québec.
If you are not satisfied with our answer, you may contact the Commission d'accès à l'information du Québec.
Confidentiality incidents
In the event of an incident, we contain it, assess the risk of serious injury and, where that risk exists, promptly notify the Commission d'accès à l'information and the persons concerned. The affected client organization is informed without delay. Every incident is recorded in our incident register.
Google Calendar integration
Show the section
Google Calendar Integration
NeoAgora offers an optional Google Calendar integration that allows our users to display their availability and enable appointment booking on their websites. This integration uses the Google Calendar API and complies with the Google API Services User Data Policy, including the Limited Use requirements.
Data Accessed
When you connect your Google Calendar account, we access the following data with your explicit consent:
• Calendar event information (date, time, duration, availability status)
• Free/busy information to display available time slots
• Basic calendar metadata (calendar name, timezone)
How We Use Google Calendar Data
Google Calendar data is used strictly for the following purposes:
• Displaying your real-time availability on your website
• Allowing visitors to book appointments during your available time slots
• Creating calendar events when appointments are confirmed
• Sending appointment confirmations and reminders
We do not use Google Calendar data for advertising, market research, or any purpose unrelated to the appointment booking functionality you have enabled. Our use of Google Calendar data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Security of Google Calendar Data
We implement the following measures to protect your Google Calendar data:
• All data is transmitted over encrypted HTTPS connections (TLS 1.2+)
• OAuth 2.0 tokens are stored securely and encrypted at rest
• Access tokens are refreshed automatically and never exposed to client-side code
• We use the principle of least privilege, requesting only the minimum scopes necessary
• Our servers are hosted in secure, SOC 2-compliant data centers
Data Retention & Deletion
Calendar data is processed in real-time and not permanently stored on our servers beyond what is necessary for the booking functionality. Appointment records are retained as part of your account data. You can revoke NeoAgora's access to your Google Calendar at any time by:
• Disconnecting the integration from your NeoAgora dashboard
• Removing access from your Google Account permissions page (myaccount.google.com/permissions)
• Contacting us at [email protected] to request complete data deletion
Upon revocation, we immediately cease accessing your Google Calendar data and delete all stored OAuth tokens within 24 hours.
Third-Party Data Sharing
We do not sell, share, or transfer your Google Calendar data to any third parties, except as necessary to provide the appointment booking service (e.g., sending confirmation emails). All communications with the Google Calendar API are made directly from our secure servers.
Consent & Control
The Google Calendar integration is entirely optional. You must explicitly authorize the connection through Google's OAuth consent screen before any data is accessed. You maintain full control over:
• Which calendars are shared with NeoAgora
• When to connect or disconnect the integration
• What information is displayed on your public website
NeoAgora offers an optional Google Calendar integration that allows our users to display their availability and enable appointment booking on their websites. This integration uses the Google Calendar API and complies with the Google API Services User Data Policy, including the Limited Use requirements.
Data Accessed
When you connect your Google Calendar account, we access the following data with your explicit consent:
• Calendar event information (date, time, duration, availability status)
• Free/busy information to display available time slots
• Basic calendar metadata (calendar name, timezone)
How We Use Google Calendar Data
Google Calendar data is used strictly for the following purposes:
• Displaying your real-time availability on your website
• Allowing visitors to book appointments during your available time slots
• Creating calendar events when appointments are confirmed
• Sending appointment confirmations and reminders
We do not use Google Calendar data for advertising, market research, or any purpose unrelated to the appointment booking functionality you have enabled. Our use of Google Calendar data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Security of Google Calendar Data
We implement the following measures to protect your Google Calendar data:
• All data is transmitted over encrypted HTTPS connections (TLS 1.2+)
• OAuth 2.0 tokens are stored securely and encrypted at rest
• Access tokens are refreshed automatically and never exposed to client-side code
• We use the principle of least privilege, requesting only the minimum scopes necessary
• Our servers are hosted in secure, SOC 2-compliant data centers
Data Retention & Deletion
Calendar data is processed in real-time and not permanently stored on our servers beyond what is necessary for the booking functionality. Appointment records are retained as part of your account data. You can revoke NeoAgora's access to your Google Calendar at any time by:
• Disconnecting the integration from your NeoAgora dashboard
• Removing access from your Google Account permissions page (myaccount.google.com/permissions)
• Contacting us at [email protected] to request complete data deletion
Upon revocation, we immediately cease accessing your Google Calendar data and delete all stored OAuth tokens within 24 hours.
Third-Party Data Sharing
We do not sell, share, or transfer your Google Calendar data to any third parties, except as necessary to provide the appointment booking service (e.g., sending confirmation emails). All communications with the Google Calendar API are made directly from our secure servers.
Consent & Control
The Google Calendar integration is entirely optional. You must explicitly authorize the connection through Google's OAuth consent screen before any data is accessed. You maintain full control over:
• Which calendars are shared with NeoAgora
• When to connect or disconnect the integration
• What information is displayed on your public website
Who is responsible for privacy at NeoAgora
Person in charge of the protection of personal information: [email protected]. To exercise your rights, ask a question about this policy or report a concern, write to this address.
Changes
We may update this policy. The update date appears at the top of the page, and significant changes are announced by email or in the portal.
A request about your personal information? Write to our privacy officer