Who we are
ALYCO refers to Alyco Impex Inc., an IT asset disposition provider based in Toronto, Ontario, Canada. We can be reached at hello@alyco.ca.
What we collect
We collect only what we need to run pickups, produce certificates, and support you.
- Contact information — name, organisation, work email, phone, and city — when you submit a quote request or book a pickup.
- Pickup details — address, date, device counts, and any notes you add.
- Device metadata — serial numbers, models, grades, and disposition outcomes for the devices we receive. Serial numbers are hashed on certificates so a device is verifiable without exposing the underlying serial.
- Account information — email address and hashed password (or Google sign-in) if you create a client portal account.
- Server logs — IP address, user agent, and request timestamps kept for security and abuse prevention.
We do not run advertising trackers, session replay, or third-party analytics. We do not sell personal information — ever.
Why we collect it
- To respond to quote requests and coordinate pickups.
- To produce and deliver certificates of destruction and settlement statements.
- To give you an ongoing view of your pickups and certificates via the client portal.
- To meet our record-keeping obligations for IT asset disposition.
- To secure our services against abuse and fraud.
How long we keep it
- Pickup and certificate records — retained for seven (7) years to support your audit and compliance obligations.
- Account data — retained while your portal account is active. On request we delete it, keeping only the pickup and certificate records above.
- Server logs — retained for up to 90 days.
Who we share it with
Only the service providers we need to run ALYCO. Each is bound by confidentiality and used only for the purpose listed.
- Lovable Cloud — hosting, database, and file storage for the ALYCO site and client portal.
- Resend — outbound transactional email (quote confirmations, pickup notices, certificate delivery).
- Google — only if you choose to sign in with a Google account.
We may also share information when we are legally required to (for example, a court order), and we will tell you when we can.
Your rights
Under PIPEDA and applicable Canadian privacy law, you can ask us to access, correct, or delete the personal information we hold about you. Email hello@alyco.ca and we'll respond within 30 days. If you're not satisfied you may contact the Office of the Privacy Commissioner of Canada.
Security
Data in the client portal is protected by row-level access rules — you only see your own pickups and certificates. All traffic is encrypted in transit (HTTPS). Certificates are stored in a private bucket and shared only through short-lived signed URLs. Access to production systems is limited to authorised ALYCO staff.
Cookies
We use only the strictly necessary cookies required to keep you signed in to the client portal. No advertising, analytics, or tracking cookies.
Changes to this policy
If we update this policy we'll change the date at the top and, for material changes, notify active portal users by email.
Reach out to hello@alyco.ca. We respond within one business day.
THIS PAGE IS MAINTAINED BY ALYCO IMPEX INC. AND DESCRIBES OUR CURRENT PRACTICES. IT IS NOT LEGAL ADVICE.