Privacy Notice

Vanteloq Privacy Policy Version: 2026-10-20-meets-v1 1. Scope and accountability This Privacy Policy applies when you visit vanteloq.com, create or use a Vanteloq account, administer a workspace, connect a supported service, submit a form, make a Vanteloq Advisory inquiry, or contact us. Vanteloq Inc. operates Vanteloq and is responsible for personal information under its control. Contact the Vanteloq Privacy Officer at hussienissa@vanteloq.com or through our private contact form (https://vanteloq.com/contact). Vanteloq follows Alberta’s Personal Information Protection Act (https://www.alberta.ca/personal-information-protection-act) and Canada’s Personal Information Protection and Electronic Documents Act (https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/) where each law applies. 2. Information we collect Account and workspace information We collect information you provide, such as your name, email address, password credentials handled by the authentication provider, business name, legal name, business contact details, role, location information, operating hours, and workspace settings. Public inquiries and Vanteloq Advisory Contact, custom plan, free demo and Vanteloq Advisory forms collect your name, email address, optional phone number, business name when relevant, and the message, business priority or scheduling preferences you choose to provide. For free demo and Advisory forms, we also collect a browser-generated submission reference, the notice version and the time your consent was submitted. Cloudflare Turnstile processes limited browser and security signals to help protect these forms from abuse. Resend delivers the inquiry and limited consent evidence to our team. Do not include passwords, payment details, identity documents, customer records or other sensitive information in a public inquiry. Data Studio authoring, when enabled Data Studio is a separate authoring service. When enabled for your account, its library stores full saved files and revisions, which can include imported CSV rows, embedded images, titles, authorship and timestamps, tasks, schedules, and saved Meets plans, notes, chat messages, polls and votes. This stored content is distinct from the native Studio analysis definitions described below. Its hosting processing is described in the Service Provider Notice (https://vanteloq.com/subprocessors). Data Studio can use your main Vanteloq identity while checking its own workspace access, file requests and permission for requested source records. It uses its own secure session and continuation cookies scoped to its application path. Signing in does not transfer every product's files, grant another organization access, or authorize Google Drive, Calendar or other provider access. When Sources is enabled and you explicitly request a preview, Data Studio reads a bounded selection of recorded daily sales from your permitted Vanteloq business and locations. Access and capture consistency are rechecked as pages are retrieved. Preview values are handled separately from ordinary saved files, revisions, search, export and AI features. This is a request-based preview of existing Vanteloq records, not automatic synchronization of all apps or a fresh collection from your POS provider. Data Studio does not currently connect to BookLoQ. Data Studio access does not authorize creating, approving, editing, posting, voiding or paying accounting records. Existing permissioned BookLoQ review features in native Vanteloq Studio remain separate. Data Studio access does not enable optional AI processing, recording or transcription. Saved Meets plans, notes, messages and polls are distinct from live calls. A local camera or microphone check does not join a call. When live Meets is enabled, you choose whether to join and whether to share your microphone, camera or a selected screen or window. Your shared media is transmitted through LiveKit to permitted participants. LiveKit also processes connection and service information, such as network addresses, device information, participant identifiers and call timing, to provide and operate the connection. This release does not enable guests, telephone calling, recording, transcription or an AI participant. Other participants may still capture content using tools outside Vanteloq. Vanteloq checks current account, workspace and meeting permissions. A separate controller hosted on Cloudflare stores call-control and security records, including workspace, meeting and session references, participant identifiers, connection timing, authorization state and removal/retry records. This does not transfer your Data Studio account database, saved documents or BookLoQ records to that controller. The controller does not receive the call's audio or video stream. Call-control and security records are not automatically erased when a call ends. Ending a call, signing out or deleting a saved meeting does not establish deletion of provider logs or backups. Contact the Privacy Officer at hussienissa@vanteloq.com about the scope of a deletion request and any unresolved records. We do not promise a fixed provider-log or backup-erasure deadline through the call controls. Processing may occur outside Canada. This release does not promise Canada-only processing or end-to-end encryption. Share only information that you are authorized to disclose to the participants and the service providers described in the Service Provider Notice. Studio analyses When you save an analysis in Vanteloq Studio, we store its name, reporting scope, chart settings, SQL text or assumption-cell definitions under your account and workspace. These private definitions do not store a copy of source rows or calculated results. Reopening or refreshing an analysis checks current access and reads the permitted source again. SQL drafts are used for bounded analytical queries and do not provide direct access to the production database. Assumptions do not change operational or accounting records. You can delete saved analyses in Studio; account deletion also removes your private Studio definitions. Existing audit and backup retention rules apply. Optional AI analysis still requires its separate permission. Connected business information Your business template, selected tools and priorities personalise onboarding and the workspace. Reviewed changes retain a dated configuration history. Changing a business type does not delete existing records, change accounting totals or grant additional subscription or role permissions. If you choose Save progress during setup, we retain the entered business profile, operating hours, business template, layout and current step in an account-scoped draft. Drafts exclude tax identifiers, passwords, payment details and legal acceptance. A draft expires after 48 hours and becomes unavailable; expired records are removed during subsequent draft housekeeping. Completing setup, discarding the draft or deleting the account also removes it. This is not a promise of immediate physical deletion from managed backups. Manual payroll accounting entries may contain aggregate wage costs, employer costs, payroll liabilities, and a reference to a customer-approved payroll report. The payroll screen does not connect to a payroll provider or collect employee bank instructions. Customers