This policy explains how BIM Tool Belt Inc., operating as VDC Stack ("VDC Stack", "we", "us"), collects, uses, discloses and protects personal information. It follows the fair information principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Quebec).
P1Scope & accountability
This policy applies to personal information we handle through VDCstack.io, our software (including sign-up, sign-in and checkout), our forms, early-access programs, and our services and communications. BIM Tool Belt Inc. is responsible for personal information under its control. The person in charge of the protection of personal information (our Privacy Officer) is Zak Loney, Co-Founder. Contact: [email protected], or by mail at PO Box 38, Ilderton, Ontario N0M 2A0.
Project content you upload to our tools ("Customer Data") belongs to you. We process it on your behalf under Section 12 of the Terms. If Customer Data contains personal information, your organization decides how it is used, and we act as its service provider.
P2Information we collect
- Information you give us. Your name, work email, company, role and message when you use our contact form, or book a demo. Account details such as login email, user profile, and the name and email address of the people you invite to your account or to a shared project, which we use to send the invitation and give them access. Billing contact and address details when you purchase.
- Sign-in and verification. If you sign in with Google or Microsoft, we receive your name, email address and an account identifier from that provider. If you turn on two-step verification by text message, we collect your mobile phone number.
- Ideas and feedback. Your name, email, role and what you submit through our contact form or in-product feedback.
- Payment information. Card payments are processed by our third-party payment processor. We do not receive or store full card numbers.
- Information collected automatically. IP address, browser and device type, pages visited, and log and usage data about how the Services are used, collected through server logs and cookies (see P8).
- Communications. Records of emails, support requests and meetings with us.
We only collect what we need for the purposes below.
P3How we use it
- To respond to enquiries and demo requests.
- To create and manage accounts, provide the Services and deliver support.
- To process payments, issue invoices and keep business records.
- To secure the Services and to detect and prevent fraud or misuse.
- To understand usage and improve the Services, using aggregated or de-identified data wherever possible.
- To send service and account notices.
- To send news, product updates and offers, only with your consent.
- To meet legal, tax and regulatory obligations.
We will ask for your consent before using personal information for any new purpose.
We do not make decisions about you based exclusively on automated processing. Some tools generate AI-assisted suggestions, such as BEP content or audit findings, which your team reviews and decides on.
P4Consent
We collect, use and disclose personal information with your consent, except where the law allows otherwise. Consent may be express, such as ticking a box to receive our newsletter. It may also be implied, for example by sending us an enquiry so that we can reply.
Under Canada's Anti-Spam Legislation (CASL), we send commercial emails only with your consent. You can withdraw consent at any time using the unsubscribe link in any marketing email, or by contacting us. Withdrawing consent for some uses, such as account management, may mean we can no longer provide certain Services.
P5Sharing & disclosure
We do not sell or rent personal information. We share it only:
- With service providers who help us run the business, such as hosting, payment processing, email delivery, analytics and customer support. They are bound by contract to protect the information and use it only to provide services to us.
- With professional advisers, such as lawyers and accountants, under confidentiality.
- Where required or permitted by law, such as in response to a valid legal order.
- As part of a merger, acquisition or sale of our business, subject to equivalent privacy protections.
- With your direction or consent, for example when you connect a third-party platform.
- With people you share a project with. Collaborators on a shared project can see the names and email addresses of the other people on it, and published content is visible to whoever it is shared with.
Our service providers include providers of hosting, payment processing, email delivery, text-message verification, sign-in (Google and Microsoft) and, only with your consent, analytics (Google Analytics). A current list of these providers and the countries where they process data is available from our Privacy Officer.
Storage and transfers outside Quebec and Canada. Some of our service providers store or process personal information outside Quebec and outside Canada, including in the United States. Information held in another country is subject to that country's laws and may be accessed by its courts, law enforcement and national security authorities. Before we transfer personal information outside Quebec, we assess whether it will receive adequate protection, and we protect it by contract.
P6Retention
We keep personal information only as long as needed for the purposes above, or as required by law. As a guide:
- Account information is kept while your account is active and for 12 months after.
- Enquiries from people who don't become customers are kept for 24 months.
- Billing records are kept for the period required by Canadian tax law, generally six years.
After that, we securely delete or anonymize the information.
P7Safeguards & breaches
We protect personal information with safeguards appropriate to its sensitivity. These include access controls, encryption in transit, secure hosting, and limiting access to staff and providers who need it. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada, and keep records as PIPEDA requires. For residents of Quebec, we keep a register of confidentiality incidents and notify the Commission d'accès à l'information du Québec and affected individuals of any incident that presents a risk of serious injury.
P8Cookies & analytics
We use essential cookies to keep you signed in and to secure the Services. Technologies that could identify, locate or profile you, such as analytics cookies, are turned off by default and are only activated if you select Accept analytics. You can change your choice at any time with the Cookie settings link at the bottom of every page. With your consent, we also use Google Analytics, a web analytics service provided by Google, to understand how our website is used. Google Analytics uses cookies to collect information such as pages visited, time on site, approximate location, and browser and device type. Google may process this information outside Canada, including in the United States. You can opt out at any time by declining analytics cookies or by installing the Google Analytics opt-out browser add-on. You can manage or block cookies in your browser settings, though some features may not work without essential cookies.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| vdc-consent | Remembers your cookie choice | Essential (stored in your browser) | Until you clear it |
| Sign-in session | Keeps you signed in to your account | Essential | Until you sign out or the session expires |
| _ga, _ga_* | Google Analytics: counts visits and how pages are used | Analytics (only with consent) | Up to 2 years |
P9Your rights
You may ask to access the personal information we hold about you, have it corrected, or have it deleted where we no longer need it, and you may withdraw consent. Send requests to [email protected]. We may need to verify your identity. We respond within 30 days, as PIPEDA requires.
If you are in Quebec, you also have the right to: receive computerized personal information you gave us in a structured, commonly used technological format, or have it sent to another organization; ask us to stop disseminating your personal information or to de-index any link to it where the law allows; and be told when we use technology that identifies, locates or profiles you.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada. Residents of Quebec may also complain to the Commission d'accès à l'information du Québec.
P10Children
Our Services are intended for business users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
P11Changes & contact
We may update this policy as our Services or legal requirements change. We will post the updated version here with a new version number and date, and email account holders about material changes. Questions or concerns? Contact our Privacy Officer, Zak Loney, at [email protected], or write to BIM Tool Belt Inc., operating as VDC Stack, PO Box 38, Ilderton, Ontario N0M 2A0.