Loading...
Privacy Policy
Version 1 — last updated 8/7/2026
This policy explains what personal information Viuni Inc. ("Viuni," "we," "us") collects through the Viuni website-as-a-service platform (the "Service"), why we collect it, and the choices and rights you have.
Viuni is headquartered in Canada, and personal information collected through the Service is stored in Canada. We are subject to the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and, in respect of Québec residents, the Act respecting the protection of personal information in the private sector ("Law 25"). Where we process personal information of individuals in the European Economic Area or United Kingdom, we also apply the standards of the General Data Protection Regulation ("GDPR") as described in this policy.
Viuni Inc. ("Viuni") is the operator of the Service and the organization responsible for the personal information described in this policy, within the meaning of PIPEDA and Law 25.
| Legal name | Viuni Inc. |
|---|---|
| Incorporation | Federal (Canada Business Corporations Act), registered in Quebec |
| Privacy contact | viuni.org@gmail.com |
Under PIPEDA and Law 25, Viuni has designated a Privacy Officer accountable for compliance with this policy and for responding to privacy inquiries and complaints. Contact details are in Section 17.
This policy applies to personal information collected through the Service, including the marketing website, user accounts, the subcontractor and initiative tools, testimonials, the contact form, and related communications. It applies regardless of where in the world you access the Service from.
It does not apply to information about our subcontractors and sponsors in their business capacity that is displayed publicly at their direction (see Section 3.4), or to third-party websites we link to (see Section 15).
We collect only what is reasonably necessary for the purposes described in Section 5. The table below reflects what the Service actually collects today.
| Data | Purpose |
|---|---|
| First and last name, username, email address | Create and identify your account |
| Password | Authenticate you. Stored only as a salted cryptographic hash — Viuni never has access to your plaintext password. |
| Language preference (English/French) | Serve the Service, and legal documents, in your preferred language |
| Country | Inferred automatically from your IP address at signup — not asked for directly. Used for tax-jurisdiction purposes and to apply legally required regional access restrictions. See Section 7. |
| Avatar image (optional) | Display on your profile |
If you use the platform as a subcontractor, we collect professional information you provide: years of experience, roles/skills, a written bio, and a LinkedIn profile URL. If you create or respond to an initiative (project), we collect the initiative's title, description, cost, payment type, and status, and a record of who has expressed interest.
If you submit the contact form, we collect your name, email address, and message, and associate it with your account. Newsletter subscribers' email addresses are collected and retained until unsubscribed, in accordance with Canada's Anti-Spam Legislation ("CASL").
Testimonials are personal information you or a customer voluntarily submits for public display at Viuni's discretion, attributed to a name, role, and company you provide. Sponsor listings are business contact and marketing information provided by the sponsoring organization for public display, not personal information about an individual.
We automatically log the information described in Section 8, including a session identifier stored in a cookie, and diagnostic information (IP address, request timestamps, and error details) retained in system logs for security and troubleshooting. Passwords, tokens, and similar secrets are automatically redacted from logs before they are written.
In accordance with PIPEDA's purpose-specification principle, we collect personal information only for these identified purposes:
We do not use your personal information for automated profiling that produces legal or similarly significant effects, other than the regional access check described in Section 7, and we do not sell your personal information.
We rely on your consent to collect, use, and disclose personal information for the purposes above. Consent may be express (for example, agreeing to this policy and our Terms of Service when you create an account, or opting in to the newsletter) or implied by the context of an interaction you initiate, such as submitting the contact form. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us as described in Section 17. Withdrawing consent for information necessary to operate your account may mean we can no longer provide the Service to you.
Where GDPR applies, we process personal information on these legal bases: performance of a contract (providing the Service you signed up for), consent (marketing communications, optional profile fields), legitimate interests (security, fraud prevention, service improvement, balanced against your rights), and compliance with legal obligations (tax obligations, and the Canadian/UN sanctions screening described in Section 7).
At signup, we infer your country from your IP address automatically. This is not shown to you as a field to fill in, and an unresolved or ambiguous lookup never blocks your signup on its own.
Separately, account creation may be automatically declined for a small number of countries subject to comprehensive economic sanctions or data-localization requirements Viuni is not presently able to comply with. This determination is reviewed and maintained deliberately, not tied to any single IP lookup result alone.
Under Law 25, you have the right to be informed of, and to obtain an explanation of, any decision based exclusively on automated processing that has a significant effect on you, and to have such a decision reviewed by a member of our staff. If your signup is declined on this basis, contact us using the details in Section 17.
The Service uses only what are commonly called strictly necessary cookies and comparable technologies — nothing used for advertising or cross-site tracking.
| Name | Purpose | Duration |
|---|---|---|
| token | Signed session credential that keeps you logged in. HTTP-only (inaccessible to page scripts) and, outside local development, sent only over HTTPS. | 24 hours |
| cf_turnstile / __cf* | Set by Cloudflare Turnstile, our bot-detection challenge shown on signup, to distinguish human visitors from automated abuse. | Session, per Cloudflare's policy |
Because these cookies are necessary for the Service to function, we do not present a cookie-consent banner for them; PIPEDA and Law 25 treat such strictly necessary use as within a user's reasonable expectations when they use the Service. If we introduce analytics or marketing cookies in the future, we will update this section and request consent where required.
We do not sell personal information. We share it only in these circumstances:
We use the following processors to operate the Service. Each is contractually bound to use your information only to provide their service to us and to protect it accordingly.
| Provider | Role | Data involved |
|---|---|---|
| MongoDB Atlas | Database hosting | All account and platform data — hosted in a Canadian region |
| DigitalOcean | API hosting (application compute) | All data processed by the Service in transit — hosted in a Canadian region (Toronto) |
| Vercel | Website hosting (user interface) | IP address and request metadata for anyone browsing the Service — processed per Vercel's own privacy policy |
| Resend | Transactional email delivery (verification, password reset, contact-form notifications, newsletters) | Name, email address, message content where applicable |
| Cloudflare (Turnstile) | Bot detection on signup | IP address, browser signals — processed per Cloudflare's own privacy policy |
| UploadThing | Avatar image hosting | Uploaded avatar image files |
| Sentry | Error tracking and monitoring | Stack traces and error diagnostics from the Service — configured to exclude user identity and HTTP request body content; hosted in Sentry's EU (Frankfurt) region |
We may disclose personal information if required by law, regulation, court order, or governmental request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Viuni, our users, or the public.
If Viuni is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to equivalent privacy protections and, where required by law, notice to you.
Content you choose to make public — a testimonial, a public initiative, or a subcontractor profile field — is shared as you direct it to be.
Our primary database and API infrastructure are hosted in Canada. Some service providers we rely on (see Section 9.1) operate infrastructure outside Canada as part of delivering their service to us — for example, Cloudflare's global network, Resend's infrastructure, Vercel's global network, and Sentry's EU (Frankfurt) region. Where personal information is processed outside Canada, including by a foreign-based service provider or an entity subject to foreign law such as the U.S. CLOUD Act, it may be accessible to courts, law enforcement, and national security authorities of that jurisdiction under its laws. We select providers with appropriate contractual and technical safeguards, and, for transfers from the EEA/UK, rely on the European Commission's Standard Contractual Clauses or an equivalent recognized mechanism where applicable.
We retain personal information only as long as necessary for the purposes it was collected for, plus any period required by law.
| Category | Retention |
|---|---|
| Account information | Retained, but invisible to other users, for 30 days after you request deletion; permanently deleted if you don't sign back in during that period (see Section 11.1) |
| Consent records (Agreement acceptances) | Retained for as long as your account exists, as evidence of PIPEDA-compliant consent |
| Contact-form messages | No automated deletion schedule is currently in place; retained indefinitely for now |
| System & security logs | Retained for 30 days from when they're written, then automatically deleted; access restricted per Section 12 |
| Error tracking (Sentry) | Retained for 30 days from when captured, then automatically deleted, per Sentry's data retention policy on our current plan |
| Financial/tax records | As required by Canadian tax law (generally six years) |
When you delete your account, it is not erased immediately. Your account, and anything tied to it that other users could see - such as an initiative you posted or your subcontractor listing - becomes invisible right away, but your data is retained, unchanged, for 30 days.
If you sign back in with your existing credentials during those 30 days, your account is automatically reactivated and full visibility is restored - there is no separate request needed to undo a deletion. If you do not sign back in within the 30-day period, your account and the personal information described in this policy are permanently deleted and cannot be recovered.
We may retain information beyond these periods where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.
We apply administrative, technical, and physical safeguards proportionate to the sensitivity of the information involved, including:
No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada, affected individuals, and, where applicable, Québec's Commission d'accès à l'information, without unreasonable delay, as required by PIPEDA and Law 25, and will keep an internal record of every breach — reportable or not — for at least 24 months.
Subject to limited exceptions, you have the right to: access the personal information we hold about you; request correction of inaccurate information; withdraw consent (see Section 6); and challenge our compliance with this policy by contacting our Privacy Officer (Section 17). You can access and update most account information directly from your profile settings.
You additionally have the right to: request that we cease disseminating your personal information or de-index a link to it, in specified circumstances; receive your personal information in a structured, commonly used technical format (data portability); and, as noted in Section 7, be informed of and obtain a human review of automated decisions with significant effects on you.
You additionally have the right to erasure ("right to be forgotten") subject to legal exceptions, restriction of processing, data portability, and objection to processing based on legitimate interests. You may lodge a complaint with your local supervisory authority.
Viuni does not sell or share personal information as defined under the CCPA/CPRA. You may request to know or delete personal information we hold about you by contacting us.
We will respond to a verified request within 30 days (or the shorter period required by applicable law), and may extend this once with notice for complex requests.
The Service is not directed at children, and we do not knowingly collect personal information from anyone under 18 — matching the eligibility requirement in our Terms of Service. If we learn we have collected such information without appropriate consent, we will delete it.
Sponsor listings, testimonials, and subcontractor profiles may link to third-party websites (e.g. a sponsor's site, a subcontractor's LinkedIn profile). We are not responsible for the privacy practices of sites we don't operate — review their policies independently.
We may update this policy as the Service evolves. Each published version is numbered and dated, and prior versions remain retrievable. Where a change is material, we will notify account holders (by email or in-product notice) and, where required by law, seek renewed consent before the change takes effect. Continued use of the Service after a non-material update constitutes acceptance of the revised policy.
Questions, requests, or complaints about this policy or our handling of your personal information can be directed to our Privacy Officer:
| viuni.org@gmail.com |
If you are not satisfied with our response, you may escalate to: