1. Who is responsible for your information
Vesk Group is not a separate legal entity: it is a brand operated by two companies of the Arbore Pruina group. Which one serves you depends on where you, or your business, are located.
| If you are in | Responsible organization | Address | Contact |
|---|---|---|---|
| Canada | APRed Software Corp. | Toronto, Ontario, Canada | contact@veskgroup.com |
| Mexico and the rest of Latin America | Arbore Pruina S.A. de C.V. | Mexico City, Mexico | contacto@veskgroup.com |
Both companies share one team, one set of systems and this policy, and may transfer information to each other to serve you (for example, when a Canadian client is served by our team in Mexico). In this policy, “Vesk”, “we”, “us” and “our” refer to the responsible organization in the table above.
Person in charge of the protection of personal information
We have designated a privacy officer for the whole group (in Quebec, the person in charge of the protection of personal information). You can write to them, in English or Spanish, at:
- English: contact@veskgroup.com
- Español: contacto@veskgroup.com
2. What this policy covers
This policy covers the personal information we process through:
- veskgroup.com, including its contact and waitlist forms and the token estimator.
- Call scheduling (Calendly) and the discovery call and kickoff meeting that follow.
- The Vesk client platform: the web console (console.veskgroup.com) and the Vesk mobile app.
- The membership relationship: proposals, acceptance, billing, support and communications by email, WhatsApp or video call.
It does not cover third-party sites and services we link to, nor the other companies of the Arbore Pruina group (OrbStudio, Uninova, arborepruina.com, apred.ca), which have their own policies.
If you use the platform on behalf of a client company, this policy applies to your information as a user; information about your company and its end customers that you upload to the platform is additionally governed by the membership agreement and our Terms and conditions.
3. What personal information we process
We process only identification, contact, professional, billing and technical information. We do not request or process sensitive personal information (health, ethnic origin, beliefs, sexual orientation, biometrics or similar); please do not include it in forms, messages or files.
a) Information you give us directly
- Call form: name, email address, company, phone or WhatsApp (optional), team size, whether you are the decision maker, the kind of situation you describe, your message and, if you used the estimator, the tasks and tokens you selected.
- Waitlist: email address and the department you are interested in.
- Scheduling: name, email, chosen time slot and any answers Calendly asks for when confirming.
- Calls and meetings: what you tell us about your business, processes, tools and goals.
- Email, WhatsApp and platform messages: the content you send us and any files you attach.
b) Business relationship and platform information
- Account: name, login email, profile photo (optional), language, the company you belong to and your role.
- Work on your projects: tasks, bug reports, chat messages, voice notes, files, approvals and the activity log tied to your account.
- Devices: push-notification identifiers (if you enable them in the app) and technical data about your device and browser.
c) Billing and payment information
- To invoice: legal or business name, business number or tax ID, billing address and the email address for invoices.
- To charge a card: payments are processed by Stripe. We receive only the last four digits, card brand, expiry date and payment status. We never store your full card number.
- To receive a bank transfer (Interac or SPEI): the transfer details shown on our bank statement.
d) Information generated automatically
- Visit source: the page you landed on, the referring site and campaign parameters (UTM), kept in your browser’s session storage and sent with your form so we know which channel works.
- Analytics: unless you switch it off, Google Analytics and Metricool record pages viewed, time on page, device, browser, language and approximate region. Advertising signals are always off. Details are in the Cookie policy.
- Technical logs: IP address, date, time and action, which our servers keep for security and troubleshooting.
e) Recordings and transcripts
We may record and transcribe the discovery call and the kickoff meeting to prepare your proposal accurately. We tell you at the start of each call, and you can ask us not to record. Recordings and transcripts are treated as confidential information.
f) Information about other people
If you share information about your company’s employees, suppliers or end customers (for example, so that we can build a system that manages them), you confirm that you have the legal authority to do so and that you have informed them. In that case we act as a service provider on your instructions, under the agreement.
