Canal privacy notice

1Scope and Vediram’s role

This notice describes the current early version of Canal, provided by Vediram GmbH. Planned features, including browser enrichment and contact-origin tracking, are not part of the current application.

Canal runs on your Windows computer and connects directly to the address-book providers you choose. Vediram does not operate a Canal backend to receive or store your address books. You decide which accounts to connect and what changes to make; you remain responsible for your processing of other people’s contact information.

2Contact information and provider access

Canal reads contact information needed to display and search your address books and carry out requested moves. This can include names, phone numbers, email addresses, organizations, postal addresses, notes, and other fields held in a provider’s contact record.

For Microsoft 365, you sign in with Microsoft and authorize delegated contact access. Canal uses that access to read and write contacts in the connected account. For Infomaniak or another configured CardDAV endpoint, you supply the account credentials needed to access that address book.

When you move a contact, its information is sent directly from your computer to the destination provider and the source record is removed after the destination has been checked. The providers process these requests under their own privacy policies. Moving information to another provider changes where that information is held.

3Storage on your computer

Canal stores account configuration and move-recovery records in its local application data on your computer. Recovery records can include full original contact information so that a move can be reconciled or undone.

Persisted contact-bearing records and saved credentials are protected using Windows protection tied to your user account. The Microsoft sign-in token cache is also protected for that Windows user. This protection does not replace device security or your own backups.

The current application does not send contact information to a Vediram server and does not integrate Vediram telemetry or an AI service. Authentication services, connected providers, and your operating system may process their own service or diagnostic data under their respective policies.

4Recovery retention and removing data

At startup, Canal removes resolved move records last updated more than 30 days ago, unless an unresolved dependent recovery operation still needs them. Unresolved records can remain longer. Cleanup requires the application to run; this is not a guarantee that all local records disappear after 30 calendar days.

Deleting a contact at a provider does not immediately delete its existing local recovery record. Account configuration and sign-in caches remain in local application storage until removed. You can revoke Canal’s Microsoft access through Microsoft’s account controls, or revoke the application password at your CardDAV provider.

To remove the local application state, close Canal and remove its Canal folder under your Windows user’s local Vediram application data. Doing so removes local account state, sign-in cache, and recovery evidence, and prevents further undo using those records. It does not delete contacts held by your providers or copies in your own backups.

5This website and privacy inquiries

This notice concerns the desktop application. Visits to this website, its analytics, and information you send to Vediram are covered by the Vediram privacy policy, which explains the relevant purposes, retention, and rights.

For data-protection inquiries or requests concerning personal information Vediram holds, contact privacy@vediram.com. Vediram cannot retrieve or erase address books or local Canal records it does not hold; manage those through your device and providers. Do not send passwords, tokens, or contact exports with an inquiry.

Canal has no product-support service. See the Canal terms of use.