Privacy Policy

1. Introduction

Vantage ("we", "our", "us") is committed to protecting the privacy of the users of its management platform for construction contractors (the "Service"). This privacy policy describes the types of personal information we collect, how we use, share and protect it, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25 (Act respecting the protection of personal information in the private sector).

2. Information we collect

We collect the following categories of information:

2.1 Information you provide directly

• First and last name, email address, phone number
• Company name, address, tax number
• Billing and payment information (processed by Stripe)
• Content of quotes, invoices, projects and reports
• Uploaded job-site photos
• Messages sent through the contact form

2.2 Information collected automatically

• IP address, browser type, operating system
• Pages viewed and interactions with the Service
• Performance data and technical diagnostics

2.3 Third-party information

• Client information you add to your Vantage CRM
• Payment data from Stripe

3. How we use information

We use your information to:

• Provide, maintain and improve the Service
• Create and manage your account
• Process payments and manage your subscription
• Send transactional communications (quotes, invoices, notifications)
• Send confirmation and reminder SMS messages (with your explicit consent, in accordance with CASL)
• Generate quotes through our artificial intelligence service
• Store files (job-site photos, PDF documents) securely
• Provide technical support
• Comply with our legal obligations

4. Sharing information

We never sell your personal information. We only share it with:

• Stripe — Payment processing (PCI DSS compliant)
• Amazon Web Services (AWS) — File hosting (S3, Canada region ca-central-1)
• Mailjet — Transactional email delivery
• Twilio — SMS delivery (with CASL consent)
• OpenAI — AI quote generation (data is anonymized)
• Render — Server infrastructure hosting
• Vercel — Website hosting

5. Data storage and security

We implement appropriate security measures to protect your data:

• Encryption in transit (HTTPS/TLS) and at rest
• Passwords hashed with bcrypt (12 rounds)
• JWT authentication with short-lived access tokens (15 minutes)
• Multi-tenant isolation (each company has its own separate data space)
• Automatic daily database backups
• Rate limiting to prevent abuse
• Validation of all user input (Zod)

6. Data retention

We retain your personal information for as long as your account is active or as needed to provide the Service. After your account is closed, we keep your data for a maximum of 90 days to allow reactivation, after which it is permanently deleted. Billing data is retained in accordance with Canadian tax obligations (minimum 7 years).

7. Your rights

In accordance with PIPEDA and Law 25, you have the right to:

• Access your personal information
• Correct inaccurate or incomplete information
• Delete your information (right to erasure)
• Withdraw your consent at any time
• Obtain a copy of your information in a structured format (portability)
• File a complaint with Quebec's Commission d'accès à l'information

To exercise these rights, contact us at dreyerfred@gmail.com.

8. SMS and electronic communications

SMS messages are sent only with the recipient's explicit consent, in accordance with Canada's Anti-Spam Legislation (CASL). Each recipient can unsubscribe at any time by replying "STOP" to the message received. Consent is recorded with a timestamp and can be withdrawn at any time in the account settings.

9. Cookies and similar technologies

We use cookies that are essential to the operation of the Service (authentication, session preferences). We do not use advertising tracking cookies or third-party cookies for marketing purposes. Session data is stored locally in your browser (localStorage) and is not shared with third parties.

10. International transfers

Your data is primarily hosted in Canada (AWS ca-central-1). Some processors (Stripe, OpenAI, Mailjet) may process data in the United States. These transfers are governed by contractual clauses that meet the requirements of PIPEDA and Law 25.

11. Changes to this policy

We may update this privacy policy from time to time. In the event of significant changes, we will notify you by email or through a notification in the Service. The date of the last update is shown at the top of this page.

12. Privacy officer

For any questions about this policy or the processing of your personal information, please contact our privacy officer: