How VeloTech handles the personal information it controls.
VeloTech Systems Inc. ("VeloTech", "we", "us") respects your privacy. This policy explains how we handle personal information that VeloTech itself controls — information about visitors to our websites, prospective customers, and the account, administrative, and billing contacts at our customer organizations.
Important scope note. This policy does not cover the data your organization puts into a VeloTech product — your CRM records, your ledger, your employee data, your work orders, your support tickets. For that data your organization is the responsible party and VeloTech acts only as your service provider. Our handling of it is governed by the VeloTech Data Processing Agreement, not by this policy.
If you are an individual whose information appears in a VeloTech customer's account — for example, you are a contact in someone's CRM — that organization, not VeloTech, is who you should contact about your information. See section 9.
VeloTech Systems Inc. is a Canadian-incorporated software company. We provide a suite of business applications — including VeloCRM, VeloLedger, VeloPulse, VeloJobs, VeloSupport, and VeloExpense — delivered as software as a service.
Our Privacy Officer, designated under s. 3.1 of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), is John Rim, Founder & Privacy Officer — john@velotechsys.ai.
This is the information VeloTech controls:
We do not collect the contents of your product data for our own purposes.
To provide, secure, and operate the products; authenticate users; bill you; provide support; send service, security, and legal notices; meet our legal obligations; understand how our products are used so we can improve them; and, where permitted, tell you about our products.
We do not sell personal information.
We process this information to perform our contract with you, to pursue legitimate business interests such as securing and improving our products, and to comply with law. Where consent is required — for example, for non-essential marketing communications — we obtain it, and you may withdraw it at any time.
Some of our products include AI features powered by models operated by Anthropic, PBC. The sub-processor list shows which. Two things follow, and we state them plainly because customers ask:
We may use aggregated, de-identified operational metrics — counts of actions, volumes of usage — to operate, secure, bill for, and improve our products. Those metrics do not identify you.
We host data in Amazon Web Services' Canada (Central) — ca-central-1 region.
We send service emails, such as notifications from our products, through Amazon Simple Email Service (SES) in the same ca-central-1 region. Once an email is delivered, it is held by the recipient's own email provider, which may store it outside Quebec or Canada.
Some of our service providers process information outside Canada. Where any processing would occur outside Quebec or Canada, we assess it in line with s. 17 of Quebec’s private-sector privacy Act before proceeding and apply appropriate protections.
We share this information only with service providers that help us operate — cloud hosting, AI processing, payment processing, email delivery, and content delivery and security — each bound by a written agreement to protect it and use it only for the services they provide to us.
Our current list of service providers is published in the Legal Centre: Sub-processors.
We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a corporate transaction such as a merger or sale of assets — in which case we will require the recipient to honour this policy.
We keep account, billing, and communications data for as long as your account is active, and afterwards for as long as required for legal, tax, and audit purposes, after which it is deleted or anonymized. Website and telemetry data, such as server and application logs, is kept for 90 days.
Subject to law, you may request access, correction, deletion, or portability of the personal information VeloTech holds about you, may ask us to stop disseminating your information or to de-index any hyperlink attached to your name that gives access to it, where the law provides for this, and may withdraw consent to non-essential communications. Where a decision about you is made by automated processing alone, you may ask for information about it and request human review.
To exercise a right, or to lodge a complaint, contact our Privacy Officer at john@velotechsys.ai. We respond within the time limits set by applicable law.
If your information is in a customer's account rather than ours — for instance, you are a contact in an organization's CRM, or an employee in an organization's HR system — that organization controls it and is who you need to contact. If you approach us, we will tell you that and, where we can identify them, forward your request to them rather than acting on it ourselves.
You may also complain to your provincial or federal privacy regulator, including the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information (CAI).
Roles. Our Privacy Officer is responsible for this policy and approves our practices for protecting personal information throughout its life cycle: collection, use, communication, retention, and destruction. Everyone at VeloTech who can access personal information may do so only as their work requires and is bound by a duty of confidentiality. confirm every person with access (employees and contractors) has signed a confidentiality obligation
Life cycle. We collect only what we need for the purposes in section 3, keep it for the periods in section 8, and then destroy or anonymize it. Before a new system or service provider handles personal information, or before information is communicated outside Quebec, we assess the privacy impact.
Confidentiality incidents. If personal information we control is accessed, used, disclosed, or lost without authorization, we take steps to reduce the risk of injury, assess whether there is a risk of serious injury, notify the Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada, and the people affected where the law requires, and record every incident in our incident register.
Complaints. Send a complaint about how we handle personal information to our Privacy Officer at john@velotechsys.ai or to the mailing address in section 15. We acknowledge it within 5 business days, investigate, and reply in writing within 30 days, explaining what we found and any steps we are taking. If you are not satisfied, you may complain to a privacy regulator as described in section 9.
Our website does not use cookies. We set no cookies on velotechsys.ai, and we use no analytics, advertising, or behavioural tracking of any kind. There is nothing to consent to and no preference to manage.
Our website loads a typeface from Google Fonts. Your browser therefore makes a request to Google's servers, and Google receives your IP address for that request. No cookie is set and we receive no information from it.
Inside our products, we use only what is strictly necessary to run the service: a secure, HTTP-only session cookie to keep you signed in, and browser storage for interface preferences such as your last-used view. These are not used for tracking or advertising, and the products carry no analytics or advertising trackers.
We protect this information with encryption in transit and at rest, access controls, least-privilege principles, audit logging, and vulnerability scanning as part of our release process. Product-specific security measures are described in the Data Processing Agreement annex for each product.
Our products are business applications and are not directed to individuals under 16. We do not knowingly collect personal information from them.
An organization using our products may enter information about its own staff, which can include employees under 16. That information is the organization's, and our handling of it is governed by the Data Processing Agreement, as described in the scope note above.
We may update this policy. We will post the new effective date and, for material changes, notify account contacts. Superseded versions remain available in the Legal Centre.
VeloTech Systems Inc. — Privacy Officer — john@velotechsys.ai
General and support inquiries — support@velotechsys.ai
Mailing address — 91 Elmers Lane, King City, ON L7B 0P5, Canada