Privacy notice

In force from 9 November 2026. The French version is the reference version.

Arrivos helps the shops of an organisation read their suppliers' invoices and file them into the Auphan point of sale. This notice explains what information the app collects, why, where it is kept, who it is shared with, how long it is kept and how to exercise your rights. It meets the requirements of Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, and of the Personal Information Protection and Electronic Documents Act (PIPEDA).

1. The person in charge

The service is operated by Logiciels Writ. The person in charge of the protection of personal information is:

Benjamin Garcia
[email protected]

Write to them with any question about this notice, to exercise your rights or to report an incident. You will receive a written answer within 30 days.

Each client organisation remains responsible for the information about its own employees and suppliers. We process it on the organisation's behalf, under the service agreement made with it.

2. The information collected

A supplier invoice may carry the name or contact details of a person at that supplier. We collect nothing else about you: no profile, no advertising tracking, no audience measurement.

3. Why we use it

• To sign you in with your Auphan account and protect access to your data.
• To read your invoices, match them against the catalogue and file them into the point of sale when you press the button that does so.
• To allow stock transfers between the shops of your organisation.
• To save filed PDFs and send the mail your organisation asked for after each filing.
• To keep the service secure, detect abuse and diagnose outages.

We use this information for no other purpose, do not sell it and make no automated decision about you.

4. Where it is kept

• Your browser. It holds your shop's data only while the app is open in a tab, read from our server at each sign-in; nothing of it stays on your computer once the tab is closed. A copy an earlier version kept on your computer is sent to the server once and then erased (section 7).
• Our server. It keeps the shop directory, transfers, the record of each document filed into the point of sale, the record of each administrative change, sessions, the organisation's settings, the encrypted copy of each vault and the Outlook connection. The provider and the country of this server have not yet been confirmed on this deployment; ask the person in charge before relying on this notice for where your information is kept.
• Microsoft, for the mail sent from the shop's Outlook mailbox, under the terms of your organisation's Microsoft 365 account.

5. Service providers

We entrust some tasks to the providers below. Each receives only what its task needs.

• Writ runs the operations in the Auphan point of sale on your behalf: it receives the Auphan username and password for the length of each operation, and the invoice lines to file. When a scanned PDF has to be turned into text, a Writ service reads it too.
• OpenRouter, and the provider of the artificial intelligence model it calls, receive the text of an invoice in three cases: the first time a supplier is seen, to write the rules that then read that supplier's invoices without artificial intelligence; when those rules are rewritten or repaired at a user's request; and when a person looks for why an invoice's total does not agree and arithmetic alone cannot explain it, together with that invoice's lines. In the first two cases, the examples of that same supplier kept in your vault may be sent with it, to check the new rules: the text of at most its last five filed invoices and the figures you confirmed on them. Your password, the rest of your vault and the invoices of your other suppliers are never sent. These services may process that text outside Quebec and Canada.
• Microsoft (Microsoft Graph) sends the mail that follows a filing, from the Outlook mailbox the shop connected. The app can send mail and read the mailbox's name and address. Only if the shop separately allows it, to import the invoices it receives by e-mail, the app also lists the recent messages of the inbox that carry a PDF (their sender, subject and date, and the attachments' names and sizes) and downloads the attachments the shop chooses; those pass through our server to the shop's browser and are not kept on the server, where only the name and size of each imported file is recorded with the administrative record. The app never moves or deletes a message.
• Cloudflare protects access to the site and carries the encrypted traffic to our server; it sees your IP address.
• The server's hosting provider supplies the machine the service runs on.
• The backup storage provider keeps copies of the server's backups. They are encrypted on our server before they leave it, with a key the provider does not hold, so it cannot read them.

Auphan, your point-of-sale provider, receives the documents you file there under the agreement your organisation has with it. Before communicating personal information outside Quebec, we assess, as the law requires, whether it will be adequately protected there.