must limit entries to necessary accounting information and provide employees with any notices or other protections required for their use of the service. When an authorized workspace user connects a supported provider or imports records, Vanteloq may receive sales, payment, refund, product, inventory, customer, supplier, location, purchasing, finance, and operational records. The exact fields depend on the source, the permissions granted, and the import selected by the user. Shopify privacy requests When Shopify sends a verified customer data request for a previously authorized store, Vanteloq records the store, request identifier, customer identifier or email address, and requested order identifiers in an encrypted request scope. A generic task and notification alert an authorized workspace owner or administrator without including those customer identifiers. The private request workflow provides matching imported customer, sale, payment and staged-order records for local download. The operator must review other retained documents or communications, verify the recipient and deliver the response securely before confirming completion. Vanteloq does not automatically send the export to the customer. Team tasks and messages Tasks can record an assigned member, location, due date, status and source reference. Team messages store the author’s display name, message text, channel, optional task reference and timestamp. Messages are shared with authorised members of that workspace and channel. A task discussion inherits the task’s location and evidence restrictions. This is shared business communication, separate from private Vanteloq AI conversations. Avoid entering credentials, payment details or unnecessary personal information. Workspace deletion removes these tasks and messages from the active application database. An individual account deletion removes that member’s messages in the applicable workspace; shared business tasks can remain. No automatic age-based purge is established for team messages. Managed backups and independent provider records follow their separate retention periods. Vehicle inventory For dealerships that use vehicle inventory, Vanteloq stores the vehicle identifier or VIN, model year, make, model, workspace stock number, location, inventory status, acquisition date and any acquisition or reconditioning amounts the customer enters. Source, revision and access metadata support review and export. These records do not include customer finance applications or create accounting entries automatically. Vehicle identifiers can be associated with individuals in other records; enter only information needed for your authorized inventory work. Workspace deletion removes these inventory records. Removing an individual user preserves shared inventory with that user’s authorship removed where applicable. Dealership operations may also retain separate stock-acquisition episodes, ownership and preparation states, cost lines and approvals, reservations, delivered-sale and reversal records, sales-credit allocations, tasks, customer names and contact details, lead stages, follow-up dates and appointments entered by an authorised user. These are shared workspace operating records with location and permission restrictions, not credit applications or a dealer-management-system connection. Do not enter identity documents, social insurance numbers, credit scores or financing applications in these fields. Source references and change history support review; deleting an individual member does not erase shared transactions. Applicable workspace deletion removes these records. Customer correction or deletion requests can be directed to the Privacy Officer where a self-service control is unavailable. Café and restaurant cost records Recipe records include ingredient quantities, purchase costs, units, usable yields, portions, modifier mappings and source dates. Reviewed edits retain the versions saved from the time revision history is enabled; versions overwritten before that point are not reconstructed. Reviewed period records may contain inventory costs, sales, labour totals, waste and check counts. Payroll amounts require additional permissions. These records support operational comparisons and do not post journals, calculate employee pay or automatically change stock. They remain until applicable workspace deletion or an authorised retention process; no automatic age-based purge is established for these operating records. Reviewed operating workflows and follow-up Optional workflows retain the source references, quantities, amounts, dates, responsible people, review decisions and corrections entered by authorised users. Depending on your business tools, these may include supplier receipts, stock movements, lot actions, preparation batches, delivery and settlement records, vehicle funding checks, customer jobs and time costs, special orders, room readiness and reservation dates. Enter only information needed for the business task. These records are restricted to the permitted workspace and location. Manual references are not proof that a provider connection or external action has completed. Managed stock requires a reviewed opening count. Accepted receipts and explicitly approved preparation batches can change that separate stock ledger; reversals retain the original movements. These controls do not overwrite a connected POS or post accounting entries automatically. Reviewed operational changes retain dated revisions. Applicable workspace deletion removes these operating records and their revision history. Removing a member can leave shared business records with the member’s authorship removed. No automatic age-based purge is established for this operating history. BookLoQ collection follow-up can store contact notes, payment promises, dispute status and next actions linked to an invoice. Automatic reminders are off by default. Only the owner can authorise reminders for a real invoice and its saved recipient. Current access, recipient, invoice balance and delivery eligibility are checked again before a send. Opt-in owner briefings use operating hours, time zone, closures and quiet hours. Email delivery uses the configured mail provider; provider acceptance does not prove receipt or that the recipient read it. Delivery attempts, failures and acknowledgements are retained with the workspace to prevent duplicate sends and support review. Turning delivery off stops future eligible sends, but cannot recall a message already sent. A downloaded export or received email needs separate secure handling. Google and Meta connections Google Analytics and Search Console use read-only permissions. Google Business Profile and Google Ads use broader provider grants that can include management or editing access. Vanteloq uses Google Ads for reporting and does not change Google campaigns. A Business Profile review reply requires a separate confirmation. Meta also grants ad-management permission; supported campaign changes require a separate confirmation. After resource approval, detailed marketing reports may retrieve website traffic by channel, page and device; Search Console queries, pages, clicks, impressions and average positions; local Business Profile discovery measures and monthly search terms; and paid campaign