Privacy Policy
MB Conseil TI Inc. ("we") respects your privacy. This policy describes the personal data we collect as part of distributing the MB Tools VIA · Virtual Infrastructure Analyzer software ("VIA"), and, more importantly, what VIA itself does not collect.
The VIA software runs entirely on customer infrastructure. It connects read-only to a vCenter, analyses data locally, and produces a local report. No inventory, configuration, performance, or VM data is transmitted to us automatically, nor to any third party. The only exception is voluntary and at your initiative (see section 8). This policy covers the personal data we collect for purchase, licensing, and support (not the data of the environment you analyse).
1. Personal data we collect
When you purchase a license, we collect (via our payment processor, Paddle) your first name, last name, billing address, email, and payment information. When you create a client-portal account, we collect your email, used for magic-link sign-in; the portal also records your download activity (which version, when) for support and audit purposes. If you contact us for support, we collect the content of your message, your reply email, and any screenshot you choose to attach. A screenshot may contain details of your environment (VM names, IP addresses): it is stored securely with restricted access, used only for your support case, handled as a support record (section 4), reachable through a link that expires, and automatically deleted no later than 90 days after it is sent. Beyond what you choose to share voluntarily, no technical data from your VMware environment is collected by MB Conseil TI Inc.
2. Data VIA collects at the customer site
No data from your environment is transmitted to us automatically. VIA runs locally, reads vCenter metadata, produces local reports, and exits. The software does not communicate with any external server and makes no outbound calls. The license key is validated locally, offline, without transmitting anything to MB Conseil TI Inc. The only technical data that can reach us is what you choose to share yourself, voluntarily (see section 8).
3. Data usage
We use the personal data collected to: deliver the license key, validate purchase authenticity, provide technical support, respond to user requests, and comply with legal obligations (billing, taxes). We do not send marketing emails without explicit opt-in consent.
4. Data retention
Billing data is retained for seven (7) years per Québec and Canadian tax requirements. Support records are retained for two (2) years after the last interaction, then anonymised. Screenshots attached to a support request are automatically deleted no later than ninety (90) days after they are sent, independently of how long the textual support record is kept. Marketing email addresses (explicit opt-in only) are retained until consent is withdrawn; every email includes a one-click unsubscribe link that removes your address immediately. Discount-eligibility data (survey or mailing-list signup) is retained for at most twenty-four (24) months after the last interaction, then automatically deleted.
5. Third-party processors
We use the following sub-processors, each bound by data protection agreements: Paddle (payment processing, invoicing); Vercel (website and portal hosting, anonymized audience analytics, United States); Upstash (portal account data storage, Canada , Montréal, Québec region); Resend (transactional email, United States); Cloudflare, including R2 (DNS and website protection globally; file storage in North America). These processors receive only the minimum data required for their function. Several of them process or store information outside Québec, notably in the United States. Before such processing, we assess privacy factors and govern those providers through written agreements, as required by applicable law.
6. Your rights (applicable data protection laws)
You have the following rights, under applicable data protection laws: access to your personal data, correction of inaccurate data, deletion (right to be forgotten) subject to legal retention obligations, portability of data in a structured format, withdrawal of consent at any time, and objection to processing. To exercise these rights, write to privacy@mbtools.ca. We respond within a maximum of 30 days.
7. Breach notification
When a confidentiality incident involves personal information, we take reasonable measures to reduce the risk of harm and prevent similar incidents. If it presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and affected individuals as required by applicable law.
8. Voluntary sharing of a bundle (support or contribution)
As part of the beta program, you may choose to share a bundle generated from the appliance. This sharing is always at your initiative: nothing is sent without an explicit action on your part. Two bundles exist, by purpose. The Support bundle is for diagnosing a specific case you report; it is anonymized by default (host, VM, and cluster names plus IP addresses replaced with aliases, with no mapping table included) and contains no report, no raw data, and no de-anonymization key. You email it to support@mbtools.ca. If, for a support case where the anonymized version is not enough, you explicitly choose to include real identifiers, that information is handled under sections 4, 6, and 7: it is used only for that support case, stored securely with restricted access, never reused for any other purpose, and deleted no later than 30 days after the case is resolved. The Contribution bundle is only to improve the accuracy of the product's rules; it is always anonymized, with no option, and will be uploaded via the Feedback page of your client portal (being enabled during the beta). You may share nothing at all, with no impact on your use of VIA.
9. Beta program applications
When you submit a beta program application, we collect the form information (name, email, role, VMware situation, estate size, and your message content) and use it to assess the fit of your organization and environment, communicate with you, plan your beta participation if you are selected, and document our decision. Access is limited to the people and processors who need it for these purposes. Applications (accepted, declined, or incomplete) are retained for twelve (12) months after the decision, then destroyed, unless a legal retention obligation applies. Submitting an application triggers no marketing communication: that requires separate consent, through an optional checkbox.
10. Contact
Personal Information Protection Officer: MB Conseil TI Inc., Québec, Canada. For any question relating to this policy, your personal data, or to reach the officer: privacy@mbtools.ca.