MonGardy was designed with the expectations of Quebec's Law 25 (Act to modernize legislative provisions as regards the protection of personal information) in mind. This page documents our posture without using the word "compliant" until a formal legal review has taken place. Everything below is verifiable; values still to be filled are marked to confirm.
Data residency
Each system component is documented separately. We do not generalize "all data stays in Quebec."
- Marketing site and lead form: Vercel, region
yul1(Montreal, Quebec). - MonGardy app (FastAPI backend): to confirm — target region Canada.
- Database and authentication: Supabase (PostgreSQL), region to confirm.
- Photo storage: Google Cloud Storage, region to confirm; keys managed by GCS KMS.
- AI synthesis of progress reports: Google Gemini API (paid tier; the free tier is not used because it may train on inputs). Requests do not contain unnecessary PII.
- Email delivery: Resend.
Privacy officer
Name: to confirm
Email: privacy@mongardy.com (monitored by the officer).
Per Law 25 article 3.1, a named officer will be published here before opening beyond the pilot phase.
Sub-processors
List of sub-processors used by MonGardy, with what each receives:
| Sub-processor | Role | Data received |
|---|---|---|
| Vercel | Marketing site hosting and lead-form serverless function | Lead form submissions (name, email, daycare, phone, need) |
| Supabase | Authentication + application database | Accounts, roles, daily reports, messages, parent-educator roles |
| Google Cloud Storage | Child photo storage | Child photos only (never messages, reports or PII) |
| Google Gemini (paid tier) | Progress report synthesis | Educator observations minimized to what is strictly needed; never medical notes, attendance, or parent PII |
| Resend | Transactional email delivery | Recipient email address and email content only |
Data processing agreement (DPA)
A DPA template is available on request for daycares that need to attach it to their compliance file. Email privacy@mongardy.com. A directly downloadable PDF will be published here before launch.
Security incident notification
- Notification to the affected daycare: within 72 hours of internal confirmation.
- Notification to Quebec's Commission d'accès à l'information per Law 25 requirements.
- Notification of affected individuals via the daycare when the risk warrants.
- Internal process: containment, risk assessment, logging, communication.
Data export and deletion
- At any time, a daycare may request a full export (reports, messages, photo metadata) in JSON format, with photos delivered as a ZIP archive.
- Export delivery time: within 10 business days.
- Deletion on termination: application data deleted within 30 days; backups deleted per rotation cycle (90 days maximum).
Consent management
Parent photo consent is captured and stored at the per-child level. Any linked parent or guardian may grant or revoke consent. No photo can be attached to a message or report without an active, system-validated consent.
AI data minimization
What is never sent to Gemini:
- Medical notes and allergies.
- Parent / guardian contact details.
- Attendance records.
- Government identifiers or photos.
What may be sent: educator observations written by the team, minimized to what is needed to draft a progress report.
AI usage in MonGardy
AI is used only for progress report synthesis from accumulated observations and for translation of already-approved reports. AI does not write daily reports, does not participate in parent-educator messaging, and never produces medical, psychological or developmental diagnoses.
Any AI-drafted progress report is reviewed by a human educator before being shared with parents, and cites the source observations.
Your rights
- Access to your personal information.
- Correction of inaccurate or incomplete information.
- Withdrawal of consent.
- De-indexing and cessation of dissemination where the law provides.
- Complaint to Quebec's Commission d'accès à l'information.
Last updated: to confirm before launch.