measurements from Google Ads or Meta. Detailed report responses are not cached in Vanteloq's database. They are visible only within the user's permitted workspace and location scope. Refreshing a report does not change a campaign, publish content or grant new provider permissions. Meta paid-ad reporting does not include organic Facebook Page or Instagram insights. A Google or Meta connection remains unavailable for measurement until an authorized user selects the exact eligible account, property, or owned business location, assigns it organization-wide or to an owned workspace location, and approves a warning-free sample. Vanteloq may retain encrypted authorization credentials while the connection is active, the selected provider and resource identifiers, the chosen workspace scope, connection and sync status, and derived daily measurements with source and freshness details. We use that information only to provide the connected reporting and operational features requested by the workspace. For a selected Google Business Profile location, an authorized user may request the current review response queue. Review text, ratings, reviewer details, and reply content are fetched directly from Google for that request, are sent with a no-store response, and are not inserted into Vanteloq's database or aggregated into a customer profile. Vanteloq sends a reply to Google only after a user with marketing-management permission enters the reply and provides a separate, specific confirmation. Google remains the system of record for the review and reply. Connected financial account information When an authorized workspace owner chooses a bank connection, Vanteloq may use Plaid as a service provider to connect selected business accounts. Depending on the connection and consent shown, Vanteloq may receive account and institution names, masked account identifiers, account type, balances, transactions, transaction descriptions, pending or posted status, currency, provider item and account identifiers, and connection or sync status. Bank sign-in information entered in Plaid Link is handled by Plaid and the financial institution. Vanteloq does not receive the online banking credentials entered in that flow. When a Plaid connection is configured and an authorized workspace user completes the provider consent flow, the connection uses only the read-only data products disclosed in that flow and does not allow Vanteloq to move money. We use connected records for bookkeeping review, reconciliation, supported cash context, connection support, security, and audit evidence. QuickBooks Online connection When an owner or administrator chooses to connect QuickBooks Online, Vanteloq records the selected company identifier, company name, authorization status, encrypted refreshable credentials, and security or audit metadata. The current sandbox stage verifies the selected company but does not import ledger records or enable dashboard calculations. Before a future accounting import is enabled, Vanteloq will identify the accounting records requested, the mapping and reconciliation controls, and any additional review required. Vanteloq AI information Vanteloq AI data use: Vanteloq AI handles business questions and app guidance in one conversation. With Workspace data enabled in AI Settings, answers may use permitted organization-wide BookLoQ ledger and cash summaries. Historical cash totals may include reviewed bank statement imports, with their reporting dates. Demonstration records, original documents and transaction descriptions are excluded from the automatic business summary. These summaries are kept separate from dated retail KPIs; raw ledger records and the identities in those records are not attached. With Workspace data disabled, business records are excluded, while your question, product guidance, limited personalization information and permitted recent conversation context may still be sent. Separately confirmed chat attachments follow the notice below. Changing Workspace data starts a new chat. A saved, current agreement must cover the selected data use before a request can be sent. When Workspace data is enabled and an authorized user accepts the current data-use notice and asks Vanteloq AI a question, Vanteloq sends OpenAI the question, product guidance, dated aggregate sales, profit, units, labour, inventory-value and accounts-payable metrics where the user has the corresponding permission, connected-source status and freshness, and permitted aggregate cash context. Users with marketing access may also include synchronized traffic, search and advertising totals from their approved sources, with reporting periods and data-coverage limits. Search queries, page addresses, Google Business Profile content, advertising amounts without verified currency, raw provider credentials, full account numbers, customer names, invoice or receipt files, and raw transaction records are excluded from the automated evidence summary. Do not include personal information or secrets in your question. Up to six recent conversation messages may be sent to OpenAI for a follow-up, including messages held in the open chat when conversation memory is off. Access is checked against the current user, workspace, permissions, subscription, consent and scope. A change in business figures does not by itself erase an authorized earlier conversation. Earlier replies are labelled as historical context and do not establish current accounting evidence. Open-chat context expires after a limited period and is rejected when its access or scope no longer matches. Starting a new chat clears that context. OpenAI is the current AI response provider. When conversation memory is enabled, Vanteloq stores the question, the generated explanation, a limited evidence summary, the model identifier, and conversation timestamps so the authorized user can continue the conversation. With memory off, new questions and replies are not saved in the Vanteloq chat database. Advisor records are scoped to that user and workspace. AI response and display preferences are saved separately from conversation memory. These choices include response length, explanation style, format, business priorities, text size and spacing. The preference controls do not accept a free-text personal profile. A request may send your selected preferences, workspace role, currency and time zone, and a validated first name from your account to personalize the reply. You can reset saved preferences in AI Settings. Saving a chat title stores that title with your private conversation. Uploaded bank statements, invoices, receipts, and other documents Bank statements can supply historical bank movements after an authorized reviewer checks the account, dates, rows and opening-to-closing balance. Vanteloq retains the original document and import history. These imports do not automatically post journals, establish accounting profit or confirm today's available balance. Statement activity is withheld from combined cash reporting while an approved Plaid feed is active to avoid duplicate counting. Optional AI analysis receives only permitted dated aggregates under the current AI data-use agreement. When available, an authorized owner or administrator with BookLoQ can separately enable a private document forwarding address after accepting