Privacy policy

Zantrey ("Zantrey", "we", "us" or "our"), the business name of 12565544 Canada Inc., makes Modulix, a modular ERP and CRM that businesses use as a hosted service ("Zantrey Cloud") or run on their own servers ("self-hosted"). This policy explains what personal data we collect when you visit zantrey.com, contact us, or hold an account with us, why we collect it, who we share it with, and the rights you have.

1. Who we are and how to reach us

Zantrey is responsible for the personal data described in this policy. For any question or request about your personal data, email privacy@zantrey.com, or write to Zantrey, Attention: Privacy, 7030 Woodbine Ave, Suite 500, Markham, Ontario L3R 6G2, Canada. We aim to reply within one month.

2. Our role: controller or processor

Data protection laws distinguish between the organization that decides why and how personal data is used (the "controller") and an organization that handles it on someone else's behalf (the "processor"). Our role depends on the situation:

• Website visitors, prospects and account holders. When you browse zantrey.com, fill in a form, talk to our sales or support teams, or hold an account with us (for example as the administrator or billing contact of a customer), Zantrey is the controller of your personal data. This policy applies.
• Data our customers store in Zantrey Cloud. The records a customer keeps in Modulix on Zantrey Cloud, such as its contacts, employees, customers and suppliers, belong to that customer. The customer is the controller and Zantrey processes that data only on its instructions, under our Data processing addendum. If your data is held in a customer's Modulix workspace, please contact that organization; we will pass on any request we receive about it.
• Self-hosted installations. When a customer runs Modulix on its own servers, the data stays on that customer's infrastructure. Zantrey does not receive, host or have access to it, and is neither its controller nor its processor. The customer's own privacy notice applies.

3. What we collect and why

We collect only what we need for the purposes below. Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the legal basis shown for each purpose.

Information you give us through forms and email

When you request a demo, ask for a quote, contact sales or support, or subscribe to updates, we collect your name, work email address, company, job title, phone number if you give it, and your message. Our forms ask for a work email address because our services are for businesses.

• Why: to answer you, arrange demos, prepare quotes and follow up on your enquiry.
• Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries.

Marketing communications

If you choose to receive news about Modulix, we use your name and email address to send it, and record whether messages are opened and links clicked so that we can improve them.

• Why: to keep you informed about products, features and events.
• Legal basis: your consent where the law requires it (for example in the EU, the UK and under Canada's anti-spam law), otherwise our legitimate interest in telling business contacts about relevant products. You can unsubscribe at any time using the link in every message or by emailing privacy@zantrey.com.

Account and customer information

For Zantrey Cloud and self-hosted customers we keep the names, work email addresses and roles of the people who manage the account, contract and order details, billing contacts and invoices, support conversations, and records of licences and subscriptions. For Zantrey Cloud users we also keep sign-in details (passwords are stored only in hashed form) and logs of sign-ins and administrative actions.

• Why: to provide the services, manage accounts and licences, invoice and collect fees, provide support, keep the services secure, and tell you about changes to the services.
• Legal basis: performance of our contract with the customer, our legitimate interest in running and securing our services, and compliance with legal obligations such as tax and accounting rules.

Website usage and technical data

When you visit zantrey.com, our servers record technical information such as your IP address, browser type, the pages requested and the time of the request. When a form is shown, a security check run by Cloudflare Turnstile assesses whether the visitor is a person or an automated program. If we enable analytics through Google Tag Manager, it collects information about how the site is used, such as pages visited, the referring site and your approximate location derived from your IP address. Our Cookie policy describes exactly what is set on your device.

• Why: to deliver the site, protect it and its forms from abuse, fix problems, and understand which content is useful.
• Legal basis: our legitimate interest in operating a secure and useful website; your consent for analytics cookies where the law requires it.

Job applications

If you apply for a role with us, we use the information you send, such as your CV and contact details, to assess your application.

• Why: to recruit.
• Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in hiring.

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing of your personal data.

