Privacy policy

Who this policy is about

VAD Workspace runs this website and the VAD Workspace software. This policy explains what personal information we collect, why, and the choices you have.

There are two roles. For our own website visitors and customers, we decide how information is used. For the data our customers put into their workspace (for example, their own clients’ details), our customer decides, and we process it on their behalf and only on their instructions.

What we collect

• Enquiry forms: your name, email, business name, and anything else you choose to give us, such as phone number, industry, team size, website, budget, timeline and your message.
• Accounts: your name, email address and password. Passwords are stored only as a one-way hash; we cannot read them.
• Workspace content: the clients, projects, documents, invoices, payments, tasks and messages you and your team add.
• Security and service records: a log of important actions in your workspace (for example, who changed an invoice), and short-lived records of sign-in and form attempts, kept to stop abuse. These attempt records store a scrambled (hashed) form of the email address and IP address, not the plain values.

Why we use it

• to answer your enquiry and arrange a consultation or demo
• to provide, secure and support the services you use
• to send service emails, such as sign-in links, password resets, portal invitations and notices about your account
• to bill you for work you have agreed to
• to meet legal and accounting obligations

What we do not do

We do not sell personal information. We do not use it for advertising, and we do not send marketing emails or newsletters without your consent.

Who processes data for us

We use a small number of service providers to run the service. They may only use the data to provide their service to us:

• website hosting (Vercel)
• database hosting (our managed PostgreSQL provider)
• document storage (our private, S3-compatible file storage provider)
• email delivery (Resend)
• card payments, if and when online payment is switched on (Stripe)

Where data is stored

Some of these providers store or process data outside Canada, including in the United States. When that happens, the data is subject to the laws of that country, and may be accessed by its courts or authorities under those laws.

How long we keep it

We keep information only as long as we need it for the purposes above. Enquiries that do not become customers are deleted on request, or after two years without contact. If a workspace is closed, its data is kept for 30 days so the business can request a copy, and is then deleted, except records we must keep for tax or legal reasons.

How we protect it

Connections are encrypted, passwords are hashed, each business’s data is kept separate from every other business’s, and documents are stored privately and only served to people with permission to see them.

Your rights

You can ask to see the personal information we hold about you, to correct it, or to have it deleted, and you can withdraw consent where we rely on it. Write to support@vadworkspace.com. We will reply within 30 days.

If your information is in a workspace run by one of our customers (for example, you are their client), please contact that business first; we will help them respond.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Changes to this policy

If we change this policy, we will post the new version here with a new effective date, and tell customers by email about material changes.