Last Updated: May 20, 2026
Language / Langue: This document is available in English. Une version française sera disponible prochainement.
Virtuallife Technologies Inc. ("we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Trackloop, our order management platform and related services.
We collect information that you voluntarily provide when you:
We use collected information for the following purposes:
Legal Basis for Processing (GDPR): We process your personal data based on: (a) Contractual necessity to provide our services, (b) Legitimate interests in operating and improving our platform, (c) Compliance with legal obligations, and (d) Your explicit consent where required.
You have the right to access, correct, delete, or export your personal data. To exercise these rights, contact us at privacy@trackloop.ca. We will respond within 30 days.
You can update your cookie preferences at any time.
We implement industry-standard security measures including encryption (TLS 1.3 in transit, AES-256 at rest), access controls, principle of least privilege for employee data access, and regular backups to protect your information.
Breach Notification: In the event of a security breach involving your personal information, we will notify you as soon as feasible after determining the breach creates a real risk of significant harm (in accordance with PIPEDA), and in any event within 72 hours where required by GDPR Article 33 or other applicable law. Where the breach affects only one tenant's data, notification is limited to that tenant.
We retain your personal information for as long as your account is active or as needed to provide services. After account deletion, we may retain certain data for legal compliance, dispute resolution, and fraud prevention for up to 7 years as required by applicable laws.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
Categories of Personal Information We Collect: Identifiers (name, email, account ID), commercial information (transactions, billing history), internet activity (log data, IP address, browser type), geolocation (approximate, from IP), and professional information (employer, role within tenant organization).
Sources: Directly from you, automatically from your device, and from service providers (Stripe for payment confirmation).
Purposes: To provide the Service, process transactions, send transactional and (where consented) commercial communications, prevent fraud, and comply with legal obligations.
We Do Not Sell or Share Personal Information. TrackLoop does not sell or share personal information as those terms are defined under the CCPA/CPRA. We do not engage in cross-context behavioral advertising. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.
Sensitive Personal Information: We process financial-account-related information through Stripe for payment processing. We do not store full payment card numbers. We do not use sensitive personal information for purposes other than those permitted under CCPA §1798.121.
Your Rights: You have the right to: (i) know what personal information we collect about you and how it is used; (ii) request deletion of your personal information; (iii) correct inaccurate personal information; (iv) opt out of the sale or sharing of personal information (we do not engage in either); (v) limit our use of sensitive personal information; (vi) non-discrimination for exercising your rights.
How to Exercise Your Rights: Email support@trackloop.ca with the subject line “CCPA Request”. We will verify your identity by matching your request to an account on file. We will respond within 45 days (with one 45-day extension where reasonably necessary).
Authorized Agents: You may designate an authorized agent to submit a request on your behalf. The agent must provide signed written permission, and we may require you to verify your identity directly.
Global Privacy Control (GPC): We honor the Global Privacy Control browser signal as an opt-out request. Because we do not sell or share personal information, the practical effect is that we will record your GPC preference and ensure no future sharing for cross-context behavioral advertising.
Retention by Category: Account identifiers — retained while account is active, then deleted 30 days after account deletion (subject to financial-record retention under CRA / IRS requirements). Log data — 90 days. Backups — 30 days rotation. Financial records — 7 years (tax compliance).
Shine the Light (Cal. Civ. Code §1798.83): California residents may request information about disclosures of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.
TrackLoop complies with Canada's Anti-Spam Legislation (CASL). When we send commercial electronic messages (including marketing emails, product updates, and feature announcements), we:
Transactional Messages: Account-related messages (receipts, password resets, order confirmations, security alerts) are necessary to operate the Service and are sent regardless of marketing preferences.
Unsubscribe: Every commercial email includes a one-click unsubscribe link in the footer. You may also email support@trackloop.ca with the subject line “Unsubscribe” at any time.
TrackLoop offers AI-powered features including business intelligence reports and AI-assisted document drafting. These features are powered by Anthropic (Claude). The data you submit to these features is processed by Anthropic under their data processing terms.
No Training on Your Data: Anthropic does not train its models on data submitted via API. Your tenant data is not used to train AI models.
Human Review: AI-generated outputs (such as document drafts or weekly business insights) are recommendations only. They do not constitute automated decision-making that produces legal or similarly significant effects under GDPR Article 22 or Quebec Law 25. All business decisions remain with you.
You may disable AI features at any time from your account settings. See our Sub-Processors page for details on Anthropic's role.
TrackLoop is a business tool intended for use by individuals 18 years of age or older. We do not knowingly collect personal information from children under 13 (or under 16 where the GDPR applies). If you believe we have collected information from a child, please contact our Privacy Officer immediately and we will delete it.
TrackLoop is operated from Canada and primarily offers its services to customers in Canada and the United States. We do not market to or actively offer our services to data subjects located in the European Union or the United Kingdom.
We have not appointed an Article 27 representative because we do not target the EU or UK markets. If you are located in the EU or UK, please understand that:
If TrackLoop later targets the EU or UK market, we will update this Privacy Policy to reflect appropriate GDPR/UK GDPR commitments and appoint a representative under Article 27.
For privacy-related questions or to exercise your data rights, contact our Privacy Officer:
Canadian users: If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.
This policy may be updated periodically. We will provide notice of material changes by email or in-app banner. Continued use of our service after changes constitutes acceptance of the updated policy.