Privacy Policy
This policy explains what personal information VantageHSG (“we”, “us”) collects through our website at vantagehsg.com and our application at ca.vantagehsg.com, why we collect it, where it is stored and processed, and the choices you have. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Québec, the Act respecting the protection of personal information in the private sector as amended by Law 25.
1. Who we are
VantageHSG provides carbon-accounting and compliance software for Ontario manufacturers: Scope 1, 2 and 3 emissions, OBPS and EPS compliance, CBAM, Bill C-59 environmental-claim substantiation and audit-ready reports. Our mailing address is 108-1580 Ernest Ave, London, ON N6E 2T9, Canada.
Our marketing website (vantagehsg.com) is a static site. Our application (ca.vantagehsg.com) is hosted in Canada. This policy covers both.
2. Information we collect
When you contact us
Our contact forms ask for your name, work email, company or facility, your role, the kind of help you need and a message. On some pages the company, role and message are optional. If you arrive from one of our comparison pages, the form also records which page. We store the enquiry in our database and email it to our team so we can reply. If you email us directly, we receive whatever you include in the email.
When you sign in to the application
You sign in with Microsoft (Microsoft Entra ID, or email sign-in through Microsoft Entra External ID). Microsoft sends us your name, work email address and the identifiers of your Microsoft account and your organization’s directory (tenant). We never see your Microsoft password. We also record which workspace you belong to and your role in it.
Data your organization uploads
Customers upload documents and data such as utility bills, fuel receipts, invoices, lab assays and supplier data, and may invite their suppliers to submit data. These can contain the names or contact details of individuals, such as a person named on an invoice or a supplier contact. We process this information on behalf of the customer organization that uploaded it, and only to provide the service to that organization.
Usage and security logs
When you use the application, our servers record technical information such as your IP address, browser user agent and request logs. The application also keeps an audit log of actions taken in each workspace (who did what, and when) so customers can show auditors how their figures were produced.
Billing
For paid plans we collect billing contact details (name, email and company). Payments are processed by Airwallex; card details are entered with Airwallex rather than stored by us.
What we do not collect
Neither site uses analytics, advertising or tracking cookies, pixels or similar tools. We do not sell personal information.
3. How we use it
- To reply to your enquiry. Contact-form details are not added to newsletters or mailing lists.
- To provide the application: signing you in, processing uploaded documents, calculating emissions and producing reports.
- To send service email such as notifications and workspace invitations.
- To keep the service secure: detecting abuse, limiting request rates and investigating incidents.
- To bill for subscriptions.
- To meet our legal obligations.
We also send business email to people at manufacturers and related businesses who may be interested in VantageHSG. These messages follow Canada’s Anti-Spam Legislation (CASL): they identify us and include a way to unsubscribe, which we honour.
4. Consent
We collect, use and disclose personal information with your consent, which may be express (for example, when you submit a form or sign in) or implied where the law allows. You can withdraw consent at any time by contacting our Privacy Officer, subject to legal or contractual limits. If you withdraw consent, we may not be able to provide some services; we will tell you what the consequences are.
5. AI processing
The application uses Google Cloud Vertex AI to read uploaded documents (for example, extracting quantities and dates from a fuel receipt) and to power the in-app assistant. This processing runs in Google Cloud’s Montréal region (northamerica-northeast1). Your documents and prompts are not used to train AI models. AI extraction can be wrong, so extracted values must be reviewed before anyone relies on them.