4. Why we use your information
We distinguish between primary purposes, which are necessary for the relationship you request with us, and secondary purposes, which are not essential and which you can object to at any time without affecting the service.
| Purpose | Type | Information used |
|---|---|---|
| Reply to your message and schedule the call you requested | Primary | Form, scheduling |
| Assess whether Vesk is the right team for your business and prepare a membership proposal | Primary | Form, calls, recordings and transcripts |
| Deliver the service: execute tasks, provide support, run the platform and the app | Primary | Account, projects, messages, files |
| Invoice, collect payment and meet tax and accounting obligations | Primary | Billing and payment |
| Send service notifications (progress, meetings, invoices, changes to this policy) | Primary | Email, phone, devices |
| Keep the site and platform secure, prevent fraud and abuse | Primary | Technical logs, account |
| Comply with the law and respond to valid requests from authorities | Primary | Whatever the law requires |
| Tell you when a department you subscribed to opens | Primary (you asked for it) | Waitlist |
| Measure site usage to improve it | Secondary (you can object at any time) | Analytics |
| Send you news about Vesk, content and offers | Secondary | Name, email |
| Use your case publicly (case study, testimonial, logo) | Secondary (requires your specific written permission) | Name, company, results |
To object to secondary purposes, write to the contact address or use the unsubscribe link in every marketing email. Objecting does not affect your membership or the service.
Where Canadian law applies, we rely on your consent: implied consent for the primary purposes you would reasonably expect when you contact us or hold a membership, implied consent for aggregate site analytics, which you can switch off as the Cookie policy explains, and express consent for marketing communications and public case studies.
5. How we use artificial intelligence
Vesk uses artificial-intelligence tools to support a senior team, never to replace its judgment. In relation to your personal information, we use it to:
- Classify your request when you submit the form, to route it to the right department and prepare the call.
- Summarize the discovery call and the kickoff meeting from their transcripts.
- Draft your proposal and our follow-up emails, which a person at Vesk reviews and approves before anything is sent to you.
- Speed up execution of your project tasks (code, design, content), with human review.
The providers we use for this (currently Anthropic, TypeSafe and Granola) act as service providers under business terms that limit the use of your information to providing the service to us and prohibit them from using it to train their models. We do not use your personal information to make automated decisions with legal or similarly significant effects on you: the decision to work with you, the plan we propose and the price are set by our team from the public plan catalogue.
6. Who we share your information with
We do not sell or rent your personal information, and we do not share it with third parties for their advertising. We share it only with:
a) Group companies
APRed Software Corp. and Arbore Pruina S.A. de C.V. transfer information to each other so that one team can serve you, under this same policy.
b) Service providers that help us operate
They process your information only on our instructions, under contracts that require confidentiality and security measures and prevent them from using it for their own purposes.
| Provider | What we use it for | Where it processes data |
|---|---|---|
| Amazon Web Services (AWS) | Hosting of the site, the platform, the database, files and transactional email | United States (Ohio region) |
| Google (Analytics, Workspace) | Site analytics, unless you switch it off; business email and video calls | United States and other countries where Google operates |
| Metricool | Aggregate visit counts for the site, unless you switch it off | Spain (European Union) |
| Calendly | Call scheduling | United States |
| Granola | Call transcription and summaries, when we record | United States |
| Anthropic and TypeSafe | AI-assisted request classification and drafts | Outside Canada and Mexico |
| Stripe | Card payment processing | United States and other countries where Stripe operates |
| Meta (WhatsApp) | Messaging, only if you choose to contact us on WhatsApp | United States and other countries where Meta operates |
| Firebase (Google) | Mobile-app push notifications, if you enable them | United States |
c) Other recipients
- Professional advisers (accountants, lawyers, auditors) bound by confidentiality, where our operations require it.
- Authorities, where a law, order or valid request obliges us, or to protect our rights, our clients’ rights or people’s safety.
- A successor in the event of a merger, acquisition or reorganization of the group, under the same obligations as this policy.
d) Transfers outside your country
Our main infrastructure is in the United States and our team works from Canada and Mexico, so your information may be processed outside the country where you live. When we do this, we contractually require our providers to provide a level of protection equivalent to this policy. While outside Canada, information may be accessible to the authorities of the country where it is held under that country’s laws.
