Aston Link — Privacy Policy

Version 2026-10-07.

Aston Link is a service of Aston ERP Solutions, Toronto, Ontario. This policy explains what personal information we handle and why, under Canada's PIPEDA.

1. What we handle and why

1. Your account. Your email address and name, the workspaces you belong to, your sign-in times and the language and display settings you choose. Used to sign you in and run your account.
2. Your business information. What you enter in the setup and the Business profile, your never-contact list, notes, drafts and emails. It belongs to you and is used only to provide the service to you.
3. Free trial requests. When you ask for a free trial: your business email address, company name, website, business address, phone number, province, industry, approximate number of staff, your role and how you heard about us, plus the IP address and a browser fingerprint (a technical summary of your browser) from your sign-up and your request. We use them to check that the request comes from a real business, to keep to one free trial per company, and to contact you about your request. They are seen only by the Aston Link team. We keep them while your account is open; for a refused request, up to 12 months after the decision, so the same trial isn't requested again.
4. Aston Link news (optional). Only if you tick the box: occasional news and tips by email. We record when you agreed (Canada's anti-spam law, CASL). You can unsubscribe from any of these emails, or ask us, at any time.
5. Companies we find for you. Business names, addresses, phone numbers, websites and published business email addresses from public sources such as Google Maps and company websites. We keep Google Maps content for at most 30 days. We honour unsubscribe requests, and we never sell this information.
6. Payments. Card payments, plans and saved cards are handled by Stripe; we never see or store card numbers. To show you which card is saved we keep only its brand, last 4 digits and expiry.

2. Your mailbox

When you connect a mailbox, Aston Link sends the emails you approve from it. It reads the inbox and sent folder only to find replies, bounces and unsubscribe requests that belong to conversations Aston Link started; other mail is ignored and never stored. We never delete, move or mark anything as read. Mailbox passwords and sign-in tokens (for "Sign in with Microsoft" or Google) are stored encrypted, are never shown again, and are deleted at once when you disconnect the mailbox. You can also remove Aston Link's access at Google or Microsoft at any time.

3. No AI training

We never use your data or your emails to train AI models, ours or anyone else's. Our AI provider (Anthropic) processes the text we send it only to give us an answer, under commercial terms that do not allow it to train its models on that text.

4. Service providers (sub-processors)

These companies process data for us, only to provide their part of the service:

• Oracle Cloud: our servers and database, in Toronto, Canada.
• Cloudflare: security and hosting of our website and the app's front door; global network.
• Google: map and business listing data (Google Maps Platform); United States.
• Anthropic: the AI that reads company websites and drafts emails; United States.
• Brevo: sign-in codes, invitations, receipts and notifications; France (European Union).
• Stripe: payments; United States and Canada.

Your own email provider (for example Google or Microsoft) handles the emails you send and receive, under your agreement with it. Some of these providers process data outside Canada, so it may be subject to the laws of those countries. We choose providers that protect it to a standard comparable to PIPEDA. We will update this list and tell customers before adding a new provider that handles their data.

Help pages on astonlink.ca may embed YouTube videos. They load only when you press play; from then on, YouTube's privacy policy applies.

Transactional emails (sign-in codes, invitations, receipts, notifications) are sent through Brevo and may include open and click tracking by Brevo (whether an email was opened and which link was clicked); we switch that tracking off where Brevo allows it, and use any such data only to check that our emails arrive.

Sales partners. A company may be referred to us by an independent sales partner (for example through the partner's link or code). If so, the sign-up is attributed to that partner, and the partner can see the company name, the sign-up date, the plan status and the amounts paid, for commission purposes only. Partners never see leads, drafts, emails, contacts or usage details.

5. Security

Access is protected by sign-in codes, encrypted connections and encryption of stored secrets. Mailbox passwords and sign-in tokens are encrypted. Backups are encrypted.

6. Deleting your account

You can delete your account at any time in the Aston Link app or on the website: My account › Delete account. We email you a one-time code to confirm it is you.

When you confirm, your account is deactivated at once: nobody can sign in to it, and you are signed out on every device. If you are the only person in a workspace, that workspace is deleted with your account. If others also use it and you are its only owner, you first make someone else an owner, or choose to delete the workspace for everyone. Any plan paid through our payment processor for a workspace that is deleted is cancelled at once; payments already made are not refunded (see our Terms).

Your account is permanently deleted 30 days later. Until then you can ask us to restore it by emailing support@astonlink.ca. We email you when the account is deactivated and again when it has been deleted.

After the 30 days we delete your personal data and the content of any workspace deleted with your account: your name, email address and sign-in records, the companies and contacts found for you, drafts, sent-email records, replies, visit routes and notes, connected mailboxes and their sign-in tokens, your settings and the devices signed in to the app.

7. How long we keep it

While your account is open, we keep your data so the service works. When it is deleted (section 6), we keep only:

• Invoices, payment and tax records, for 6 years, as Canadian tax law requires (for example the *Income Tax Act* and the *Excise Tax Act* for HST). They contain the amounts and dates of payments and the workspace they belong to; your name and email address are removed from them.
• Sales partner commission records: where a sales partner introduced your company, the records of commission paid on your payments are kept for the same period, because they are part of our accounting.
• A record that a deletion took place: the date and an internal number only, with no personal data.
• A one-way fingerprint of your email address (a salted cryptographic hash, which cannot be turned back into the address) for 12 months, used only to stop the same address from claiming new-customer offers again (free trials, welcome or friend codes). It is deleted automatically after 12 months.

Refused trial requests are kept up to 12 months after the decision.

Backups. We keep encrypted backups so the service can be recovered after a failure. Backups on our server are kept for 14 days, and copies stored off-site for up to 180 days. Deleted data may remain in these encrypted backups until they expire. It is not used for any other purpose, and it is not restored into the live service: if we ever have to restore a backup, accounts that were already deleted are deleted again before the service is back online.

8. Your rights and contact

You can ask to see, correct or delete your personal information, withdraw a consent, or ask questions about this policy. Write to our privacy officer at support@astonlink.ca. We answer within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).