its storage notice. Cloudflare Email Routing processes incoming messages, and an Email Worker sends supported attachments to Vanteloq's private quarantine. Vanteloq records the unverified sender address, receipt time and duplicate-check references, but does not keep the email body. The address can be replaced or disabled. Forwarding does not authenticate the sender as a Vanteloq user and never starts scanning, extraction, AI analysis or accounting posting. Those actions retain their separate permissions and review steps. Forwarded originals follow the same document retention and deletion controls as uploaded originals. Deleting an original removes its sender address from the attachment receipt; a minimal receipt remains to prevent the same delivery from recreating the file. Failed uploads retain a private disposal reference until storage cleanup succeeds. Interrupted writes may require support review before cleanup can be confirmed. Cloudflare states that Email Routing does not store email content; this does not mean that Vanteloq's quarantined attachments, email-provider delivery metadata or copies in the sender's mailbox are not stored. When a user uploads a business document, we may collect the original file, file name, type, size, cryptographic duplicate-check value, uploader, upload time, document category, storage reference, review status, and links to related transactions or records. If document extraction is enabled, we may also process proposed supplier, customer, date, amount, tax, currency, line-item, confidence, and source-page fields. Extracted fields remain subject to human review. Private linked files Where configured, a workspace owner may separately connect Google Drive and Sheets or Microsoft OneDrive. Google requests read access to Drive files; Microsoft requests read access to the signed-in user’s OneDrive files and continued access. These provider grants can cover more files than the owner selects in Vanteloq. Vanteloq uses that access to list supported files and import only the files and sheet tabs the owner selects. It does not edit the original files. These permissions are separate from marketing connections. Vanteloq stores encrypted connection credentials, file identifiers and names, source revision and refresh timestamps, encrypted Google Sheet table snapshots, and private PDF copies of selected documents. While the Linked Files panel is open and visible, it checks up to 2 enabled files per minute. This is not continuous background monitoring. Document copies enter quarantine and retain separate scanning, extraction and accounting review steps. A table or document refresh never automatically posts a journal or changes financial reports. You can pause a selected file, unlink it or disconnect the account. Unlinking removes the linked table snapshot. Disconnection removes local connection credentials and linked sources; you can also revoke the app in your Google or Microsoft account. Previously imported document copies and reviewed accounting records remain subject to their separate deletion and retention controls. Linked file content is not automatically sent to Vanteloq AI. Service and security information We may collect device and browser details, IP address, timestamps, authentication events, audit events, integration status, request identifiers, error details, and records of actions taken inside a workspace. This information supports sign-in, fraud prevention, troubleshooting, access control, and service reliability. Website analytics After a visitor explicitly allows analytics, Google Analytics may process page paths without URL query text, device and browser context, approximate region, timestamps, and configured interaction events. We use these measurements to understand public site use and improve navigation, content, and reliability. Advertising signals and ad personalization remain disabled, and Vanteloq does not intentionally send account details, form entries, contact details, or workspace records to visitor analytics. Communications and billing information We collect messages and support details that you send to us. Stripe provides subscription status, plan, billing contact, transaction identifiers, tax related checkout fields, and limited payment details. Stripe collects card information in its secure checkout. Vanteloq does not receive or store full card numbers. Optional news and product updates Newsletter enrolment is not offered during signup or onboarding. Creating an account, accepting our terms or contacting support does not subscribe you. Previously recorded preferences and unsubscribe controls remain available. We record the consent notice, your choice, verification time and limited hashed request evidence. Unverified signup choices expire after 7 days. You can turn updates off in Settings or use the unsubscribe link without signing in. Account and security messages are separate. When an account closes, we remove its newsletter recipient profile and keep only minimal keyed suppression and unlinked consent evidence needed to honor your choice and answer compliance questions. Address validation and transactional email Signup uses manual address fields. If a separate AddressComplete search is offered and you choose to use it, Vanteloq sends the address search text and country to Canada Post AddressComplete and receives address suggestions and the selected address result. When an authorized user sends an invoice email, Resend processes the recipient, sender, subject, message content, attachment, and delivery metadata for that requested delivery. 3. How we use information We use information to: - create, authenticate, secure, and administer accounts and workspaces; - import, organize, reconcile, display, and analyze records selected by authorized users; - store and review uploaded source documents, detect duplicate files, and support document extraction where that feature is enabled; - provide reports, calculations, alerts, audit context, and operational workflows; - use the selected AI provider, after separate affirmative acceptance, to explain verified aggregate business evidence and identify missing inputs; - maintain integrations and show their connection or verification status; - respond to contact, custom plan, free demo, Vanteloq Advisory and support requests, including arranging a requested conversation; - protect the service, investigate misuse, and meet legal obligations; - measure and improve the public website after the visitor allows optional analytics; - improve reliability and usability using the service and security information described above; and - send commercial electronic messages only with express or implied consent, or when an applicable CASL exception permits the message, with the required sender information and unsubscribe method; We do not sell personal information. We do not use workspace business data to create advertising profiles. 