6. How long it is kept

• A sign-in session expires after 12 hours without activity and at the latest 7 days after signing in; a session opened while the point of sale was down expires after 24 hours. The server erases expired and idle sessions within the hour.
• The Auphan password is never kept by the server. The encrypted cookie that carries it lasts until you lock the app, your session ends, or the browser closes, whichever comes first.
• A PDF waiting to be saved is erased from the server as soon as it has been written into the organisation's folder, and at the latest 90 days after it was filed; the receipt shows that date.
• The note of which computer saved a filed invoice into its folder is erased 90 days after the save. A computer stays in the list of the computers that save a shop's invoices until it is removed in Settings or stops saving into a folder there. A computer removed in Settings is told so at its next sign-in and stops saving there; that note is erased 90 days after the removal.
• What a shop recorded when it declined a transfer (the reason, the quantities it proposed and the versions it declined) is erased 2 years after the decline; the transfer itself stays with the organisation's records.
• A row of the administrative record - who changed a setting, a parser, an organisation, an administrator's password or a document already filed in the point of sale - is erased 2 years after the change.
• A row of the missing-items report is erased 1 year after it was closed; an open row stays until it is closed. While a shop's own copy still lists an erased row, the server keeps a short note so the row is not reopened: the item's key (its kind and code), which shop account reported it, how it was closed (created, dismissed or sent to the point of sale), when it was closed and when the row was erased. That note goes as soon as the shop no longer lists the item, and at the latest 1 year after the row was erased.
• The record of each document filed into the point of sale is kept 7 years after it was filed. A document's corrections and its cancellation are kept with it and leave with it, once the most recent of them is 7 years old. A transfer between shops is kept 7 years after the last thing that happened to it (its acceptance, decline, reversal or cancellation). The app's record of each filed invoice, including the receipts filed before October 5, 2026 that a computer sent, is kept the same way, 7 years after it was filed. The full reading of a filed invoice is kept 180 days.
• The note that stops one invoice being filed twice is erased 180 days after the outcome of the filing was known, or 1 year after the filing when that outcome could not be established. The same applies to the note kept for each correction of a filed document.
• The organisation's answer to a finding of the nightly check against the point of sale (who answered, the answer and its comment) is erased 90 days after it was given.
• The rules that read a supplier's invoices: for each organisation and supplier, the version in use and the 20 most recent versions are kept, and a version that was never proven is erased 180 days after it was written; the version in use is never erased. A proposed change to those rules, with who proposed and who decided it, is erased 2 years after it was accepted or refused, and at most 20 proposals waiting for a decision are kept per supplier.
• The examples of a supplier's filed invoices kept on the server to check the rules that read them: at most the last 10 per organisation and supplier, each erased 24 months after it was filed. A draft moved to the trash is erased after 30 days; the copy of an invoice's PDF kept on the server is erased 24 months after it was stored.
• An account nobody signs in to. When a shop account has not signed in for 13 months, the organisation's administrators are told: in the organisation's record of activity and, when the organisation receives the nightly report by e-mail, at that address. Thirty days later, unless someone has signed in to that account meanwhile, the server erases its encrypted copy of the vault, its PDFs waiting to be saved, the list of its computers that save them and its Outlook connection. The documents it filed, its transfers and its reports stay with the organisation's records, under the ages above. Signing in at any time before the erasure cancels it.
• A connection to Outlook or Writ that was started but not completed is forgotten after 10 minutes.
• The Outlook connection is erased from the server as soon as the shop disconnects it, and with the data of an account nobody signs in to (above).
• Server logs are overwritten as they grow and never exceed 250 MB in total.
• Everything else is kept while the organisation uses the service. When the agreement ends, the organisation can export its data, and everything about it is then erased from the server within 30 days, including the encrypted copies of the vaults an earlier version kept. The record of administrative changes is the one exception: it is what accounts for what was done to the organisation, that erasure included, so it goes on its own two-year schedule above.
• Backups: the server keeps its last 14 nightly copies, and a second storage provider keeps encrypted copies for 30 days (daily) and 12 months (monthly). Information erased from the server stays in those copies until they expire, at the latest 12 months after it was erased. They are used only to restore the service after a failure. A copy of the database the server takes before an update is undone is erased after 30 days.

A copy of your data an earlier version kept in your browser is erased from your computer 30 days after it reached the server (section 7).

7. Cookies and browser storage

The app uses two cookies, both strictly necessary, both unreadable by any script in the page and sent only to this service: the session cookie that keeps you signed in, and the point-of-sale sign-in cookie, which holds your Auphan company, username and password encrypted under a key only the server has, so that the point of sale can be reached without your browser ever keeping the password. The second one works only together with your session and from the tab you signed in from; it is deleted when you lock the app or your session ends, and the browser drops it when it closes. They serve no other purpose and no third party reads them. There is no tracking, advertising or audience-measurement cookie, which is why no banner asks for your agreement.