4. Who we share data with

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Service providers

We use service providers to run our business. They may use personal data only to provide their services to us, under contracts that require them to protect it. By category:

• Hosting and infrastructure: the providers that host zantrey.com and Zantrey Cloud and store backups.
• Customer relationship management and marketing forms: HubSpot, which receives and stores the information you submit through our website forms, and from which we send marketing emails.
• Bot protection: Cloudflare, whose Turnstile service checks that form submissions come from people.
• Analytics: none today. If we add analytics (for example Google Analytics through Google Tag Manager), we will update this policy and our Cookie policy first.
• Content management: Sanity, which stores the text and images of this website. It does not receive the information you submit in forms.
• Email delivery: providers that deliver our transactional and service emails.
• Business tools: providers of accounting, invoicing, support ticketing and communication tools.

Others

• Professional advisers such as lawyers, accountants and auditors, under a duty of confidentiality.
• Authorities, when the law requires it, or where necessary to establish, exercise or defend legal claims or to protect the rights, property or safety of Zantrey, our customers or others.
• A buyer or successor, if Zantrey is involved in a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.

5. International transfers

Zantrey and our service providers may process personal data in countries other than the one in which you live, which may have different data protection rules. When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision or put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. For transfers from Canada, we use contractual and other measures to provide a comparable level of protection. You can ask for more information about these safeguards at privacy@zantrey.com.

6. How long we keep data

We keep personal data only for as long as we need it for the purposes above, and then delete or anonymize it:

• Enquiries, demo requests and sales contacts: 24 months after our last contact with you.
• Marketing preferences: until you unsubscribe. We then keep your email address on a suppression list so that we do not contact you again.
• Account data: for the life of the account, and then for up to 60 days after the subscription ends (30 days for the customer to export its data, then up to 30 days to delete it), as set out in our Terms of service.
• Contracts, invoices and payment records: for as long as tax and accounting laws require, typically six to ten years depending on the country.
• Support conversations: 36 months after the request is closed.
• Web server logs: 30 days.
• Security logs for our own systems: up to 12 months.
• Analytics data: no longer than 14 months.
• Job applications: 12 months after the recruitment decision, unless you agree to a longer period.
• Backups: data deleted from live systems remains in encrypted backups until they are rotated out, which happens within 35 days.

We may keep data longer where the law requires it or where it is needed to resolve a dispute.

7. How we protect data

We use technical and organizational measures appropriate to the risk, including encryption of data in transit, access to production systems limited to authorized personnel, role-based access control, logging of administrative actions, regular backups, and prompt application of security updates. The measures that apply to Zantrey Cloud are described in our Data processing addendum. No system is completely secure, so please tell us at privacy@zantrey.com if you believe your data has been put at risk.

8. Your rights

Depending on where you live, you may have the right to:

• ask whether we hold personal data about you and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our use of your data, including objecting at any time to its use for direct marketing;
• receive the data you gave us in a structured, machine-readable format and have it sent to another organization;
• withdraw your consent at any time, where we rely on consent, without affecting the use made before you withdrew it;
• complain to a data protection authority, such as the authority in your EU country, the UK Information Commissioner's Office or the Office of the Privacy Commissioner of Canada.

California residents have the right to know what personal information we collect, use and disclose, to request its deletion or correction, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information for purposes that would give rise to a right to limit its use.

To exercise any of these rights, email privacy@zantrey.com. We may need to confirm your identity before acting on a request, and you may use an authorized agent where the law allows it. We respond within the time limits set by the applicable law, usually one month. Requests about data held in a customer's Modulix workspace are best sent to that customer, as explained in section 2.

9. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact privacy@zantrey.com and we will delete it.

10. Changes to this policy

We may update this policy to reflect changes in our services or the law. We will publish the updated version on this page with a new effective date and, if the changes are significant, tell account holders by email or in the product before they take effect.

11. Effective date

This policy is effective as of October 19, 2026.