On this page
Legal
Privacy Policy
How we collect, use and protect your personal information.
Last updated: 27 September 2026
1. Who we are
UnicyVinci is a growth platform offered as software-as-a-service to real estate agencies, brokers, and their teams. It is operated by Unicy, in Montreal, Quebec, Canada ("Unicy", "we"). For this policy: admin@unicyvinci.com.
This policy follows Quebec's Act respecting the protection of personal information in the private sector, as modernized by Law 25, and Canada's PIPEDA.
2. Scope
It covers unicyvinci.com and the UnicyVinci application, people who create an account, visitors of pages published with the platform, and people whose information our clients enter. Agency websites have their own policy. This page is the platform policy.
3. Privacy officer
Unicy has designated an officer for this policy and for your requests: Unicy, Montreal, admin@unicyvinci.com.
4. Our role: controller or processor
We are the controller of information tied to our contract with you: account, credentials, billing, technical data of the public site, and third-party accounts you connect to UnicyVinci.
We are the processor of information our clients enter about their own contacts, inquiries, and customers. The client remains the controller. A processing agreement is available on request at admin@unicyvinci.com.
5. Information we collect
Account: name, email, phone, agency, role, credentials.
Billing: plan and history. Payments go through Stripe. We do not store card numbers.
Content our clients enter: records, pages, contacts, inquiries, campaigns.
Use: IP address, device, browser, pages viewed, logs, cookies.
Accounts you connect: only what the section "Third-party accounts you connect" describes.
6. Why and on what basis
We use this information to provide the platform, manage the account and subscription, process payments, communicate, keep the service secure, improve it, and meet legal duties. The basis is the contract, consent, our legitimate interests, or a legal duty. You may withdraw a consent, subject to the law.
Third-party accounts you connect
You choose to connect an account. You can revoke access in UnicyVinci and at the provider. We request only what the feature you turn on needs. If you later connect another calendar or account, the same rule applies: access limited to that feature, revocation at any time, no sale.
Google Calendar and Google account
- Data accessed
- When you connect Google Calendar, we receive the Google account email and name, and the busy or free windows (start and end) of the primary calendar. We do not read event titles, descriptions, locations, or attendees.
- How we use it
- Busy or free windows block availability. Writing is limited to appointments confirmed in UnicyVinci: we create, update, or cancel that event on your calendar. We keep only the identifier of the event UnicyVinci created, so we can change or cancel it. We never change any other event.
- Sharing
- This data is not sold. It is not used for advertising. It is not transferred to a third party, except to subprocessors that host or secure the platform, or if the law requires it.
- Storage and protection
- Access tokens are encrypted at rest and in transit. Busy or free windows are queried when availability is calculated and are not kept. From Google Calendar we store only the identifier of the event UnicyVinci created.
- Retention and deletion
- Tokens stay while the connection is active. Disconnecting deletes them. You can also remove UnicyVinci in your Google Account: https://myaccount.google.com/permissions. To delete your UnicyVinci data, see Data deletion.
- AI processing
- Google Calendar data and Google tokens are not sent to an artificial intelligence model. They are not used to train a model, ours or a third party's.
Google API Services — Limited Use Disclosure. UnicyVinci's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We do not use Google user data for advertising, profiling, or retargeting.
- We do not sell Google user data, and we do not transfer it to third parties except to provide or improve user-facing features, for security, or to comply with the law.
- No human reads Google user data unless you give explicit consent, for security, for a legal duty, or in aggregated and anonymized form.
- Google user data is not used to train artificial intelligence or machine-learning models, ours or a third party's.
Google Business Profile
- Data accessed
- If a broker connects a Business Profile, we access the profile they select and the email of the Google account used for that connection.
- How we use it
- To show and update that profile from the workspace, only for the actions they request.
- Sharing
- No sale, no advertising, no transfer beyond subprocessors needed to operate the service.
- Storage and protection
- Tokens encrypted at rest and in transit. Access limited to the connected account.
- Retention and deletion
- Until disconnection, then the tokens are deleted. You can also revoke access in the Google Account. Account deletion: Data deletion.
- AI processing
- This data is not sent to a model and is not used for training.
Meta (Facebook Page)
This connection exists in the product. It runs only if you choose to connect a Page.
- Data accessed
- The list of Pages you manage, information about the Page you select, the engagement data needed to publish, and the public profile and email of the account used to connect.
- How we use it
- To publish or update the content you ask us to publish on that Page, and to show the connection status.
- Sharing
- No resale. No advertising use of Page data beyond the publish action you request. We follow the Meta Platform Terms.
- Storage and protection
- Page tokens protected at rest and in transit. Access limited to the account that connected the Page.
