Privacy policy

This policy explains how Forge Libre Inc., a for-profit business corporation (NEQ 1181640138), which operates Discer, collects, uses, discloses and keeps personal information, and how to exercise your rights. It covers the discer.ca website, the application, the API, the MCP server, the AI assistant and our emails.

Discer is intended for businesses. The personal information we handle is mostly business information: that of the Users of the accounts and that of the contact persons published in public tenders.

We handle personal information in accordance with applicable laws, including Québec's Act respecting the protection of personal information in the private sector. Terms defined in the Terms of use have the same meaning here.

What you provide

• Account: email, name, language and sign-in method (email code or Google).
• Business: name, NEQ, website and monitoring profile (tender types, regions, specialties, keywords, details).
• Bidder file: legal name, address, phone, email, name, title and email of the signatory, GST and QST numbers, RBQ licence and subcategories, insurance, certificates and certifications.
• Work content: Pipeline (followed tenders, bid prices, notes), contact book and private notes, saved searches, indicators, uploaded documents and their analyses, questions and conversations with the assistant.
• Team: email of the people invited to join the account.
• Billing: name, billing address and tax numbers, entered in Stripe. We keep the Stripe identifiers, the plan and the payment history, never the card number.
• Exchanges with us: your messages and requests, including requests to remove a contact and to delete the account.

What we collect during use

• Technical logs: IP address, date, page or route requested, browser, to run and protect the service.
• Call log of the API, the MCP server, the assistant and exports: account, key, route, number of items and date, never the content.
• Account sharing detection: a short, non-reversible fingerprint of the device type and network.
• Use of the service: consumption of AI credits and features, tender sorting (keep, discard), clicks on tender links in our emails.
• Audience measurement (Mixpanel and internal measurement): pages viewed and actions taken in Discer, as codes; approximate city, region and country of the visit, derived from the IP address by our server, which does not keep it; device, browser and operating system type; linked to an internal identifier only (see Cookies and audience measurement).
• Where a request or an account came from: when you request your tenders or your market snapshot, or create an account, we record what brought you to the site: the source, medium and campaign of a link, the click identifier of a Google or Meta ad, the landing page and the referring site, for your first visit and for the last one that carried a campaign. Your browser keeps this for up to 90 days (local storage); we keep it with the request or the account, in Canada, without passing it on to anyone.
• Advertising cookies, only if you accept them: see Cookies and audience measurement.

People who request their tenders or their market snapshot

On the site, a person may request their open tenders by email, or the market snapshot for a tender type and a region. We keep their email, the website or business name entered, their choices (tender types, region, language) and proof of their consent (date, text shown and email confirmation).

People who fill out the form of a Discer ad

Discer's ads on Facebook and Instagram may offer a form, hosted by Meta. It asks for a business email, the business name, its specialty, the tender type and the region. By sending it, the person accepts the Terms of use, including receiving our emails. Meta collects this information for Forge Libre, which transfers it to its database hosted in Canada. Meta may also keep it under its own terms.

Discer presents data published by public bodies: tenders and contracts from SEAO (Données Québec), CanadaBuys and the City of Toronto, the Québec enterprise register and licences of the Régie du bâtiment du Québec. Some contain personal information of a professional nature, such as the name, email and phone number of the contact persons listed in tenders.

This information is presented for the purpose of its publication: transparency and participation in public procurement. The Contacts section only shows those from contracts of the last 36 months.

To request the removal of a contact about you, write to info@forgelibre.ca. Forge Libre reviews each request and removes the contact from all accounts when the request is justified. A subscriber may also report a contact from Discer: it is then immediately hidden for their account.

We use information to:

• provide Discer: open and protect the account, establish your monitoring profile, select relevant tenders, send emails, analyze documents, prepare your bid documents and answer your questions;
• adjust tender relevance to your account, based on your sorting;
• bill and manage the subscription;
• ensure security: prevent fraud, account sharing, data extraction and abuse;
• communicate with you about the service (tenders, alerts, billing, changes);
• promote Discer: with your consent, show our ads to people who visited the site and measure their results;
• measure which campaigns and channels bring requests, accounts and subscriptions;
• improve Discer (fixes, usage measurement, relevance);
• produce aggregated and anonymous data, such as the trades required by a tender (Subcontracting feature);
• meet our legal obligations (tax, accounting, requests from an authority).

We do not sell any personal information. The only advertising uses are the Meta pixel and the Google Ads tag, with your consent (see Cookies and audience measurement). Forge Libre does not use your documents or your conversations to train an AI model.

