Privacy Policy

1. Introduction

Vantage ("we", "our", "us") is committed to protecting the privacy of the users of its management platform for construction contractors (the "Service"). This privacy policy describes the types of personal information we collect, how we use, share and protect it, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25 (Act respecting the protection of personal information in the private sector).

2. Information we collect

We collect the following categories of information:

2.1 Information you provide directly

• First and last name, email address, phone number
• Company name, address, tax number
• Billing and payment information (processed by Stripe)
• Content of quotes, invoices, projects and reports
• Uploaded job-site photos
• Messages sent through the contact form

2.2 Information collected automatically

• IP address, browser type, operating system
• Pages viewed and interactions with the Service
• Performance data and technical diagnostics

2.3 Third-party information

• Client information you add to your Vantage CRM
• Payment data from Stripe

3. How we use information

We use your information to:

• Provide, maintain and improve the Service
• Create and manage your account
• Process payments and manage your subscription
• Send transactional communications (quotes, invoices, notifications)
• Send confirmation and reminder SMS messages (with your explicit consent, in accordance with CASL)
• Generate quotes through our artificial intelligence service
• Answer your questions in the conversational assistant and produce your weekly business insights
• Store files (job-site photos, PDF documents) securely
• Provide technical support
• Comply with our legal obligations

4. Sharing information

We never sell your personal information. We only share it with:

• Amazon Web Services (AWS) — Hosting for the files you upload (S3, ca-central-1 region, Montréal, Québec)
• Render — Hosting for the application and the main database (Ohio region, United States)
• Vercel — Website hosting (United States)
• Stripe — Payment processing, PCI DSS compliant (United States)
• Mailjet — Transactional email delivery (European Union — Germany and Belgium)
• Twilio — SMS delivery, with CASL consent (United States)
• OpenAI — AI quote generation, conversational assistant, and weekly business insights. For insights, only 7-day numeric totals are transmitted (counts of quotes, invoices and new clients, amounts collected and overdue — no client names, no project details) (United States)

5. Data storage and security

We implement appropriate security measures to protect your data:

• Encryption in transit (HTTPS/TLS) and at rest
• Passwords hashed with bcrypt (12 rounds)
• JWT authentication with short-lived access tokens (15 minutes)
• Multi-tenant isolation (each company has its own separate data space)
• Automatic daily database backups
• Rate limiting to prevent abuse
• Validation of all user input (Zod)

Our team's access to your account

By default, nobody at Vantage can enter your account. Our team only gets in if an administrator at your company explicitly allows it, from Settings → Team → « Allow Vantage support ». That authorization is recorded with the date and the identity of the person who granted it, it never reactivates on its own, and you can remove it at any time in a single click.

While an authorization is active, a banner stays visible in your account, and you receive an email every time a support session is opened. Sensitive actions taken by support are written to a log you can review, including after the authorization is removed. Support can never change your subscription, your payments, your team, or close your account.

6. Data retention

We retain your personal information for as long as your account is active or as needed to provide the Service. You can close your account at any time from the settings (Subscription → “Permanently close my account”). After closure, your data is kept for 90 days to allow reactivation (just write to info@vantagesuite.ca), after which it is permanently deleted — database and uploaded files. Only the billing history of your subscription is retained by our payment processor (Stripe), in accordance with Canadian tax obligations (minimum 7 years).

7. Your rights

In accordance with PIPEDA and Law 25, you have the right to:

• Access your personal information
• Correct inaccurate or incomplete information
• Delete your information (right to erasure)
• Withdraw your consent at any time
• Obtain a copy of your information in a structured format (portability)
• File a complaint with Quebec's Commission d'accès à l'information

To exercise these rights, contact us at info@vantagesuite.ca.

8. SMS and electronic communications

SMS messages are sent only with the recipient's explicit consent, in accordance with Canada's Anti-Spam Legislation (CASL). Each recipient can unsubscribe at any time by replying "STOP" to the message received. Consent is recorded with a timestamp and can be withdrawn at any time in the account settings.

9. Cookies and similar technologies

We use cookies that are essential to the operation of the Service (authentication, session preferences), which do not require your consent. Any other cookie — audience measurement and advertising measurement — is only set with your explicit consent, which you can grant or decline per category via the banner shown on your first visit. Session data is stored locally in your browser (localStorage).

Audience measurement (Google Analytics).On our public website (vantagesuite.ca), we use Google Analytics 4 to measure audience — only if you consent to the "Analytics" category. No analytics cookies are set before you consent, and your IP address is anonymized. Without consent, the tag runs in "consent denied" mode (Google Consent Mode): no cookies are set and only anonymous, cookieless technical signals without identifiers are sent to Google to estimate aggregate statistics (for example, the approximate number of visits).

Advertising measurement (Google Ads).If you consent to the "Marketing" category, we measure the effectiveness of our advertising campaigns through Google Ads — for example, learning which ads lead to a sign-up or a subscription. No advertising cookies are set if you decline this category. You may decline without affecting your use of the site, and withdraw your consent at any time by clearing your browser cookies or by writing to info@vantagesuite.ca. Your choice is stored locally in your browser along with the date of your decision.

10. Where your information is hosted

Your information is not all hosted in the same place. Here is the exact breakdown:

• In Québec — The files you upload (job site photos, documents, quotes and invoices as PDFs, your company logo) are hosted with AWS in the ca-central-1 region, located in Montréal. These files do not leave Québec.
• In the United States — The application and the main database are hosted with Render in the Ohio region. This is where information about your clients, employees, projects, quotes, invoices and time punches resides. The website is hosted by Vercel, also in the United States.
• With our other processors — Stripe, OpenAI, Mailjet and Twilio process certain data outside Québec, as described in section 4.

These communications outside Québec are governed by contractual agreements with each provider and are covered by a privacy impact assessment, in accordance with section 17 of Law 25 and the requirements of PIPEDA. You may request a summary by writing to info@vantagesuite.ca.

11. Changes to this policy

We may update this privacy policy from time to time. In the event of significant changes, we will notify you by email or through a notification in the Service. The date of the last update is shown at the top of this page.

12. Privacy officer

For any questions about this policy or the processing of your personal information, please contact our privacy officer: