Overview
This notice explains what personal information Vylan collects, why, where it lives, and the rights you and your clients have over it. It is written for Canadian accounting and bookkeeping firms and reflects Quebec's Law 25 (the Act respecting the protection of personal information in the private sector) and Canada's PIPEDA.
What we collect
- Account information: your firm's name, your name, and your email address.
- Client information your firm enters: each client's name, email, phone number, language, and any notes you add.
- Documents your clients upload: tax slips, statements, receipts, and any other files you request.
- Usage information: which pages were viewed, plus your IP address and browser type, kept for security.
Why we collect it
- To run the service: send the private-link portal, store and deliver documents to your firm, send automatic email reminders, and check uploads with AI.
- To bill firms on a paid plan.
- To keep the service secure and to improve it.
- To meet our legal obligations.
How AI is used
Two parts of Vylan use AI, each with a different provider. When a client uploads a document, it is sent to OpenAI to read and classify it — to check it is the right document, readable, and for the right year. Vylan's chat assistants — the in-app help assistant and the per-engagement assistant — run on Anthropic (Claude). Each provider processes this data only to answer that request, and we do not permit them to use it to train their models. Both are based in the United States; they appear in the subprocessor list below.
Quebec Law 25
We have a person responsible for the protection of personal information, reachable at the contact address below. New firms start with privacy settings at their most protective, and we will tell you before we use your information for any purpose beyond the ones described here.
Where your data lives
Your clients' documents and the information about them are stored in a Canadian region (Supabase, ca-central-1). Some services we rely on operate in the United States: email delivery, payment processing, and the AI providers above. Emails never contain document content — only a link back to the portal.
Who we share it with
We do not sell personal information, and we never will. We share it only with the subprocessors listed below, and only as far as each one needs to do its job.
Subprocessors
- Supabase — hosting, database, and file storage. Canada.
- OpenAI — reads and classifies uploaded documents. United States.
- Anthropic — powers the in-app chat assistants. United States.
- Resend — sends transactional and reminder emails. United States.
- Stripe — processes payments. United States and Canada.
How we protect it
Data is encrypted in storage and in transit. Access to a firm's data is enforced at the database level, so one firm can never reach another's. Document downloads use links that expire quickly. You can turn on two-factor login for your own account.
How long we keep it
We keep your data while your account is active. A deleted engagement stays recoverable for 30 days, then it and its files are permanently removed. You can export everything your firm holds at any time. If you close your firm's account, we delete its data within 24 hours of your request.
Your rights
- See the personal information we hold about you.
- Correct it if it is wrong.
- Delete it, or export it to take it elsewhere.
- Withdraw your consent to a use of it.
- Complain to Quebec's Commission d'accès à l'information or the Office of the Privacy Commissioner of Canada.
If something goes wrong
If a security incident affects your personal information, we will notify the affected firms and the appropriate authority, as the law requires.
Contact
Questions about this notice, or a request about your personal information, go to hello@vylan.app.