Document analysis and assistant

To analyze your documents and answer your questions, Discer sends its AI provider, DeepSeek: the relevant text of the uploaded documents, your questions and the latest exchanges of the conversation, the Discer data needed for the answer and the relevant elements of your monitoring profile. The public text of your business's website, if you provide it, is also sent to establish your profile. Your bidder file is not sent: it is checked within Discer.

We do not send any personal information to DeepSeek. Before anything is sent, a filter removes people's names, phone numbers and personal email addresses from the text. Do not enter third parties' personal information in your questions to the assistant, nor in your documents beyond what the official tender notice contains (see the Terms of use).

Uploaded files go through an antivirus, then are deleted as soon as the analysis ends (at most 24 hours after a failure). The result of the analysis remains in your account for 24 months after it is created, then is deleted.

Tender relevance

To rank tenders according to your profile, the text of your business profile (specialties, tender types, keywords, RBQ subcategories, types of insurance and certificates) is sent to Voyage AI, which converts it into a numerical representation. No personal information is sent: no identity, signatory, address or number.

Aggregated and anonymous data

The results of analyses are used, in aggregated and anonymous form, to establish the trades and services required by a tender. This data contains neither the subscriber's identity, nor the document, nor any excerpt. A trade is inferred from similar tenders only if it appears in the analyses of at least three distinct accounts.

We disclose information to providers that process it on our behalf, according to our instructions and only for the purposes described here:

• Supabase: accounts, sign-in, database and uploaded files, hosted in Canada (Amazon Web Services servers located in Canada).
• Railway: application servers and the pipeline that collects public data.
• Stripe: payment and billing; Stripe processes card data.
• Brevo: sending emails, and measuring their opens and each recipient's clicks.
• DeepSeek: document analysis and assistant, with no personal information (see Artificial intelligence).
• Voyage AI: tender relevance, based on the text of the business profile, with no personal information.
• Google: sign-in with your Google account, if you choose it; we receive your email and the basic information of your profile. Only with your consent, Google Ads retargeting and measurement tag on the site's public pages, with no email, name or phone number (see Cookies and audience measurement).
• Mixpanel: audience measurement (pages viewed and actions taken in Discer), with an internal identifier only; never a name, an email, a phone number, a NEQ, a business name, text you entered or a file name; Mixpanel never receives your IP address, only the approximate city, region and country our server derives from it (see Cookies and audience measurement).
• Meta: only with your consent, retargeting pixel on the site's public pages, with no email, name or phone number; forms of Discer's ads on Facebook and Instagram (see Cookies and audience measurement).

We may also disclose information to an authority that requires it by law, to enforce our rights or prevent fraud, and, as part of a business transaction (sale, merger, financing), to the other party, under a confidentiality undertaking, as permitted by law.

Our clients' data is hosted in Canada. Some technical processing is carried out by providers located outside Québec: the application servers and the pipeline that collects public data (Railway), sending emails (Brevo), payment (Stripe), sign-in with Google, audience measurement (Mixpanel, in the United States, which only receives an internal identifier), advertising (Meta, in the United States and Ireland: the pixel, with your consent, and the forms of its ads; Google LLC, in the United States: the Google Ads tag, with your consent) and AI (DeepSeek and Voyage AI, which receive no personal information).

Before disclosing personal information outside Québec, we assess, as required by law, whether it will receive adequate protection there. Information processed outside Québec may be subject to the laws of the place where it is located.

Our clients' data is hosted in Canada: our database and uploaded files are at Supabase, on Amazon Web Services servers located in Canada. We keep information as long as needed for the purposes described, then delete it or make it anonymous:

• Uploaded files: deleted as soon as the analysis ends, at most 24 hours after a failure.
• Call log (API, MCP, assistant, exports): 90 days.
• Device fingerprints (account sharing): 30 days.
• Server technical logs: 30 days.
• Conversations with the assistant: until you delete them, or until the account is deleted.
• Bidder file: until you erase it (Settings, Bidder file), or until the account is deleted.
• Document analyses (results, versions and addendum reports): 24 months after they are created, then deleted automatically.
• Account, profile and work content: during the subscription, then 12 months after it ends; you may request their deletion sooner.
• Billing: 6 years, as required by tax laws.
• Unsubscribes: as long as needed to respect your choice.
• Audience measurement (Mixpanel): 24 months; deleted sooner on request, using your account's internal identifier.
• Internal audience measurement (Supabase, Canada): 24 months, then deleted automatically; random value of the one-day visitor identifier: two days.
• Advertising cookie choice: 12 months, in your browser.
• Meta pixel: _fbp and _fbc cookies, 90 days, set by Meta, deleted from discer.ca if you decline; data received by Meta: up to two years, under Meta's terms.
• Google Ads tag: _gcl_au and _gcl_aw cookies, 90 days, set by Google, deleted from discer.ca if you decline; data received by Google: under Google's terms; Google removes part of the IP address from its advertising logs after 9 months and cookie information after 18 months.
• Ad forms: at Meta, under its terms; at Discer, like other requests, until consent is withdrawn.
• Where a request or an account came from: as long as the request or the account.
• Email log (recipient, type, subject, delivery, opens and clicks): 24 months, then deleted automatically, and with the account.
• Aggregated and anonymous data: without limit, since it does not identify anyone.