Your shop's invoices, catalogues, learned matches, settings and the rest of its data are kept on the server, not in your browser: each sign-in reads them from the server, and the open tab holds them only while it is open. The browser also keeps, on your computer only:

• your sign-in to the point of sale as this tab knows it - the company and username you typed, a random code that ties the tab to the point-of-sale sign-in cookie, and when you signed in, never your password - sealed so that reloading the page does not ask for your password again; it is held for the open tab only (sessionStorage), is honoured for 12 hours after you signed in at most, and disappears when the tab closes or you lock the app; it is sealed under a key of this tab's own, which the browser will not let any script read out (IndexedDB), filed under a random identifier for this tab (sessionStorage); Lock removes the key and the identifier, and a key a closed tab left behind is removed at a later sign-in once it is 13 hours old;
• the handle of the folder the organisation's PDFs are saved into, which lets the app write into that folder and nowhere else (IndexedDB);
• a fingerprint of the supplier list last sent to the server, so the same list is not sent again (localStorage);
• on a server that asks for one, the shared access key to the service, as you typed it and not encrypted, so that it is not asked for again on this computer (localStorage);
• a short name for this computer and a random identifier for it, the last company you signed in with, your display preferences such as language, theme, how tightly the lists are packed and how wide the invoice is shown beside its lines, whether the app moves on to the next invoice by itself once one is filed, whether the keyboard shortcuts are switched on, and whether the troubleshooting log is switched on (localStorage);
• the tab you last opened, the filed receipt you had open and the batch of receipts you were working through, by their identifiers only - the receipts themselves are on the server - so that reloading the page brings them back; all of it for the open tab only, and the receipt and the batch are forgotten when you lock the app (sessionStorage).
• the fact that you put off the organisation set-up, with the company and the account that put it off, so that reloading the page does not offer it again; for the open tab only, and forgotten when you lock the app (sessionStorage).
• the copy of your data an earlier version kept on this computer until November 2026, encrypted under a key derived from your password (localStorage), with the records of that copy, the older receipts of that copy and the invoice PDFs of that copy (IndexedDB), and what that version knew of the server (localStorage). Nothing is added to that copy any more. At your first sign-in with your password on this version, what it holds that the server does not have yet is sent to the server, once, and the app notes when that copy reached the server (localStorage); the copy and everything kept beside it are erased from this computer 30 days later, or 30 days after you chose to go on without it when it was made under a previous password.

The name of your account is part of the name under which the browser filed that earlier copy and what that version knew of the server, so it can be read on this computer without the password until the copy is erased. Nothing else of your shop's data stays on this computer once the tab is closed.

8. Security

• Every connection to the service is encrypted (HTTPS).
• Your shop's data is kept on the server encrypted under the server's key, each record bound to its place; your browser keeps none of it once the tab is closed.
• The server keeps only a digest of each session token, never the token itself.
• Your Auphan password is never stored on the server nor kept by your browser's pages: it is encrypted into a cookie bound to your session and to the tab you signed in from, which no script can read.
• The platform is administered with an account separate from the Auphan accounts, protected by a strong password. A second authentication factor (an authenticator app) can be added to it; once added, it is asked for at every sign-in and the password alone opens nothing.
• Repeated sign-in attempts are limited, and each organisation sees only its own shops.

9. Your rights

You can:

• ask what information we hold about you and receive a copy of it;
• have inaccurate, incomplete or out-of-date information corrected;
• withdraw your consent, for example by disconnecting the Outlook mailbox in Settings, which also ends the app's permission to read it;
• receive your data in a structured, commonly used format: Settings, under "Your data", exports it as JSON and CSV files any spreadsheet or text editor opens;
• ask for information that is no longer needed to be erased.

Send your request in writing to Benjamin Garcia, at [email protected]. We answer within 30 days.

If our answer does not satisfy you, you can complain to Quebec's Commission d'accès à l'information (www.cai.gouv.qc.ca) or, for a matter under federal law, to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

10. Confidentiality incidents

Every confidentiality incident is recorded in a register. When an incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the persons concerned, and take the measures needed to reduce its consequences and prevent it from happening again.

11. Changes

If this notice changes, the new version is published at this address with the date it takes effect, and your organisation is told before any significant change applies.