Privacy Policy

Our role differs depending on the information involved, and the distinction determines who you should contact about your rights.

• Customer content — the records, documents, audits, and personnel data an organization maintains in its workspace. We handle this only on that organization's instructions, as its service provider. The organization decides what is collected, why, and for how long.
• Account and platform data — the information we collect to operate the Service itself, such as sign-in records, billing contacts, support correspondence, and security logs. For this we act as a business in our own right and determine the purposes ourselves.

If you are an employee or contact of an organization that uses the Service and you want to exercise rights over content held in that organization's workspace, direct your request to that organization. We will assist them in responding, but we will not unilaterally alter or delete their records.

• Identifiers — name, work email address, organization affiliation, and user identifier.
• Account and authentication data — sign-in timestamps, one-time passcode delivery records, session activity, and role and module permissions.
• Commercial information — subscription plan, billing contact, and transaction records.
• Internet and network activity — IP address, browser and device type, pages accessed within the Service, and error diagnostics.
• Professional information — job title, department, training records, competence assessments, and qualification data, where an organization chooses to maintain these in its workspace.
• Content submitted by users — documents, audit findings, process records, supplier data, and any personal information an organization elects to place in those records.
• Support correspondence — the content of messages sent to our support channels.

We do not intentionally collect sensitive personal information as defined by the CPRA, and the Service is not designed to store government identification numbers, financial account numbers, precise geolocation, biometric data, or health records. Organizations should not place such information into workspace records.

• Directly from you, when you sign in, use the Service, or contact support.
• From the organization that granted you access, when it creates or updates your user record.
• Automatically from your use of the Service, through application and security logging.
• From our payment and infrastructure providers, in the form of transaction and operational records.

We use personal information to:

• Provide, maintain, and support the Service, including authenticating users and enforcing access permissions.
• Secure the Service — detecting, investigating, and responding to unauthorized access, abuse, and operational faults.
• Maintain audit trails of lifecycle and administrative actions, which the Service records so that customers can evidence control of their quality management system.
• Administer subscriptions, billing, and customer communications.
• Improve reliability and performance through aggregate, non-identifying analysis.
• Comply with legal obligations and enforce our agreements.

Under PIPEDA we rely on consent. For account and authentication data, consent is implied by an individual's use of the Service for the purposes identified above, which are those a reasonable person would consider appropriate in the circumstances. Where we seek to use personal information for a materially different purpose, we will obtain fresh consent. An individual may withdraw consent subject to legal and contractual restrictions and reasonable notice; withdrawing consent to essential processing means access to the Service cannot continue.

We do not use personal information to make decisions producing legal or similarly significant effects without human involvement, and we do not use customer content to train generally available machine learning models.

In the preceding twelve months we disclosed the following categories of personal information to service providers for the business purposes described above. We have not sold or shared personal information.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA as amended by the CPRA. We have not done so in the preceding twelve months. We do not serve targeted advertising within the Service, and we do not permit third parties to collect personal information through it for their own purposes.

Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" opt-out. Should this ever change, we will update this Policy and provide the required mechanism before the change takes effect.

We do not knowingly sell or share the personal information of consumers under sixteen years of age.

We engage the following categories of service provider to deliver the Service. Each is bound by contract to process personal information only on our instructions and to maintain appropriate safeguards.

• Cloud infrastructure and hosting — compute, networking, and application runtime.
• Identity and authentication — management of user directories and one-time passcode sign-in.
• Transactional email delivery — sending one-time passcodes and system notifications.
• Object storage — storage of uploaded documents and generated files.
• Managed database — the dedicated database provisioned for each organization.
• AI model hosting — processing prompts and returning generated output for AI-assisted features.
• Machine translation — translating interface content and, where a customer requests it, record content.
• Spreadsheet rendering and editing components — supporting in-browser editing of spreadsheet documents.

We will provide the current list of named subprocessors on request to [PRIVACY CONTACT EMAIL]. We remain accountable for personal information transferred to a service provider for processing, and we use contractual means to provide a comparable level of protection while it is in their hands.

Each organization selects a home region when its workspace is created — currently Canada or the United States. That choice is fixed at creation and determines where the organization's data resides.

An organization's database, uploaded files, backups, exports, logs, and sandbox environments all remain within its home region. We never replicate an organization's data across the region boundary. A Canadian organization's data stays in Canada; a United States organization's data stays in the United States.

Personal information stored in Canada or the United States is subject to the laws of that country, and may be accessible to its courts, law enforcement, and national security authorities under those laws. Limited platform metadata — such as which region an organization belongs to, needed to route a sign-in request — is maintained centrally and does not contain workspace record content.

Customer content is retained for as long as the organization maintains it in the Service. Organizations configure their own retention period for records, and the Service applies that setting; we do not shorten it unilaterally.

Following expiry or termination of a subscription, an organization has thirty (30) days to export its data. After that window we delete customer content from active systems, and it ages out of backups on our standard backup cycle. Account, billing, and security log data is retained for as long as needed for the purposes described in this Policy and to meet legal, tax, and audit obligations, after which it is deleted or de-identified.

We apply safeguards proportionate to the sensitivity of the information, including:

• A dedicated physical database for each organization, so one customer's records are isolated from another's at the infrastructure level rather than by query filtering alone.
• Encryption of data in transit and at rest.
• Passwordless sign-in using one-time passcodes delivered to a verified email address, removing reusable passwords as an attack surface.
• Access control by role and by module, enforced on the server rather than in the browser.
• Audit trails recording lifecycle and administrative actions with a traceable actor and timestamp.
• Encrypted, regionally-resident backups.
• Least-privilege access for our personnel, granted only where needed to operate and support the Service.

No system is perfectly secure, and we cannot guarantee absolute security. Where a breach of security safeguards creates a real risk of significant harm, we will notify affected organizations and the applicable regulators as required by law, without undue delay.

Under PIPEDA, individuals in Canada may request access to the personal information we hold about them, request correction of inaccuracies, ask about our use and disclosure practices, and withdraw consent subject to legal and contractual restrictions.

Under the CCPA as amended by the CPRA, California residents may request to know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of recipients; request deletion; request correction; and limit the use of sensitive personal information. We will not discriminate against anyone for exercising these rights.

To exercise any of these rights, contact [PRIVACY CONTACT EMAIL]. We will verify your identity before responding, ordinarily by confirming control of the email address associated with your account. We respond within thirty (30) days under PIPEDA and within forty-five (45) days under the CCPA, extendable where permitted with notice to you. An authorized agent may submit a request on your behalf with written proof of authorization.

Where the information sits in a customer organization's workspace, we will refer the request to that organization and assist it in responding, since it — not us — determines what is held there and why.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the California Privacy Protection Agency or California Attorney General, as applicable to you.

The Service is a business tool intended for use by organizations and their personnel. It is not directed to children, and we do not knowingly collect personal information from anyone under sixteen years of age. If we learn that we have collected such information other than as a record maintained by a customer organization for its own lawful purposes, we will delete it.

We may update this Policy from time to time. Where a change materially affects how we handle personal information, we will give notice by email to account administrators or within the Service before it takes effect, and we will update the effective date shown at the top of this page.

Questions, requests, and complaints about privacy may be sent to [PRIVACY CONTACT EMAIL], or by mail to [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. [LEGAL ENTITY NAME] is incorporated in [JURISDICTION OF INCORPORATION] and is accountable for personal information under its control.