4. Consent and workspace authority We obtain consent where required and identify the purpose before or when information is collected. You may withdraw consent, subject to legal, security, and contractual limits. Withdrawal may prevent features that need the information from continuing to operate. A workspace customer decides which authorized users and supported sources are added. The customer is responsible for having the authority to provide business records and personal information to Vanteloq. If Vanteloq processes personal information for a customer, that customer remains responsible for its own notices, permissions, and legal obligations. Connected-service consent Before an implemented provider connection begins, Vanteloq shows an unselected acknowledgement with that provider’s privacy policy, the applicable data use and permission limitations. It records the workspace, user, provider, acceptance time and current notice and policy versions. The provider presents its own permissions separately. Connecting does not by itself authorise optional automatic synchronization, AI processing, a payment or a message. Slack notifications use an incoming webhook for one chosen channel. A separate owner-only conversation option requests public-channel information and history permissions in addition to that webhook. Slack’s grant can cover other public channels where the app is a member, but Vanteloq restricts its reader to the public channel selected during installation and excludes private channels, direct messages and shared channels. The owner must confirm authority to share the channel and provide any notices required for its members. Existing notification connections require an explicit disconnect and new authorization before conversation reading can begin. The Slack reader loads at most 15 recent parent messages on an explicit request, subject to provider limits. It processes plain text, Slack author identifiers, timestamps and reply counts in request memory and the owner’s open panel. It does not save message content in Vanteloq, copy it into team messages, read files or thread contents, or send it to AI. Leaving the panel clears its displayed snapshot. Encrypted credentials, selected channel and team identifiers, the owner’s consent and read cooldown metadata are retained while the connection is active. Replies and full history remain in Slack. Disconnection stops future reads; Slack’s independent retention and permissions continue to apply. Before Plaid Link opens, Vanteloq shows a separate financial-data authorization that names the requested data categories, each processing purpose, the read-only limitation, retention consequences, and withdrawal choices. The authorization is not preselected. An authenticated user must actively accept it, and Vanteloq records the workspace, user identifier, acceptance time, provider, data categories, purposes, and versions of this Privacy Policy and the authorization notice. Plaid then presents the eligible institutions, accounts, and provider-specific permissions in Plaid Link. A financial connection begins only after both steps are completed. A workspace owner can disconnect the connection, which stops scheduled access and causes stored provider access credentials to be revoked or deleted. The owner can then use the protected Plaid deletion control to delete unreviewed imports and remove bank/provider identifiers from accounting records that must remain. Approved, reconciled, or posted accounting fields and limited audit evidence may remain when needed for legal recordkeeping or a documented retention requirement. For Google and Meta, authorization alone does not approve measurement collection. An authorized workspace user must complete the provider resource and owned-location selection described above before measurement sync can begin. Disconnecting stops scheduled access and removes the local authorization credential even if the provider's remote revocation service is temporarily unavailable. Before QuickBooks authorization begins, an unselected acknowledgement explains that Intuit’s accounting grant is broader than Vanteloq’s current company-verification use. This stage stores company identity, authorization status and encrypted continuing-access credentials; ledger, invoice, bill and tax imports are not enabled. Vanteloq records the workspace, user, provider, acceptance time and notice versions. Intuit then presents its own company selection and authorization screen. Any future import requires its own identified records and review controls. Vanteloq's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Google data is used only to provide or improve the customer requested feature, is not sold, is not used for advertising, and is not transferred except to provide or secure the feature, comply with law, or as part of a transaction with appropriate safeguards. Vanteloq AI data-use acceptance Vanteloq AI uses OpenAI. Before the first request for a data-use purpose, the agreement starts unchecked. Your acceptance is saved for your account and workspace and checked against the current notice before each request. New chats and changes to conversation memory keep that agreement. Disabling Workspace data keeps business records out of the request while allowing app instructions and general financial or analytical guidance in the same assistant. You can decline the agreement or withdraw it in AI Settings to stop future AI requests while continuing to use other permitted workspace features. The workspace must have authority to use its imported records for this purpose; an employee agreement does not replace obligations to customers or staff. OpenAI API content is not used for training by default unless the account opts in. The Vanteloq application does not enable training; provider-account administrators must keep optional training and data-sharing settings disabled for business analysis. Requests disable stored Responses API objects, but this is not zero retention: provider abuse-monitoring logs may retain content for up to 30 days, with exceptions described by OpenAI. Additional provider caching and legal obligations may apply. Clearing a conversation in Vanteloq deletes its active application records; it does not erase provider safety logs. OpenAI data controls (https://developers.openai.com/api/docs/guides/your-data). Optional chat attachments have a separate confirmation for each message. If you select a PDF, supported photo, TXT or CSV file and confirm sending it, its contents and filename are sent to OpenAI for that reply. This works separately from the Workspace data setting. Vanteloq processes these files in request memory and does not save them in Documents, file storage or chat history. The attached exchange, including its question and answer, is not saved even when conversation memory is enabled. It remains visible in the open chat until cleared or closed. Recent messages from that exchange may inform a follow-up while the open-chat context remains valid; the original file is not automatically attached again. Follow-ups using that attachment context also remain unsaved. OpenAI safety retention still applies, including exceptions for file and image inputs under its data controls. Structural file validation is not a malware-scan certification. Attach only files you are authorized to share, remove personal identifiers or secrets first, and verify extracted figures. Attaching a file does not import transactions or change accounting records. Use Documents and the reviewed import workflow for those tasks. The separate AI data-use notice describes the data categories, purpose, exclusions, conversation memory, and links to this Privacy Policy. Vanteloq records the workspace, user, provider, acceptance time, data categories, purposes, and versions of this Privacy Policy and the Advisor notice. A current agreement must cover the selected Workspace data setting. If no matching agreement exists, including after withdrawal or a notice-version change, Vanteloq asks for acceptance again before sending a request. Commercial electronic messages require express or implied consent, or an applicable CASL exception. A purchase, transaction, customer profile, or imported contact does not automatically establish consent to receive those messages. Customers remain responsible for determining which rule applies and for their notices, sender identification, contact information, unsubscribe controls, consent evidence, and suppression lists. 