Account deletion

To have your account deleted, make the request in Settings, Security, or write to info@forgelibre.ca. We delete the account and its content within 30 days, except what the law requires us to keep.

We take reasonable security measures, suited to the sensitivity of the information:

• password-less sign-in (one-time code or Google) and two-factor authentication available;
• encrypted exchanges (HTTPS);
• data access separated by account and limited to the people who need it;
• uploaded files scanned by an antivirus and deleted after the analysis;
• API keys stored in irreversible encrypted form;
• call logging and usage caps against extraction.

No measure is infallible. In the event of a confidentiality incident that presents a risk of serious injury, we notify the people concerned and the Commission d'accès à l'information, as required by law. You are responsible for the security of your access.

Discer uses cookies needed for it to work and, only if you accept them, Meta's and Google's advertising cookies.

Necessary cookies

• Session: keeps you signed in; cannot be read by the page's scripts.
• Sign-in with Google: temporary cookies, for the time of the sign-in.
• Language: remembers the language chosen, for one year.
• Advertising cookie choice: remembers your choice, for 12 months (browser local storage).
• Visit origin: the campaign of your first visit and of the last one that carried a campaign, for 90 days (browser local storage); it is only sent with a request or at sign-up.

Your browser also keeps, on your device, a few display preferences (collapsed menu, list view, guides already seen); they are not sent to us.

Advertising cookies (Meta and Google)

On the site's public pages (home, Product, Pricing, About, blog), Discer may use the Meta pixel and the Google Ads tag to show its ads on Facebook, Instagram and Google to people who visited the site, stop showing them to people who already made a request, and measure their results.

• The pixel and the tag are off by default. They only load after “Accept” in the banner. If you decline, or make no choice, nothing is sent to Meta or Google.
• They never load in the application, on a business's report page, or on a page whose address contains an identifier.
• Meta receives the address of the page visited and of the referring page, two events (page view; tender or snapshot request made on the site), a browser identifier (_fbp and _fbc cookies, 90 days) and what your browser sends on its own (IP address, browser and device type). Meta may link this information to your Facebook or Instagram account, under its own policy, and keep it for up to two years.
• Google receives the same information: the address of the page visited (with, if present, the click identifier of a Google ad) and of the referring page, the same two events, a browser identifier (_gcl_au and _gcl_aw cookies, 90 days) and what your browser sends on its own. Google may link this information to your Google account and use its own cookies on its domains, under its own rules.
• Discer sends Meta and Google no email, name, phone number or NEQ, not even in hashed form. The click identifier of a Google ad is never sent to Meta, nor Meta's to Google.
• You can withdraw your consent at any time with the “Cookies” link at the bottom of the page: the pixel and the tag stop and their cookies are deleted from discer.ca.
• If your browser sends a Do Not Track or Global Privacy Control signal, the banner does not appear on its own and they stay off.

Audience measurement

To understand how Discer is used and improve it, we use Mixpanel. Your browser keeps a random identifier in its local storage (no cookie). Mixpanel receives:

• the pages viewed, without address parameters; tender numbers, NEQs and other identifiers are replaced before sending;
• where the visit comes from, as a category (search engine, social network, email, direct) and, if present, the source and campaign of a link;
• the browser type, operating system and screen size;
• the approximate city, region and country of the visit, which our server derives from your IP address: Mixpanel never receives the address;
• some actions taken in Discer, as codes only: sign-up steps, plan, choices on a tender (source and relevance level, not the tender itself), document analysis requested or completed (number of pages in ranges), subscription.

Once you are signed in, this data is linked to your account's internal identifier, never to your name or email. Your IP address is not kept. No typing is captured. Your browser's Do Not Track setting is respected for the measurement done in the browser.

