Overview
This notice explains what personal information Vylan collects, why, where it lives, and the rights you and your clients have over it. It is written for Canadian accounting and bookkeeping firms and reflects Quebec's Law 25 (the Act respecting the protection of personal information in the private sector) and Canada's PIPEDA.
What we collect
- Account information: your firm's name, your name, your email address, and a profile photo if you add one. If you sign in with Google, Google shares your name and email address with us.
- Client information your firm enters or asks for: each client's name, email, phone number, language and notes, and — when your firm collects them — their mailing address, date of birth, business number and social insurance number. Social insurance numbers are stored encrypted.
- Documents and messages: the files your clients upload, signed engagement letters, and the messages you and your clients exchange in Vylan.
- Work and billing records: tasks, time entries, invoices and payments. Full card and bank account numbers are handled by the payment processor and never stored by us.
- Usage information: which pages were viewed, plus your IP address and browser type, kept for security.
Why we collect it
- To run the service: send the private-link portal, store and deliver documents to your firm, send automatic email and text-message reminders, collect signatures, and use AI to check uploads and draft text you ask for.
- To bill firms on a paid plan.
- To keep the service secure and to improve it.
- To meet our legal obligations.
How AI is used
Vylan uses AI from two providers, OpenAI and Anthropic (Claude). It reads and checks the documents your clients upload — that each one is the right document, readable, and for the right year. It powers the in-app assistants. And it drafts or translates text when you ask it to — for example a document checklist, a questionnaire, an automation, or a list of services read from a file you provide. Some tasks always use the same provider; others can go to either one, so that one provider being down does not stop your work. If your firm turns on automatic rejection, Vylan can ask a client to upload a document again when the AI finds it unusable, without a person reviewing it first. Each provider processes this data only to answer that request, and we do not permit them to use it to train their models. Both are based in the United States; they appear in the subprocessor list below.
Quebec Law 25
Vylan's co-founders are the people responsible for the protection of personal information. You can reach them at the contact address below. New firms start with privacy settings at their most protective, and we will tell you before we use your information for any purpose beyond the ones described here.
Where your data lives
Your clients' documents and the information about them are stored in a Canadian region (Supabase, ca-central-1), and the application runs on servers in Montreal (Vercel). Some services we rely on operate in the United States: email and text-message delivery, e-signatures, payment processing, error reports, and the AI providers above. Emails never carry the documents your clients upload — only a link back to the portal. The one exception is an invoice, which can be attached to the email that sends it.
Who we share it with
We do not sell personal information, and we never will. We share it only with the subprocessors listed below, only as far as each one needs to do its job, and with software your firm chooses to connect.
Subprocessors
- Supabase — database, file storage and sign-in. Canada.
- Vercel — runs the application, and counts page views without cookies. Servers in Montreal, Canada; company in the United States.
- OpenAI — AI: reads and checks uploaded documents, and drafts and translates text. United States.
- Anthropic — AI: powers the in-app assistants, and also reads documents and drafts text. United States.
- Resend — sends emails. United States.
- Twilio — sends text-message reminders. United States.
- SignWell — collects e-signatures on proposals and engagement letters. United States.
- Stripe — processes payments. United States and Canada.
- Sentry — receives error reports so we can fix problems. It never records your screen. United States.
- Upstash — briefly holds IP addresses and account IDs to block abuse. United States.
- Notion and Cal.com — hold the details people give us when they ask for a demo. United States.
Software your firm connects
If your firm connects other software — QuickBooks, Xero, Google (Calendar or Drive), Microsoft (OneDrive or SharePoint), Dropbox, ShareFile or PayPal — we send that service what the connection needs to work, at your firm's direction, and bring in what your firm asks us to import. Those companies are not our subprocessors: they handle that information under your firm's own agreement with them. Your firm decides which of them to connect.
How we protect it
Data is encrypted in storage and in transit. Access to a firm's data is enforced at the database level, so one firm can never reach another's. Document downloads use links that expire quickly. You can turn on two-factor login for your own account.
How long we keep it
We keep your data while your account is active. A deleted engagement stays recoverable for 30 days, then it and its files are permanently removed. You can export everything your firm holds at any time. If you close your firm's account, you can still export everything for 30 days, and then we permanently delete its data.
Your rights
- See the personal information we hold about you.
- Correct it if it is wrong.
- Delete it, or export it to take it elsewhere.
- Withdraw your consent to a use of it.
- Complain to Quebec's Commission d'accès à l'information or the Office of the Privacy Commissioner of Canada.
If something goes wrong
If a security incident affects your personal information, we will notify the affected firms and the appropriate authority, as the law requires.
Contact
Questions about this notice, or a request about your personal information, go to hello@vylan.app.