5. When information is shared We may disclose information: - to authorized users in the same workspace according to their roles and permissions; - to providers that support hosting, authentication, security, email delivery, payments, support, and connected services; - when an authorized user directs a connection, export, or disclosure; - to investigate security incidents or enforce the Terms of Service; - where required by law, court order, or lawful government request; or - as part of a business transaction, subject to appropriate confidentiality and legal protections. Current infrastructure and product flows may involve Cloudflare for hosting and security, Supabase for authentication, Stripe for billing, Resend for authorized transactional email, Canada Post AddressComplete for address validation, Google Analytics after a visitor allows public website measurement, Plaid for a bank connection selected by an authorized workspace owner, OpenAI for a Vanteloq AI request affirmatively started by an authorized user, and the provider chosen by a workspace for another authorized integration. The current list and purposes appear in the Subprocessor and Connected Service Notice (https://vanteloq.com/subprocessors). Plaid also provides information about its handling of connected account data in its End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy). 6. Processing outside Canada Resend may process contact, custom plan, free demo and Vanteloq Advisory inquiries, authorized email content, limited consent evidence and delivery metadata in the United States. The Service Provider Notice (https://vanteloq.com/subprocessors) describes its purpose. Contact our Privacy Officer at hussienissa@vanteloq.com to ask about our practices for service providers outside Canada. Some service providers may process or store personal information outside Canada. Cloudflare may process web traffic through its global network for hosting, delivery, and security. Supabase processes authentication information in the configured project region and may use subprocessors in other countries. Stripe may process billing and supported payment information in the United States and other countries outside Canada when configured. Plaid may process authorized financial-connection information in the United States and other countries identified in its privacy materials when configured. Google may process consented website analytics and authorized Google integration data in countries described in Google's service materials. OpenAI is the enabled Vanteloq AI provider. OpenAI may process authorized AI requests in the United States and other countries described in its service materials; Canadian-only processing has not been established. A customer-selected integration may also process authorization and synchronized records in countries disclosed by that provider. Information processed in another country may be subject to that country’s laws and lawful access rules. We assess providers and use contractual, technical, and organizational safeguards appropriate to the information and service. Contact the Privacy Officer at hussienissa@vanteloq.com to ask about a current service-provider location or safeguards relevant to a specific connection. 7. Retention and deletion We keep information only as long as reasonably needed for the purposes described in this policy, to provide the service, protect the integrity of business records, meet legal requirements, resolve disputes, and maintain security or audit evidence. Retention periods vary by record type. Account, transaction, audit, and accounting records may need different periods. When information is no longer required, we delete it, anonymize it, or securely isolate it until deletion is completed. Backup copies may remain for a limited period before being overwritten. Public inquiry and Vanteloq Advisory contact information is retained only as long as reasonably needed to respond, manage the prospective business relationship, document consent, resolve a dispute or meet a legal requirement. Resend delivery records remain subject to its independent systems and retention practices. Active provider access credentials are kept only while the connection is active and are revoked or deleted after disconnection. Slack disconnection removes local message access immediately. If provider removal is unconfirmed, encrypted removal-only material may remain isolated from message sending until a successful retry or your recorded confirmation of manual removal in Slack. The Integrations screen shows this pending step; no automatic retention deadline is applied to that cleanup material. Scheduled collection then stops. After disconnecting Plaid, an owner can permanently delete unreviewed Plaid imports. For a transaction already approved, reconciled, or posted into a journal, the deletion workflow removes Plaid identifiers, pending links, and transaction descriptions while retaining the minimum accounting fields needed to preserve ledger integrity. After a Google or Meta disconnection, Vanteloq removes the local access credential and stops collection. Selected resource identifiers, derived measurements, and limited audit evidence are deleted or retained only for the documented service, security, legal, or workspace recordkeeping purposes described in this policy. After a QuickBooks disconnection, Vanteloq requests provider revocation, deletes the locally stored authorization credential, and stops access. Company references and limited audit evidence are deleted or retained only for the documented security, legal, or accounting recordkeeping purpose. A disconnection does not silently delete accounting entries that an authorized user later reviewed and posted. Disconnecting Shopify deletes locally stored credentials and stops collection. Imported records are retained under their applicable rules. The store domain, prior authorization date and limited connection audit evidence can remain to route subsequent privacy or uninstall events for those records. Local disconnection does not establish that the provider-side app grant has been revoked. Pending Shopify privacy requests retain their encrypted identifying scope until completion or applicable workspace deletion. The queue assigns a 30-day response due date for operator follow-up; reaching that date does not automatically send a response or delete the request. Explicit completion clears the encrypted scope while retaining the opaque request identifier, request hash, status, export counts and timestamps, completing