1. Who we are
Solidlio is a professional services automation (PSA) and IT service management platform operated by Tridacom IT Solutions Inc. ("Tridacom", "Solidlio", "we", "us", or "our"), a corporation based in Edmonton, Alberta, Canada. This Privacy Policy explains how we handle personal information in connection with our websites, applications, and services (collectively, the "Services").
We can be reached at 10215 178 Street NW, Edmonton, Alberta, T5S 1M3, Canada, by phone at 888-858-4765, or by email at privacy@solidlio.com. Our Privacy Officer can be reached using the details in the “How to contact us” section below.
2. Scope and our role
This Policy applies to personal information we handle in two different roles:
- As a controller (or, under Canadian law, an organization determining the purposes of processing) for information about our account holders, website visitors, and prospects — for example, the details you provide when you sign up, subscribe, pay, or contact us.
- As a processor (or service provider) acting on behalf of our business customers when they use the Services to manage their own end users, clients, tickets, assets, and records. For that customer content, our customer is the controller and its own privacy notice governs; we process it only under our agreement with that customer.
If you are an end user of a business that uses Solidlio (for example, a client of a managed service provider), please direct privacy requests to that organization; we will support them in responding.
3. Information we collect
Information you provide
- Account and profile data: name, business name, email address, phone number, role, and password (stored only as a secure hash).
- Authentication data: multi-factor authentication (MFA) enrollment and verification data, and session information.
- Billing data: billing contact, address, tax identifiers, plan and subscription selections, and payment details. Card and bank (PAD) payment details are collected and processed by our payment processor, Stripe; we do not store full card numbers.
- Support and communications: messages, tickets, attachments, and other content you send to us or through the Services.
Information we collect automatically
- Usage and device data: log data, IP address, browser and device type, pages viewed, and feature interactions, used to operate, secure, and improve the Services.
- Cookies and similar technologies: see our Cookie Policy for details and choices.
Information from AI features
When you use AI-assisted features (such as ticket categorization, summarization, drafting, or knowledge search), the inputs you provide and the resulting outputs are processed to deliver the feature. AI processing is performed through our AI sub-processor. AI output may be inaccurate or incomplete and should not be relied on as professional advice.
Customer content
When our business customers use the Services, they submit content about their own users, clients, and operations. We process that content on their behalf as described in the “Scope and our role” section.
4. How we use information
- To provide, maintain, and secure the Services and to authenticate users.
- To process subscriptions, payments, taxes, and invoices.
- To provide customer support and respond to your requests.
- To operate AI-assisted features you choose to use.
- To monitor, prevent, and investigate fraud, abuse, and security incidents.
- To improve and develop the Services, including through aggregated or de-identified analytics.
- To send service, security, and administrative communications, and — where permitted — marketing communications you can opt out of.
- To comply with legal obligations and enforce our agreements.
5. Legal bases for processing (EEA/UK)
Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:
- Performance of a contract — to provide the Services you or your organization have requested.
- Legitimate interests — to secure, improve, and market our Services, balanced against your rights.
- Consent — where required, such as for certain cookies or marketing; you may withdraw consent at any time.
- Legal obligation — to comply with applicable laws, including tax and accounting requirements.
6. Data residency and regions
Solidlio hosts all customer data in Canada. Your account's data — including tickets, documents, attachments, invoices and audit records — is stored in Microsoft Azure's Canada Central region, and backups are retained within Canada. We do not currently operate a United States or European hosting region, and no account can be placed in one.
Some sub-processors we rely on to operate the Services process data outside Canada. Those transfers, and the safeguards applied to them, are described in "International data transfers" below and in our sub-processor list.
[Attorney review] Corrected 2026-07-27: this section previously offered a choice of Canada, United States or Europe. Only one deployment exists, in Azure Canada Central, and the region field on an account moved no stored data. The hosting and backup geography here have since been verified against the deployed infrastructure. What remains for counsel is the cross-border position in section 13, not this paragraph. No regional claim may be added here before the corresponding deployment exists.
8. Data retention
We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it.
