Privacy policy

This policy explains how Teyvor ("we", "us") handles personal information when you use Teyvor (the "Service") and this website. It applies worldwide; the sections on your rights list what applies in your region. Effective 2026-10-01.

Who is responsible

For your account, billing and website use, Teyvor (Québec (Québec), Canada) is the controller. For the project content you and your colleagues enter (tasks, budgets, RFIs, comments, documents), your organisation is the controller and we act as its processor under our Data Processing Addendum. Person in charge of the protection of personal information (Privacy Officer): info@teyvorpm.com.

What we collect

• Account details: name, work email address, password (stored only as a salted hash by our authentication provider), language and theme preferences, and the time you accepted our Terms.
• Organisation and project content you or your team enter: project data, schedules, budgets, commitments and actual costs, RFIs, risks, change requests, site diary entries, comments and uploaded documents.
• Team information: the email addresses and roles of people you invite or add.
• Billing information: plan, seats, currency, billing country and Stripe customer and subscription identifiers. Card details go directly to Stripe; we never see or store them.
• Activity records: an in-app activity log (who added a member, changed a role, created or archived a project), notifications, and offline-sync receipts.
• Technical data: IP address, browser type and request logs kept by our hosting and security providers to run and protect the Service.

We use no advertising trackers, we do not sell personal information, and we do not share it for cross-context behavioural advertising. On this public website only, and only if you accept, we use Microsoft Clarity to see how visitors use the pages (see the Cookie policy). It is never loaded inside the signed-in application.

Why we use it, and on what legal basis

Who we share it with

Only with service providers that process data on our instructions, listed on the Subprocessors table of our Data Processing Addendum: database, authentication and file storage; payments; transactional email; hosting. We may also disclose information when the law requires it, or to protect rights and safety. If we are involved in a merger or sale, information may transfer under the same protections.

International transfers

Our database is hosted in Canada, in Montréal (AWS ca-central-1), and some providers operate in other countries. When personal information leaves your country, we rely on the transfer mechanisms your law recognises, such as Standard Contractual Clauses or an adequacy framework, together with the security measures described on our Security page.

How long we keep it

• Account and project data: for as long as your account or organisation is active.
• After deletion: personal details are removed promptly; content created for an organisation stays with that organisation until it deletes it. Backups roll off on a fixed schedule.
• Billing and tax records: for the period accounting and tax law requires.
• Activity log: while the organisation exists.

Your rights

Depending on where you live you may have the right to access, correct, delete, export, restrict or object to the use of your information, to withdraw consent, and not to be discriminated against for exercising these rights. You can export your data and delete your account yourself in Settings › Security. For anything else, write to the privacy contact above; we answer within 30 days.

• European Economic Area, United Kingdom, Switzerland (GDPR): all rights above, plus the right to complain to your supervisory authority.
• Canada (PIPEDA) and Québec (Law 25): access, rectification, withdrawal of consent, portability, and information about automated decisions (we make none). You can complain to the Office of the Privacy Commissioner or the Commission d'accès à l'information du Québec.
• United States (CCPA/CPRA and other state laws): know, access, delete, correct, and opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of; we honour Global Privacy Control signals.
• Brazil (LGPD), Japan (APPI), Singapore (PDPA), South Korea (PIPA), India (DPDP Act), Australia (Privacy Act): access, correction, withdrawal of consent and complaint rights as your law provides.

Emails

We email you about your account (security, invitations, payments) and, during and after the trial, a few information messages (welcome, a check-in, the end of the trial). Each information message names us, gives our mailing address and has a link to unsubscribe that works without signing in; the change applies right away. Account messages are not optional while you have an account.

Security

We isolate each organisation's data at the database level, encrypt data in transit and at rest through our providers, offer two-step verification and keep an activity log. Details are on our Security page. No system is perfectly secure; if a breach affecting you occurs, we will notify you and the authorities as the law requires.

Children

The Service is for professionals and is not directed to anyone under 16. If you believe a child has given us information, contact us and we will delete it.

Cookies and similar technologies

We use only the storage needed to keep you signed in and remember your language, theme and consent choice. See the Cookie policy for the exact list.

Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect, and update the date above.