user, response method and a hash of the operator’s fulfilment reference. This is an operator attestation, not independent proof of delivery. This limited evidence follows the documented privacy and audit purpose and retention review; no automatic age-based purge is established. Workspace deletion removes the queue. Downloaded export copies require separate secure handling and disposal by the authorized operator. Linked-file names, provider identifiers, revision metadata and encrypted sheet snapshots remain while the source is linked. Pausing stops refresh without deleting those records. Unlinking removes the linked source and its snapshot; disconnecting removes local credentials and all linked sources for that connection, while limited connection and audit metadata may remain for the documented purpose. Applicable account or workspace deletion removes its cloud-file connections and linked sources. Previously imported PDF copies and reviewed accounting records follow their separate document and accounting retention controls. Revoke the app in the provider account when provider-side access also needs to end. Conversation memory is off by default whenever you open Vanteloq AI. With memory off, Vanteloq does not save new question or answer content in its chat database, but up to six recent messages held in the open chat may still be sent for a permitted follow-up. If you enable memory, Vanteloq saves eligible new messages and can reopen your authorized saved chats. Changing memory starts a fresh chat. Your data-use choice is stored against your account and workspace, and is checked against the current notice before a request. You can withdraw it in AI Settings; it is not required again for every message while that choice remains valid. Turning memory off stops loading saved history and saving new messages; it does not delete chats already saved. Use Manage saved chats to delete one or all of your saved chats in the current workspace from the active application database. Conversations inactive for 90 days are deleted when you next use the Advisor or open saved-chat controls. A limited deletion audit event remains without question or answer content. Provider safety logs and managed backups follow their separate retention periods. Saved AI response and display preferences remain until reset or applicable account or workspace deletion. Vanteloq also keeps limited request identifiers, hashes, state and timestamps to prevent duplicate AI processing and support retries. Those retry records do not contain the question, answer, attached files or authorization tokens. Records older than 24 hours are removed when you next submit a request that uses this retry control; this is not a scheduled 24-hour purge. Our retention policy assigns quarterly operational reviews and at least annual policy renewal to the Privacy Officer, with additional review after a material provider, product, infrastructure, or legal change. These reviews must identify expired purposes, unresolved deletion requests, legal holds, and records eligible for deletion or de-identification. Review dates, outcomes and exceptions must be recorded; the policy schedule does not itself establish that a review or disposal has occurred. A verified legal hold suspends deletion only for the affected records and documented period. Imported bank transactions, approved accounting records, original invoices and receipts, corrections, and review history may need a longer period because they support the customer’s books or legal obligations. Customers should export required records before closing an account and should confirm their retention duties with a qualified professional. Unsubscribe and suppression information may be kept in a minimal form so that a prior marketing choice can continue to be honoured. Security, incident, and audit records may be kept for a documented period that is proportionate to the risk and any applicable legal requirement. Optional website analytics remains disabled unless the visitor allows it. A visitor can withdraw that choice through Cookie settings. Google Analytics retention is controlled through the applicable property settings and Google's deletion tools, subject to legal and operational requirements. Data Studio files and closure In the enabled Data Studio authoring library, deleting a file physically removes its active database record and associated saved revisions and meeting-room record. Related tasks remain with their file link removed, and independent copies or derived files require separate review. There is no trash or recycle-bin recovery control. File deletion does not establish erasure from provider logs, backups, downloaded copies or another service. Signing out or revoking access is different from deleting Data Studio content. Main Vanteloq account or workspace closure must not be assumed to erase the separate Data Studio library or records used to grant access. Full Data Studio workspace or account closure requires assistance and is not an automatic control. Contact the Privacy Officer at hussienissa@vanteloq.com to establish the requested scope, available actions and technical limitations. We will distinguish confirmed removal from records or provider copies that remain unresolved. Available Data Studio file exports are not a complete archive of every revision, task, conversation or account record. Check the contents and supported format before relying on an export. These Data Studio controls do not establish an automatic content-purge schedule, a numerical log or backup deletion deadline, or recovery of a deleted or unsaved item. Self service account and workspace deletion If the protected deletion control is unavailable, contact the Privacy Officer using the address below. We will verify the request, explain any required retention or technical limitation, and arrange the applicable deletion process. Do not send passwords, authenticator codes, or identity documents in an ordinary email. Authenticated users can open Settings, Account and login, or the account deletion page (https://vanteloq.com/account/deletion), to review protected deletion controls after recent multifactor authentication. A paid subscription is not required. A nonowner can remove their Vanteloq membership, personal profile, preferences and private Advisor history. A shared sign-in needed by another service is retained. Business records remain with anonymous authorship where needed for the customer's accounting, security or audit integrity. Ambiguous or suspended workspace relationships require verified assistance before deletion can proceed. A workspace owner can permanently delete the workspace and its memberships after disconnecting providers and exporting required records. Vanteloq verifies the deletion scope, obtains separate confirmations, cancels the Vanteloq Stripe subscription and customer, and removes workspace records, uploaded files, local credentials and memberships. Other members' independent sign-in identities are not deleted by the owner's request. The requesting person's identity is removed only when it is not required by another workspace or the separate private console. A confirmed deletion uses an encrypted processing record so an interrupted request can be retried. The browser keeps a private deletion-session key for that