[Attorney review] Specify concrete retention periods per data category (e.g., account data, billing records, logs, backups, AI inputs/outputs, support content) and the deletion timeline after account closure.
9. Security
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and support for multi-factor authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your rights — Canada (PIPEDA)
If you are in Canada, you have the right to access and request correction of your personal information, and to withdraw consent (subject to legal or contractual restrictions). To exercise these rights, contact our Privacy Officer using the details below.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (OPC), and residents of some provinces may contact their provincial privacy regulator.
11. Your rights — EEA and UK (GDPR)
If you are in the European Economic Area or the United Kingdom, you have the right to access, rectify, erase, restrict, and object to processing of your personal information, the right to data portability, and the right to withdraw consent where processing is based on consent.
You also have the right to lodge a complaint with your local supervisory authority. To exercise your rights, contact us using the details below. Where we act as a processor for a business customer, we will refer your request to that customer.
12. Your rights — California (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access to and deletion of your personal information, to correct inaccurate personal information, and to be free from discrimination for exercising your rights.
We do not sell your personal information and do not share it for cross-context behavioural advertising as those terms are defined under California law.
[Attorney review] Confirm the “no sale / no sharing” statement is accurate given all analytics and advertising technologies in use, and add the required “Do Not Sell or Share My Personal Information” link and authorized-agent process if any such activity exists.
13. International data transfers
Canada does not require private-sector personal information to stay in Canada. Under PIPEDA, sending personal information to a service provider for processing is a <em>use</em> rather than a disclosure, so it does not require separate consent — but it does not reduce our responsibility either. We remain accountable for personal information in a sub-processor's hands, and we are required to use contractual means to secure a comparable level of protection.
What the law does require is that we are open about it. Personal information processed outside Canada is subject to the laws of that country, and may be accessible to its courts, law enforcement and national security authorities. That is true of every provider named below and is not something a contract can override.
Countries and purposes
- <strong>Canada</strong> — all hosting: the database, cache, file storage and backups (Microsoft Azure, Canada Central).
- <strong>United States</strong> — AI-assisted features and semantic search (Anthropic, Voyage AI), outbound and inbound email (SendGrid), payment processing (Stripe), and distributor catalogue synchronisation (Ingram Micro, TD Synnex).
- <strong>European Union</strong> — address autocomplete (Geoapify).
- <strong>Customer-determined</strong> — any integration you connect yourself, such as Microsoft 365 or QuickBooks, processes where that provider operates for your tenant.
Alberta's Personal Information Protection Act requires an organisation using a service provider outside Canada to state which countries the information may be processed in and why. The list above is that statement. Questions about it go to privacy@solidlio.com.
If you are in the EEA or the UK, your personal information is transferred to Canada — which the European Commission recognises as providing adequate protection for data subject to PIPEDA — and onward to the providers above. Where an onward transfer leaves the EEA or the UK, we rely on Standard Contractual Clauses or the UK equivalent as incorporated into each provider's data processing agreement.
[Attorney review] Two items remain for counsel rather than the whole section: (1) Quebec's Law 25 requires a privacy impact assessment BEFORE personal information is transferred outside Quebec — that assessment has not been performed and should be, before selling into Quebec. (2) Confirm the contracting entity and current DPA terms for each provider named above; locations stated are primary processing regions and can change without notice to us.
14. Children
The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, please contact us so we can delete it.
15. Changes to this Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised Policy.
16. How to contact us
To exercise your rights or ask questions about this Policy, contact our Privacy Officer at Tridacom IT Solutions Inc., 10215 178 Street NW, Edmonton, Alberta, T5S 1M3, Canada, by phone at 888-858-4765, or by email at privacy@solidlio.com.
[Attorney review] Confirm the designated Privacy Officer's name/title and whether a dedicated privacy@ mailbox and EEA/UK representative (GDPR Art. 27) are required.
Contact us
Tridacom IT Solutions Inc. — 10215 178 Street NW, Edmonton, Alberta, T5S 1M3, Canada.
Phone: 888-858-4765 · Email: support@solidlio.com