Privacy Policy

What we collect

• Contact form. Your name or company, email address, service interest, message, optional budget range, and basic campaign context (UTM parameters and the referring page). This is stored in our database so we can respond to you.
• Portal accounts. For clients: name, email address, and the records connected to the engagement — projects, milestones, deliverables, messages, support tickets, files you upload, and billing records.
• Billing information. Invoices, payment status, dates, amounts, and a payment reference returned by our payment processor. We never see or store card numbers — see Payments below.
• Site assistant. Messages you send to our website chatbot are processed by OpenAI, acting as a subprocessor, to generate replies. If you share your email in the chat to be contacted, we save the conversation with your inquiry. Please do not share sensitive personal information in the chat.

How we use it

We use personal information to respond to inquiries, deliver contracted services and operate client portals, issue and collect invoices, and send transactional email — replies to your messages, and account, project, or billing notifications.

We do not sell personal information, and we do not use it for third-party advertising.

Payments

Card payments are processed by Stripe. When you pay an invoice online, your card details are entered on and transmitted directly to Stripe’s systems — they never touch our servers. Stripe’s handling of your payment data is governed by Stripe’s privacy policy.

What we keep is the business record: the invoice, its amount and status, the payment date, and Stripe’s payment reference — the information required to account for the transaction and show it in your billing history.

AI-assisted operations

We use AI tooling, under human supervision, to help our team work — drafting replies, summarizing project information, and analyzing documents you share with us. In doing so, relevant content (for example an inquiry, a support ticket, or a project document) may be processed by OpenAI or Anthropic acting as subprocessors via their business APIs, which do not use the data to train their public models.

Anything AI-drafted that is sent to you is reviewed and approved by a person first.

Cookies & storage

On our public marketing pages we use Google Analytics to understand how visitors use the site (pages viewed, general region — IP addresses are anonymized) — and only if you accept the consent banner; choosing “Essential only” means no analytics loads at all. We do not use advertising cookies or cross-site tracking, and analytics is never loaded inside the business or admin portals. You can change your choice any time via Cookie Preferences in the footer; you can also opt out globally at tools.google.com/dlpage/gaoptout.

For abuse protection, our forms and app services use Google reCAPTCHA Enterprise (Firebase App Check) as strictly necessary security processing — it runs regardless of the analytics choice and is governed by Google's privacy policy.

Portal users receive functional storage only — an authentication session and a theme preference — which is required for the portal to work.

Service providers & international transfers

We rely on a small set of service providers to run VstreamX, each limited to its purpose:

• Google Cloud / Firebase — hosting, database, file storage, and authentication.
• Stripe — payment processing (see Payments).
• OpenAI and Anthropic — supervised AI assistance (see AI-assisted operations).
• Google Analytics — consented marketing-site analytics only.
• Google Workspace — business email.

Some of these providers process data on servers outside Canada, primarily in the United States. While in another jurisdiction, information is subject to that jurisdiction’s laws. We choose providers with strong, contractually committed security and privacy practices.

Retention

We keep personal information while it remains relevant to the business relationship, and then delete or anonymize it. Two specifics:

• Financial records — invoices, receipts, and payment records are retained for at least six years as required by Canadian tax law.
• Everything else — you can request deletion at any time (see Your rights); we honour it except where a legal obligation requires keeping a record.

Your rights

You may request access to, correction of, export of, or deletion of your personal information by emailing admin@vstreamx.com. We will respond promptly. If you are in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

Security

Data is encrypted in transit with TLS and at rest on Google Cloud infrastructure. Access to client data is role-based and enforced by server-side security rules; app requests are attested with Firebase App Check; and payment credentials are held by Stripe, not by us. If a breach ever creates a real risk of significant harm to you, we will notify you and the relevant authorities as PIPEDA requires.

Updates to this policy

We may update this policy from time to time. The effective date above always reflects the current version, and material changes will be posted on this page.