- Retention and deletion
- While the Page stays connected. You can revoke access in Meta and request deletion through Data deletion.
- AI processing
- Page data and Meta tokens are not sent to a model and are not used for training.
Calendly
A broker may connect Calendly for booking. The connection stays off until it is enabled for that account.
- Data accessed
- The Calendly account identity, event types, availability, and the scheduled events needed to display and book.
- How we use it
- To show open times and to create or update an appointment the broker or their client requests.
- Sharing
- No sale. No advertising. Transfer limited to subprocessors that run this booking.
- Storage and protection
- Encrypted tokens. Appointments shown in UnicyVinci are those the file needs.
- Retention and deletion
- Until disconnection, then the tokens are deleted. You can also remove access in Calendly. Broader deletion: Data deletion.
- AI processing
- Calendly data is not sent to a model and is not used for training.
7. Sharing and providers
We do not sell your information. Sharing is limited to providers that operate the platform.
| Provider | Role | Location |
|---|---|---|
| DigitalOcean | Platform hosting | Canada |
| Stripe | Payments and subscriptions | United States / Ireland |
| Calendar, Business Profile, maps, form protection (reCAPTCHA) | United States | |
| Meta | Page connection, and advertising measurement only after consent | United States |
| Calendly | Booking, if the broker connects an account | United States |
| OpenAI | Vinci assistant | United States |
| Mailtrap | Transactional email | May be outside Quebec |
| Mapbox | Map display | United States |
| Centris | Listing data | Canada |
This list changes if a provider changes. No keys or technical identifiers are published here.
8. Transfers outside Quebec
Some providers process data outside Quebec, including in the United States. Before a transfer, and under Law 25, we weigh sensitivity, purpose, safeguards, and the legal framework. By using the platform, you are informed that information may be processed outside Quebec and Canada.
9. Retention and deletion
| Category | Period |
|---|---|
| Account | While the account is open, then according to a deletion request |
| Billing | Seven years, for Quebec tax duties |
| Connected-account tokens | While the connection is active, deleted on disconnect |
| Security logs | As long as needed for security and incident handling |
| Audience measurement | According to the tool and your consent. See the cookie policy |
| Inquiries a client enters | While that client's workspace exists, or until the client deletes them |
The deletion procedure is on Data deletion. It is not repeated here. Some records stay if the law requires it.
10. Security
Encryption in transit, tokens encrypted at rest, hosting isolated per client, access controls, and logs. No system is flawless. If an incident presents a risk of serious harm, we notify affected people and the Commission d'accès à l'information du Québec.
11. Cookies
Detail and your choices are in the cookie policy. Cookies required to run the service do not wait for consent. Measurement and advertising wait for your choice.
Analytics, advertising, and session tools
These tools load only after your choice in the banner. Two families: audience measurement, and marketing. Nothing in those families is sent before that choice, except what is strictly required to run the service.
Depending on what is enabled for the site: Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Microsoft Clarity, Hotjar, and equivalent tags. They may receive page views, a device or cookie identifier, and an IP address. Clarity and Hotjar may record a session. Sensitive form fields are not meant for those recordings.
Purposes: measure use, protect the service, understand friction, and, only with marketing consent, measure a campaign.
Data obtained through a connected account (Google Calendar, a Meta Page, Calendly) is never sent to these tools.
Detail and how to withdraw consent: cookie policy. Provider policies: Google, Meta, LinkedIn, TikTok, Microsoft, Hotjar.
Vinci assistant and artificial intelligence
The Vinci assistant uses OpenAI. We send the text of the request and the file context needed to answer. We do not send tokens, Google Calendar event contents, or Meta Page data.
UnicyVinci does not use your data to train its own models. Connected-account data is not used to train a third-party model.
This policy does not claim that the model provider stores nothing. That period depends on its contract, not on a switch shown in the product.
12. Your rights
Under Law 25 and PIPEDA, you may access your information, have it corrected, request deletion, withdraw a consent, request portability, and file a complaint.
Visitors outside Quebec may also have similar rights, including under the GDPR or the CCPA, depending on where they are. Write to us and we will handle the request under the law that applies.
To use a right: admin@unicyvinci.com. We generally reply within 30 days and may ask you to confirm your identity. If a client entered your information, contact that client first.
You may also contact the Commission d'accès à l'information du Québec.
13. Minors
The platform is for professionals. It is not directed at anyone under 18.
14. Changes
We may change this policy. The date at the top of the page is the last update. A material change is announced by email or in the application.
Last updated: September 27, 2026.
15. Contact
Unicy, Montreal, Quebec, Canada — admin@unicyvinci.com.
Note. This page applies to the UnicyVinci platform (unicyvinci.com). Agencies and brokers may have their own policy on their site. If you are on an agency site, read the policy shown there.