Privacy Policy

1. Data controller

Veerlyn Inc., a company established in Quebec (Canada), is responsible for the processing of personal information collected through the Service.

For any question relating to data protection or to exercise your rights, you may contact us at: support@veerlyn.com.

2. Information we collect

We collect the following categories of information:

• Account identification data: first name, last name, email address, password (hashed), role (admin, manager, employee), access PIN.

• Organisation data: company name, address, city, province, country, postal code, currency used.

• Business data entered by the user: information about buildings, units, leases, tenants (name, email, phone, payment status), suppliers, payments, uploaded documents, communications, expenses.

• Billing data: processed by our provider Paddle (Merchant of Record); we do not directly store card numbers.

• Technical data: IP address, browser type, access logs, session identifiers, audit data (who did what and when).

3. Purposes and legal bases

We process your personal information for the following purposes:

• To provide, maintain and improve the Service (performance of the contract).

• To manage your subscription and billing (performance of the contract / legal obligation).

• To ensure the security of the Service, prevent fraud and abuse (legitimate interest).

• To send you transactional emails (confirmation, reminders, Service changes) (performance of the contract).

• To send you marketing communications — only if you have expressly consented, with the possibility of unsubscribing at any time (consent).

• To respond to your support requests (legitimate interest).

4. Sharing with third parties

We do not sell your personal information. We share it only with:

• Our technical service providers, strictly necessary for the operation of the Service: Supabase (hosting and database), Paddle (payments and billing), transactional email providers.

• Public authorities, where the law so requires (judicial subpoena, legally binding request).

Each of these third parties is contractually required to respect the confidentiality and security of the information entrusted to them.

5. International transfers

Some of our service providers may process data outside of Canada (notably in the United States or the European Union). Where this is the case, we ensure that appropriate contractual safeguards are in place, in accordance with applicable personal-information-protection laws.

6. Data retention

We retain your personal information for as long as your account is active, and for the duration necessary for the purposes described above.

When your account is closed, your data is retained for a transitional period (by default 30 days) during which you may recover it or request its restoration, and is then permanently deleted from our active systems, subject to any legal retention obligations (for example, accounting or tax).

7. Security

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, disclosure, alteration or destruction: encryption in transit (HTTPS), role-based access controls, audit logs, password hashing, regular backups.

Despite these measures, no electronic transmission or storage is completely secure. In the event of a security incident affecting your personal information, we will notify you in accordance with applicable legal requirements.

8. Your rights

In accordance with Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights:

• Right of access to your personal information.

• Right of rectification of inaccurate or incomplete information.

• Right to withdraw consent (in particular for marketing communications).

• Right to data portability in a structured and commonly used technological format.

• Right to erasure ("right to be forgotten"), subject to legal retention obligations.

• Right to lodge a complaint with the Commission d'accès à l'information du Québec (CAI) or with the Office of the Privacy Commissioner of Canada.

To exercise these rights, contact us at support@veerlyn.com. We will respond within the applicable legal timeframes (generally 30 days).

9. Cookies and similar technologies

Veerlyn uses cookies that are strictly necessary for the operation of the Service: maintaining your session, remembering your language, security.

We do not use advertising cookies or third-party trackers for behavioural marketing purposes. You can configure your browser to block cookies, but this may affect the proper functioning of the Service.

10. Information concerning minors

The Service is not intended for minors under 14 years of age. We do not knowingly collect personal information concerning minors under 14. If you believe such information has been transmitted to us in error, please contact us so that we may delete it.

11. Responsibilities of managers

When you use Veerlyn to manage buildings and tenants, you enter into the Service personal information concerning third parties (your tenants, suppliers, employees). In this context, you act as the controller of that data, and Veerlyn acts as the processor.

You undertake to comply with applicable personal-information-protection laws (in particular Law 25 and PIPEDA), to inform the persons concerned and, where applicable, to obtain their consent before entering their data into the Service.

12. Changes to this policy

We may update this policy to reflect changes to the Service or legal requirements. Any material change will be notified to you by email or through the Service at least thirty (30) days before it comes into effect. The date of the last update is indicated at the top of this page.

13. Contact

For any question relating to this Privacy Policy, or to exercise your rights, contact us at: support@veerlyn.com.