Internal audience measurement

We also record, in our database hosted in Canada (Supabase), the pages viewed (address without parameters, identifiers replaced by a template), the language, the visit source as a category (search engine, social network, email, direct access), campaign codes (UTM) and the actions taken in Discer, as codes only; your account's internal identifier is added only when you are signed in. Our server adds:

• the approximate city, region and country of the visit, which it derives from your IP address using the open IP Geolocation by DB-IP database (CC BY 4.0 licence); the address itself is neither kept nor shared;
• the device type (computer, mobile, tablet) and the browser and operating system type, without keeping your browser's full description;
• when you are not signed in, a visitor identifier valid for a single day, to count visitors without cookies: a fingerprint computed from your IP address, your browser and a random value that changes every day and is deleted after two days, which can neither link two days nor reveal your address.

No IP address, name, email or typed text is recorded, and your browser's “Do Not Track” signal is respected. Nothing is measured outside discer.ca, and visits from our administrators' devices are marked and excluded from statistics. This data is kept for 24 months, then deleted automatically.

Subscribers receive emails related to the service: morning tenders, alerts (closing, addendum, award, subcontracting), billing and security. Frequency is set in Settings, Emails, and each tender email contains an unsubscribe link. Billing and security emails are sent as long as the account exists.

People who request their tenders or their market snapshot on the site receive our emails with their consent: box checked and confirmed by email. People who fill out the form of a Discer ad agree, by sending it, to receive their market snapshot and our emails (new features, promotional offers, special offers for users and events), as provided in the Terms of use. Everyone may unsubscribe at any time, with the link in each email.

Discer emails sent through Brevo measure each recipient's opens and clicks, to know which emails are useful and to stop writing to people who no longer read them.

When you publish a private tender, are invited to one or bid on one, we also process the following information.

• Buyers: work email, first name, last name, title and phone of the person in charge (for verification; sent with the email to the selected bidder at award, never to the other bidders), organization, NEQ and address, commitments checked and their version.
• Suppliers invited by a buyer: email and company name provided by the buyer, who attests a business relationship; the source is stated in each invitation, with a link to stop receiving them.
• Bids: price, validity, exclusions, attachments, bid contact (name, email, phone), submission time and fingerprint. They are encrypted until opening.

Purposes: sending the notice, receiving and opening bids, sending them to the buyer at opening, notifying each bidder of the result, publishing the result as for a public tender, keeping history and statistics, preventing fraud and collusion. Disclosures: to the buyer, the bids and their contacts at opening; to the selected bidder, at award, the name, title, email and phone of the buyer's person in charge; to subscribers whose plan allows it, bidder names, their prices, the winner and the amount; to our providers (Supabase, in Canada; Brevo for emails; Railway for processing, outside Québec; Voyage AI, which receives the text of the notice — title, scope, tender type and categories — without personal information, to match it with subscribers' profiles). Retention: bid attachments deleted 24 months after closing; price, rank and result kept for history and statistics; list of invitation refusals kept permanently.

Analysis of the tender documents: when the buyer submits the tender, Discer sends the text of its documents and addenda to its AI provider, DeepSeek, once per tender. Before sending, the filter described in the Artificial intelligence section removes personal information, including the buyer's contact details. No bid is sent for this analysis. The result is shown to everyone who sees the tender.

Bid Evaluation ($190 per tender, taxes extra, purchased by the buyer): Discer gathers facts on each bidder from public data and Discer, and sends to DeepSeek, after the same filter, the text of the attachments of the opened bids of this tender, to look for the tender requirements in them. The report is given to the buyer only.

Subject to the exceptions provided by law, you may:

• access the personal information we hold about you and obtain a copy;
• have inaccurate, incomplete or equivocal information corrected; most can be corrected directly in Settings;
• withdraw your consent to a use or a disclosure, including our emails;
• have your information deleted or stop its dissemination, where the law allows;
• receive the information you provided to us in a structured, commonly used technological format.

To exercise a right, write to the person in charge of the protection of personal information (see the next section). We may verify your identity. We answer within 30 days, at no cost.

If our answer does not satisfy you, you may contact the Commission d'accès à l'information du Québec.

The person in charge of the protection of personal information at Forge Libre Inc. is Thomas Lemire.

Email: info@forgelibre.ca

Address: Forge Libre Inc., 80 rue Wellington Sud, Suite 5120, Sherbrooke, QC J1H 5C7

We may change this policy. The date of the version appears at the top of the page. We notify users of any significant change by email or in Discer.