Trust
Quebec transfer fact sheet
Effective Date: September 6, 2026
Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) requires an organization to carry out a privacy impact assessment before communicating personal information outside Quebec (s. 17). A Quebec organizer using Lime-n.io is that organization; Lime-n.io is its service provider (s. 18.3). This sheet gives the facts the assessment needs.
Service provider
Harvest Technology Systems, Inc., Ontario, Canada. Person responsible for the protection of personal information: Stu Doherty, privacy@lime-n.io.
What personal information leaves Quebec
Guest names, optional email addresses and phone numbers, party sizes and attendance status entered through the organizer's guest lists; the organizer's and their promoters' names, emails and phones as account holders.
Where it goes
Ontario, Canada (the service provider) and the United States:
- Google Cloud / Firebase — nam5 (US multi-region) storage and us-east4 processing.
- Resend — email delivery.
- Stripe — the organizer's billing.
- Sentry — error reports without personal identifiers.
Legal and contractual protection
A written service-provider agreement — the Lime-n.io Data Processing Agreement, Quebec addendum — covering purpose limitation, confidentiality, security measures, incident notice within 48 hours, sub-processor notice, deletion at the end of the service and on request; Google, Stripe, Sentry and Resend are bound by their own data processing terms with standard contractual clauses; Canada's federal private-sector law (PIPEDA) applies to the service provider.
Security measures
Encryption in transit and at rest; role-based access enforced by security rules; an activity trail written only from trusted code; daily backups retained 7 days; error reports without personal identifiers.
Retention
Guest data deleted 90 days after the event, automatically; account data within 180 days of the account ending; backups 7 days; deletion requests actioned within 14 days.
Rights handling
Organizers export guest lists themselves in the app; deletion and access requests go to privacy@lime-n.io; guests' requests are routed to the organizer and actioned on their instruction.
Regulator
This sheet is provided to help the organizer's assessment; it is not legal advice. See also the trust page and the Privacy Policy.