Privacy Policy
1. Who We Are
Vertessia, a sole proprietorship registered in British Columbia, Canada (“we”, “us”), based in Vancouver, British Columbia. We are the data controller for account and billing data. For files uploaded by business customers via our API, we act as a data processor on the customer’s behalf under a separate Data Processing Agreement (DPA).
2. Privacy Officer & Contacts
Privacy contact (the person responsible under PIPEDA): the owner of Vertessia, reachable at info@vertessia.com. EU/UK representative: not appointed — below the threshold that requires one.
3. Information We Collect
| Category (CCPA) | Examples | Source |
|---|---|---|
| Identifiers | Email, account ID, IP address | You; automatically |
| Commercial information | Purchases, credits, subscription status | You; Stripe |
| Internet/network activity | Log data: user agent, referrer, timestamps, pages | Automatically |
| User content | Uploaded files and file names, conversion metrics | You |
| Payment data | Processed by Stripe; we do not store full card numbers | Stripe |
4. How and Why We Use It (Purposes & Legal Basis)
| Purpose | GDPR legal basis |
|---|---|
| Providing conversions and your account | Performance of a contract — Art. 6(1)(b) |
| Billing and fraud prevention | Contract; legitimate interests — Art. 6(1)(f) |
| Security and abuse prevention | Legitimate interests — Art. 6(1)(f) |
| Legal and tax compliance | Legal obligation — Art. 6(1)(c) |
| Optional analytics / marketing email | Consent — Art. 6(1)(a) |
| Improving conversion quality from retained uploads | Legitimate interests — Art. 6(1)(f); you may opt out |
We do not carry out automated decision-making that produces legal or similarly significant effects on you.
5. File Handling & Retention
| Data | Retention |
|---|---|
| Input files (if you opt out of retention) | Deleted immediately after conversion (max 24 hours) |
| Retained uploads (default) | Kept to improve conversion quality until you ask us to delete them |
| Output files | Up to 24 hours anonymous; up to 7 days for signed-in paid users |
| Server logs | 180 days |
| Billing records | 6 years (Canada CRA requirement) |
| Account data | Until closure, then deleted within 35 days |
Retention of uploads to improve our service. By default we keep the files you upload and their conversion results to improve conversion quality and develop our algorithms. You can opt out on each upload using the checkbox in the converter, or ask us to delete your data at any time via info@vertessia.com. Failed conversions may be kept as diagnostic samples on the same basis. We do not sell this data and do not use it for any purpose other than improving the Service.
We do not keep backups of your uploaded files or outputs beyond the periods above.
6. Special-Category / Sensitive Data
We do not intentionally collect special-category data (GDPR Art. 9) or sensitive personal information (CPRA). Your uploaded files may contain such data; you are responsible for what you upload, and we mitigate risk through short retention and access controls.
7. Cookies
We use strictly necessary cookies only (for login sessions). Our usage analytics are first-party and do not use tracking cookies, so no consent banner is required.
8. Sharing & Third-Party Processors
We share personal data only with service providers acting on our instructions: Stripe (payments), Cloudflare R2 (file storage), and Resend (transactional email). Usage analytics are first-party, kept on our own servers. We do not sell or “share” (as defined by CCPA/CPRA) your personal information.
9. International Data Transfers
Your data may be processed in Canada, the United States, or other countries. Where required, we rely on Standard Contractual Clauses or an adequacy decision to protect transfers out of the EEA/UK.
10. Your Rights
EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your supervisory authority. California (CCPA/CPRA): know, access, delete, correct, limit use of sensitive information, opt out of sale/sharing (we do neither), and non-discrimination for exercising rights. Canada (PIPEDA / BC PIPA): access, correction, and the right to challenge our compliance. To exercise any right, contact info@vertessia.com; we may verify your identity and respond within legally required timeframes.
11. California Notice (CCPA/CPRA)
In the past 12 months we collected the categories in Section 3 for the purposes in Section 4, disclosing them only to the processors in Section 8. We did not sell or share personal information. You may submit requests yourself or through an authorized agent at info@vertessia.com.
12. Security
We protect data in transit with TLS, isolate conversion workloads in sandboxed containers, and restrict internal access. No system is perfectly secure and we cannot guarantee absolute security.
13. Children
The Service is not directed to children under 16. We do not knowingly collect their data and will delete it if discovered.
14. Complaints
Please contact our Privacy Officer first. You may also complain to the Office of the Privacy Commissioner of Canada, the BC Office of the Information and Privacy Commissioner, or — in the EEA/UK — your local data protection authority.
15. Changes & Contact
We will post updates here with a new date and provide notice of material changes. Contact: info@vertessia.com.