purpose; it is not included in links or analytics. The status page distinguishes pending work from confirmed completion. Processing identifiers are cleared when completion is confirmed. The retry session expires after 30 days; unresolved requests then require verified assistance from the Privacy Officer. Deletion cannot remove records that Stripe, a connected provider, or another independent organization must retain under its own agreement or law. A pseudonymous receipt containing hashes, the deletion scope, result and general retained categories may be kept for 24 months. It does not contain the deleted name, email, workspace name, network address or provider account number. Hashes are not a guarantee of anonymity. Expired completed processing records and receipts are removed during privacy-request housekeeping. Backup copies and legally required records are subject to the managed retention cycle and any documented legal hold. 8. Safeguards Vanteloq uses safeguards designed for the sensitivity of the information, including authenticated access, records separated and scoped by organization, role-based server permissions, protected provider authorization flows, encrypted credential storage, request controls, and recorded audit and security events for important actions. Production browser, API, authentication, webhook, and provider traffic uses HTTPS. Vanteloq's production change control requires the managed edge to reject protocol versions below TLS 1.2 before Plaid production access is enabled. Stored application data is encrypted at rest by the managed database platform. Plaid access tokens and provider item identifiers receive an additional application-level AES-GCM encryption layer under a hosted key that is not stored with the database record. Vanteloq does not place raw Plaid credentials in browser storage, source control, ordinary connection-status responses, or application logs. No online service can promise absolute security. Users must protect their credentials, use strong passwords, enable available account protections, and promptly report suspected unauthorized access. 9. Access, correction, and privacy requests You may ask to access or correct personal information under our control, subject to legal exceptions. You may also ask about how information was used or disclosed, withdraw consent where applicable, or raise a privacy concern. Workspace controls allow an authenticated user to permanently delete their account and allow an authorized owner to permanently delete the workspace after the warnings and confirmation steps described above. Other controls allow an owner to export records, disconnect a provider, or correct reviewable fields. A disconnection is not the same as deleting legally retained accounting records. We will explain any applicable limitation when responding to a verified request. Send a clear privacy request to hussienissa@vanteloq.com or through our private contact form (https://vanteloq.com/contact). Contact, custom plan, free demo and Vanteloq Advisory forms collect the information described in section 2. Resend delivers these inquiries to our team so we can respond and, when requested, arrange a conversation. Resend may process this information in the United States. Our Service Provider Notice (https://vanteloq.com/subprocessors) explains its role. Submitting a request does not enroll you in marketing, create a subscription or create a paid Advisory engagement. Contact our Privacy Officer at hussienissa@vanteloq.com with questions about these practices. Avoid sending passwords, payment details, identity documents or customer records. We may need to verify your identity and authority before responding. If information is controlled by a Vanteloq customer, we may direct the request to that customer. If a concern is not resolved, you may contact the Office of the Information and Privacy Commissioner of Alberta (https://oipc.ab.ca/) or the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/), depending on which law applies. 10. Analysis and human review Optional voice dictation Dictation starts only after you choose Start dictation and your browser permits microphone access. Your browser or operating system may send audio to its speech-recognition service under that provider’s terms. Vanteloq does not record or upload audio. The resulting text appears in your message box for review and is sent to Vanteloq AI only when you send the message using the normal data-use controls. Dictation stops when you stop it, edit the message, leave the page, or reach 30 seconds or the 800-character message limit. Browser support and service availability vary. Reviewing analysis and suggested actions Vanteloq may organize records and produce calculations, alerts, or suggested next steps from available data. These outputs depend on the quality, completeness, timing, and definitions of the source records. Material business, financial, legal, tax, employment, or inventory decisions should be reviewed by an authorized person and, where appropriate, a qualified professional. Vanteloq AI explains a bounded evidence snapshot; it does not receive authority to post journals, send payments, change inventory, contact customers, or take another business action. The generated explanation can be inaccurate or incomplete and does not replace qualified accounting, tax, legal or investment advice. Vanteloq displays source dates and missing inputs, and an authorized person must review the explanation before relying on it. Document extraction can misread text, numbers, tax, dates, pages, suppliers, or other fields. Vanteloq keeps extracted values provisional until an authorized reviewer compares them with the original document. An extracted value is not an approved accounting entry, payment instruction, tax position, or professional conclusion. When configured, Scan and Read sends the selected file to Microsoft Azure Blob Storage and Defender for Storage for malware scanning, then Microsoft Azure Document Intelligence for extraction after a verified clean result. The action includes a specific processing notice, and Vanteloq records who authorized it and when. Processing uses the configured Azure regions. See the service provider notice (https://vanteloq.com/subprocessors) for purposes, temporary retention and recovery copies. This action does not send the document to OpenAI or change accounting balances. If a customer uses Vanteloq activity, access, scheduling, task, or operational records to monitor employees, the customer is responsible for a reasonable business purpose, appropriate notice, lawful authority, proportional access, retention limits, and any consent or employment requirement. Vanteloq must not be used for covert surveillance or an automated employment decision. 11. Business users and children Vanteloq is a business service for people authorized to act for an organization. It is not directed to children, and we do not knowingly collect personal information from children for their own use of the service. 12. Changes to this policy We may update this policy when the service, providers, or legal requirements change. We will post the revised policy with a new update date. If a change materially affects how personal information is used, we will provide additional notice or seek consent where required.