6. Where your information is stored and processed
Customer documents and the application database are stored in Canada, and AI processing happens in Canada. Sign-in, email and payments use providers that may process data outside Canada. When information is processed outside Canada it is subject to the laws of that jurisdiction, and authorities there may be able to access it. We use the following service providers:
| Service provider | Purpose | Location |
|---|---|---|
| OVHcloud | Application hosting, database, uploaded documents, backups | Beauharnois, Québec; backups in Toronto, Ontario |
| Google Cloud (Vertex AI) | AI extraction of uploaded documents and the in-app assistant | Montréal, Québec (northamerica-northeast1); not used to train models |
| Microsoft (Entra ID) | Sign-in | Microsoft cloud (may be outside Canada) |
| Cloudflare | DNS, marketing website delivery, security | Global network |
| Resend | Transactional email (notifications, invitations) | United States |
| Google Workspace | Our email (contact-form enquiries, support) | Google cloud (may be outside Canada) |
| Airwallex | Payment processing | Airwallex (may be outside Canada) |
| Smartlead | Outbound business email to prospects | Outside Canada |
Each provider receives only the information it needs for its purpose. We remain responsible for personal information we transfer to them.
7. Cookies
The marketing website does not set its own cookies. Cloudflare, which delivers the website, may set strictly necessary security cookies. The application uses only the strictly necessary cookies below. None of them track you across sites, and they are not used for analytics or advertising.
| Cookie | Purpose | Duration |
|---|---|---|
__Host-vantage_session | Keeps you signed in. It holds a random token only; your session is stored on our server, and only a hash of the token is kept there. | 7 days, or until you sign out |
__Host-vantage_oidc | Remembers the state of a sign-in in progress so the response from Microsoft can be checked. | 10 minutes; cleared when sign-in completes |
__Host-vantage_consent | Remembers the state of an administrator granting consent for your organization's Microsoft directory, so the response can be checked. | 10 minutes; cleared when consent completes |
If we ever add analytics or advertising tools, we will ask for your opt-in consent before setting any non-essential cookie.
8. How long we keep it
| Information | How long |
|---|---|
| Account information and customer content | For as long as the account is active and as required for audit and legal obligations. |
| Audit log of actions in the application | Append-only and hash-chained so it can serve as evidence. Entries are kept for 7 years, then deleted automatically. |
| Sign-in sessions | Expire after 7 days. Expired sessions are deleted daily. |
| Rate-limit counters (keyed by IP address or user) | Deleted after 1 day. |
| Database backups | Encrypted. Continuous backups allow recovery to any point in roughly the last 4 weeks. Nightly database copies are kept for 3 days on the server and 30 days off-site in Toronto, then deleted. |
| Off-site copy of uploaded documents | Synchronised every few minutes to off-site storage in Toronto. Deleting a document in the application does not remove it from this copy; we remove it when we delete your organization's data. |
| Contact-form enquiries and email | For as long as needed to answer the enquiry and for any business relationship that follows. You can ask us to delete them at any time. |
| Usage and security logs | For as long as needed to operate and secure the service and as required for audit and legal obligations. |
9. How we protect it
- All traffic to our sites is encrypted in transit (HTTPS).
- Each customer’s data is isolated at the database level, so one organization cannot read another’s data.
- Session tokens are stored only as hashes, and sign-in tokens from Microsoft never reach your browser.
- Database backups are encrypted.
- Administrative access to our servers is restricted to a private network.
No system is perfectly secure. If a breach of security creates a real risk of significant harm, we will notify affected individuals and the regulators as the law requires.
10. Your rights
You can ask us to:
- give you access to the personal information we hold about you;
- correct information that is inaccurate or incomplete;
- withdraw your consent to our use of your information.
Send your request to our Privacy Officer. We may need to confirm your identity. We will respond within 30 days. If your information is part of data a customer organization uploaded, we may refer your request to that organization and help it respond.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada. Québec residents can also complain to the Commission d’accès à l’information du Québec.
11. Changes to this policy
We will update this page when our practices change and change the “last updated” date. If a change is significant, we will also tell customers by email or in the application before it takes effect.
12. Contact our Privacy Officer
Questions, requests and complaints about privacy go to our Privacy Officer:
Privacy Officer, VantageHSGprivacy@vantagehsg.ca
108-1580 Ernest Ave, London, ON N6E 2T9, Canada
See also our Terms of Service.