Privacy Policy

1. Who we are

Solidlio is a professional services automation (PSA) and IT service management platform operated by Tridacom IT Solutions Inc. ("Tridacom", "Solidlio", "we", "us", or "our"), a corporation based in Edmonton, Alberta, Canada. This Privacy Policy explains how we handle personal information in connection with our websites, applications, and services (collectively, the "Services").

We can be reached at 10215 178 Street NW, Edmonton, Alberta, T5S 1M3, Canada, by phone at 888-858-4765, or by email at privacy@solidlio.com. Our Privacy Officer can be reached using the details in the “How to contact us” section below.

2. Scope and our role

This Policy applies to personal information we handle in two different roles:

• As a controller (or, under Canadian law, an organization determining the purposes of processing) for information about our account holders, website visitors, and prospects — for example, the details you provide when you sign up, subscribe, pay, or contact us.
• As a processor (or service provider) acting on behalf of our business customers when they use the Services to manage their own end users, clients, tickets, assets, and records. For that customer content, our customer is the controller and its own privacy notice governs; we process it only under our agreement with that customer.

If you are an end user of a business that uses Solidlio (for example, a client of a managed service provider), please direct privacy requests to that organization; we will support them in responding.

3. Information we collect

Information you provide

• Account and profile data: name, business name, email address, phone number, role, and password (stored only as a secure hash).
• Authentication data: multi-factor authentication (MFA) enrollment and verification data, and session information.
• Billing data: billing contact, address, tax identifiers, plan and subscription selections, and payment details. Card and bank (PAD) payment details are collected and processed by our payment processor, Stripe; we do not store full card numbers.
• Support and communications: messages, tickets, attachments, and other content you send to us or through the Services.

Information we collect automatically

• Usage and device data: log data, IP address, browser and device type, pages viewed, and feature interactions, used to operate, secure, and improve the Services.
• Cookies and similar technologies: see our Cookie Policy for details and choices.

Information from AI features

When you use AI-assisted features (such as ticket categorization, summarization, drafting, or knowledge search), the inputs you provide and the resulting outputs are processed to deliver the feature. AI processing is performed through our AI sub-processor. AI output may be inaccurate or incomplete and should not be relied on as professional advice.

Customer content

When our business customers use the Services, they submit content about their own users, clients, and operations. We process that content on their behalf as described in the “Scope and our role” section.

4. How we use information

• To provide, maintain, and secure the Services and to authenticate users.
• To process subscriptions, payments, taxes, and invoices.
• To provide customer support and respond to your requests.
• To operate AI-assisted features you choose to use.
• To monitor, prevent, and investigate fraud, abuse, and security incidents.
• To improve and develop the Services, including through aggregated or de-identified analytics.
• To send service, security, and administrative communications, and — where permitted — marketing communications you can opt out of.
• To comply with legal obligations and enforce our agreements.

5. Legal bases for processing (EEA/UK)

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract — to provide the Services you or your organization have requested.
• Legitimate interests — to secure, improve, and market our Services, balanced against your rights.
• Consent — where required, such as for certain cookies or marketing; you may withdraw consent at any time.
• Legal obligation — to comply with applicable laws, including tax and accounting requirements.

6. Data residency and regions

Solidlio hosts all customer data in Canada. Your account's data — including tickets, documents, attachments, invoices and audit records — is stored in Microsoft Azure's Canada Central region, and backups are retained within Canada. We do not currently operate a United States or European hosting region, and no account can be placed in one.

Some sub-processors we rely on to operate the Services process data outside Canada. Those transfers, and the safeguards applied to them, are described in "International data transfers" below and in our sub-processor list.

7. How we share information

We do not sell personal information. We share personal information only as follows:

• Service providers and sub-processors who process data on our behalf under contract (for example, hosting, payments, email delivery, and AI). See our list of sub-processors.
• With our business customers, where you are their end user, as described above.
• In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.
• To comply with law, respond to lawful requests, protect our rights, or protect the safety of any person.

8. Data retention

We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and support for multi-factor authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights — Canada (PIPEDA)

If you are in Canada, you have the right to access and request correction of your personal information, and to withdraw consent (subject to legal or contractual restrictions). To exercise these rights, contact our Privacy Officer using the details below.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (OPC), and residents of some provinces may contact their provincial privacy regulator.

11. Your rights — EEA and UK (GDPR)

If you are in the European Economic Area or the United Kingdom, you have the right to access, rectify, erase, restrict, and object to processing of your personal information, the right to data portability, and the right to withdraw consent where processing is based on consent.

You also have the right to lodge a complaint with your local supervisory authority. To exercise your rights, contact us using the details below. Where we act as a processor for a business customer, we will refer your request to that customer.

12. Your rights — California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access to and deletion of your personal information, to correct inaccurate personal information, and to be free from discrimination for exercising your rights.

We do not sell your personal information and do not share it for cross-context behavioural advertising as those terms are defined under California law.

13. International data transfers

Canada does not require private-sector personal information to stay in Canada. Under PIPEDA, sending personal information to a service provider for processing is a use rather than a disclosure, so it does not require separate consent — but it does not reduce our responsibility either. We remain accountable for personal information in a sub-processor's hands, and we are required to use contractual means to secure a comparable level of protection.

What the law does require is that we are open about it. Personal information processed outside Canada is subject to the laws of that country, and may be accessible to its courts, law enforcement and national security authorities. That is true of every provider named below and is not something a contract can override.

Countries and purposes

• Canada — all hosting: the database, cache, file storage and backups (Microsoft Azure, Canada Central).
• United States — AI-assisted features and semantic search (Anthropic, Voyage AI), outbound and inbound email (SendGrid), payment processing (Stripe), and distributor catalogue synchronisation (Ingram Micro, TD Synnex).
• European Union — address autocomplete (Geoapify).
• Customer-determined — any integration you connect yourself, such as Microsoft 365 or QuickBooks, processes where that provider operates for your tenant.

Alberta's Personal Information Protection Act requires an organisation using a service provider outside Canada to state which countries the information may be processed in and why. The list above is that statement. Questions about it go to privacy@solidlio.com.

If you are in the EEA or the UK, your personal information is transferred to Canada — which the European Commission recognises as providing adequate protection for data subject to PIPEDA — and onward to the providers above. Where an onward transfer leaves the EEA or the UK, we rely on Standard Contractual Clauses or the UK equivalent as incorporated into each provider's data processing agreement.

14. Children

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, please contact us so we can delete it.

15. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised Policy.

16. How to contact us

To exercise your rights or ask questions about this Policy, contact our Privacy Officer at Tridacom IT Solutions Inc., 10215 178 Street NW, Edmonton, Alberta, T5S 1M3, Canada, by phone at 888-858-4765, or by email at privacy@solidlio.com.