Dossilia privacy policy

Last updated: November 3, 2026

This policy explains how Dossilia collects, uses, discloses and protects personal information, and how to exercise your rights. It applies to this website and to the Dossilia service. Each firm’s “Protection of personal information” page also describes that firm’s own practices.

1. Who is responsible for what

Exode Immigration Canada (“we”, “us”) publishes and operates Dossilia, a file-tracking portal for firms and professionals (immigration and other professions), their assistants and their clients. Three roles are involved:

The firm (the professional or organization that uses Dossilia): it decides what information about its clients is collected, why, and for how long. It is responsible for that information, including its obligations to its regulatory body.
You, as a firm’s client: for any request about your file (access, correction, deletion), contact your firm first; we help it respond, and you may also write to us.
Us: we provide the platform on behalf of the firms, and we are responsible for the information in their user accounts and for the secure operation of the service.

2. The information we collect

Firm and team accounts: name, email, role, password (stored in hashed form, i.e. protected by an irreversible method, never in plain text), licence or registration numbers that the firm chooses to display, firm contact details and settings, subscription.

Sign-in with Google or Facebook (optional): if you choose this sign-in method, your email, your name and the app-specific identifier supplied by the provider (see section 4).

Client files: what the firm and its clients enter or upload: identity and contact details, questionnaire answers, prefilled forms, documents (identity documents, passports, certificates and other items in the file), messages, contracts and signatures, invoices, appointments and file steps. Depending on the file, this information may be sensitive (identity, family situation, work history, health or background information required for an application). We do not access it, except to keep the service running and secure, or at the firm’s request.

Payment: payments are processed by Stripe, PayPal or another gateway chosen by the firm. Dossilia neither receives nor keeps card numbers; we keep the amount, the payment status and transaction identifiers.

Technical information: IP address and time of sign-in, sign-up and password-reset attempts (deleted after about an hour); an activity log of important actions; visit counters by source, with no personal information.

3. Why we use it

to create and secure your account, authenticate you and prevent abuse (limiting sign-in attempts);
to run the service: manage the firms’ client files, their clients, documents, questionnaires, contracts, invoices and appointments, and collect payments when the firm has enabled this;
to send you the emails the service needs (confirmations, password reset, important notices);
to meet our legal obligations and protect our rights.

We do not use your information to sell it, or to profile you for advertising.

4. Sign-in with Google or Facebook

If you wish, you can sign in to Dossilia or create your account with Google or Facebook. This is optional: you can always use an email and a password. If you use it:

Data we read: only your email address, your name and your profile picture, as Google or Facebook send them to us after you give permission. Nothing else is requested.
Use: only to sign you in (recognize you, find or create your account). We do not store your profile picture. We have no access to your contacts, posts, emails, files or any other data in your Google or Facebook account, and we post nothing on your behalf.
No resale, no advertising: this data is never sold, rented or shared with data brokers, and is never used for advertising, ad targeting or profiling.
Google API Services User Data Policy (Limited Use): Dossilia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Withdrawal and deletion: you can unlink Google or Facebook from your account at any time (My account), remove Dossilia’s access in your Google account settings (myaccount.google.com/permissions) or Facebook settings (Settings, then Apps and Websites), and ask for your data to be deleted: see the data deletion instructions.

Google and Facebook apply their own privacy policies to their services.

5. Your consent

We collect your information with your consent, or where the law allows it in order to provide the service you request. Consent to receive promotional communications is always separate, optional and can be withdrawn at any time (through the unsubscribe link or by writing to us).

6. Cookies and similar technologies

Name	Purpose	Duration
`exode_portail`	Session cookie: keeps you signed in and protects forms. Required.	Until the browser is closed
`lang`	Remembers your language (French or English).	1 year
`src_…`	Remembers the source of a link (`utm_source`) for the firm’s statistics. Contains no personal information.	60 days
`aff_…`	Firm’s shop, if its referral program is active: remembers the referral code from a link. Contains no personal information.	60 days

Dossilia does not use advertising cookies. A firm’s funnels and public pages may, if the firm enables it, use tracking tools (Meta Pixel, Google Analytics, TikTok), always subject to your consent on the page concerned.

7. Who we share information with

We do not sell your information. We disclose it only:

to the firm you are a client of, and to its team, according to the roles it has defined;
to payment gateways (Stripe, PayPal or other) to process a payment;
to our technical providers (hosting, email delivery) who process information on our behalf and may not use it for any other purpose;
to tools the firm has itself connected or embedded (for example Rendezvix, Fluxia, an external booking calendar, or another system through a webhook or API): the firm is responsible for them;
to authorities, where the law requires it.

8. Hosting and transfers outside Quebec

We choose hosting providers that offer adequate safeguards; the hosting location is provided on request (confidentialite@dossilia.com). Some of the providers mentioned above (notably payment services) may also process information outside Quebec, including outside Canada. In that case, the information may be subject to the laws of those jurisdictions. We disclose information outside Quebec only when necessary for the service, taking into account the sensitivity of the information and the protections offered.

9. Retention and deletion

Account information is kept as long as the firm’s subscription is active. Client files are kept according to the firm’s choices and obligations (including the retention periods required by its regulatory body): the default retention period is 5 years, and the firm can adjust it according to its profession and obligations (this is not legal advice). The firm can export its space’s data (ZIP file, link valid for 48 hours) and delete its account after a 30-day grace period. A client’s deletion request never erases anything that is under retention: the firm decides file by file and answers in writing within 30 days. After the subscription ends, and subject to our legal obligations, we delete the firm’s data at its request or after a reasonable period following notice. Backup copies are overwritten on their normal cycle. To ask for your data to be deleted, see Data deletion.

10. Security

We protect your information with reasonable measures: encrypted connection (HTTPS), passwords protected by an irreversible method (hashing), separation of each firm’s data, role-based access (professional, assistant, client), protection against form forgery, limits on sign-in attempts, and an activity log. No system is infallible; if you suspect a problem, write to us.

11. Privacy incidents

If a privacy incident presents a risk of serious injury, we will promptly notify the Commission d’accès à l’information and the people concerned, and we will take reasonable measures to reduce the risk. Where an incident affects information for which a firm is responsible, we notify that firm without delay so that it can meet its own obligations. To report an incident: confidentialite@dossilia.com.

12. Your rights

Under the Act respecting the protection of personal information in the private sector (Quebec, as amended by Law 25) and the Personal Information Protection and Electronic Documents Act (federal), you may, subject to the exceptions provided by law:

find out whether we hold information about you and access it;
have inaccurate, incomplete or equivocal information corrected;
withdraw your consent to the use or disclosure of your information;
ask for your information to be deleted, or for its dissemination to stop;
ask for your computerized information to be returned to you in a structured, commonly used technological format (portability);
file a complaint with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada.

To exercise these rights, write to us at the address given in the “Contact us” section. We respond within 30 days. We may ask you to confirm your identity.

13. Minors

Dossilia is intended for people 18 and over, or for professionals and organizations. We do not knowingly collect information about children under 14 without the consent of their parent or guardian.

14. Changes to this policy

We may update this policy. The date of the last update appears at the top of the page; for a significant change, we will let you know through a notice in the service or by email.

15. Contact us

Privacy officer: Agnes Takoukam, Exode Immigration Canada.
Email: confidentialite@dossilia.com
Mailing address: Terrebonne (Québec) J7M 2H8
General questions: Contact page