If you live in Quebec: the personal information we collect may be communicated to and stored outside Quebec (in the United States, Mexico and other Canadian provinces). Before doing so we carry out the privacy impact assessment required by the Act respecting the protection of personal information in the private sector (Law 25), taking into account the law of the destination.
7. Cookies and similar technologies
The site stores one strictly necessary first-party cookie (your language) and uses aggregate analytics tools (Google Analytics and Metricool) with no advertising features, which you can switch off with your browser’s “Global Privacy Control” or “Do Not Track” signal, an add-on or by writing to us. Before we use advertising or marketing cookies we will ask for your consent. Which cookies we use, how long they last and which ones we may use in the future are listed in the Cookie policy.
8. How long we keep your information
We keep information only for as long as it serves the purpose we collected it for, or as long as the law requires, and then securely delete or anonymize it.
| Information | Retention |
|---|---|
| Contact requests and waitlist sign-ups that do not become a membership | Up to 24 months from last contact |
| Call recordings and transcripts | Up to 12 months, or until you ask if you do not become a client |
| Client account and project data | For the duration of the membership and up to 12 months after, unless you ask us to delete it sooner or the law requires us to keep it |
| Invoices, payments and accounting records | The applicable statutory period: 6 years in Canada and 5 years in Mexico, counted as the law provides |
| Technical security logs | Up to 12 months |
| Analytics data | As configured in each tool (Google Analytics: 14 months); see the Cookie policy |
Information needed to establish, exercise or defend legal claims may be kept for the applicable limitation period.
9. How we protect your information
We apply reasonable administrative, technical and physical safeguards proportionate to the risk: encryption in transit (TLS) and at rest, role-based access control and least privilege, password authentication with two-step verification for our team, activity logging, backups, and confidentiality agreements with staff and providers. No system is infallible; if a security breach occurs that creates a real risk of significant harm to you, we will notify you and the relevant authorities without delay and as the law requires.
10. Your rights and how to exercise them
In Canada (PIPEDA and Quebec’s Law 25)
You have the right to access the personal information we hold about you, to have it corrected, to withdraw your consent (subject to the contractual consequences we will explain) and to file a complaint with the Office of the Privacy Commissioner of Canada. If you live in Quebec, you may also request portability of the information you provided to us, in a structured, commonly used technological format, and de-indexing or cessation of dissemination in the cases set out by law, and you may complain to the Commission d’accès à l’information du Québec.
In Mexico (LFPDPPP)
Under the Federal Law on the Protection of Personal Data Held by Private Parties you have the rights of access, rectification, cancellation and objection (ARCO rights), as well as the right to revoke your consent and to limit the use or disclosure of your information. The supervisory authority is the Secretaría Anticorrupción y Buen Gobierno, where you may file a complaint if you believe we have not handled your request properly.
How to make a request
- Email contact@veskgroup.com (or, in Spanish, contacto@veskgroup.com) with the subject line “Personal information”.
- Tell us your full name, how to reach you, which right you wish to exercise and, if possible, which information or service your request relates to.
- Attach a valid government ID or, if you act for someone else, the document that proves your authority. We use it only to verify identity.
We respond within the legal time limits: in Canada, within 30 days; in Mexico, within 20 business days, and if the request is granted, we act on it within the following 15 business days. Exercising these rights is free of charge; only justified shipping or reproduction costs permitted by law could apply.
If you have a platform account, you can also update your name, photo and language directly from your profile.
11. Minors
Our services are intended for businesses and adults. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with information, write to us and we will delete it.
12. Changes to this policy
We may update this policy when our services, providers or the law change. The current version is always on this page with its date. If a change is material and you have an active account or membership, we will notify you by email or within the platform at least 15 days in advance.
13. Contact
For any question about this policy or your personal information: contact@veskgroup.com (English) · contacto@veskgroup.com (Spanish). Handled by Vesk Group’s person in charge of the protection of personal information.