Privacy

Privacy Policy

We built the governed workspace for regulated work, so we treat your data the way our customers' regulators expect. This policy explains what we collect, why, how we protect it, and the rights you hold. Last updated July 22, 2026.

1. Who we are and what this covers

The governed workspace (“we,” “us,” or “our”) provides a governed AI workbench that helps organizations write, reuse, and govern prompts before they reach AI models. This policy applies to our marketing site, the governed workspace application, and the connectors and services we operate. It covers individuals who use the governed workspace on behalf of an organization (“customers”) and the end users and visitors whose information may be processed through it.

When an organization uses the governed workspace, that organization is the controller of the data it puts into the product, and we act as its processor (service provider) under our customer agreement. For our own website and account records, we act as the controller.

The governed workspace is operated from Canada and is designed around Canadian privacy expectations, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”). Unless we clearly tell you otherwise in a product or customer agreement, customer data and production application data are stored in Canada.

2. Information we collect

Account data: name, work email, organization, role, and authentication records (we use one-time codes, not stored passwords in plain text).
Workspace content: prompts, skills, notes, meeting summaries, approvals, and the context you connect from systems you authorize.
Connected-system data: only the records you explicitly connect (for example documents, calendar entries, or repositories) and only to the scope you grant.
Usage and audit data: prompt runs, policy decisions, violations, and the evidence trail we keep so your team can show what happened.
Technical data: device, browser, IP address, and security logs needed to operate and protect the service.
Billing data: handled by our payment processor; we store plan and invoice metadata, not full card numbers.

3. How we use information

To provide, secure, and improve the governed workbench and connectors.
To apply the governance, policy, and audit controls your organization configures.
To authenticate users and protect accounts against abuse.
To communicate about your account, security, and service changes.
To meet our legal, regulatory, and contractual obligations.

We do not sell personal information, and we do not use your workspace content to train third-party foundation models.

4. Legal basis, consent, and identified purposes

We collect, use, and disclose personal information only for identified business purposes that a reasonable person would consider appropriate in the circumstances, including operating the governed workspace, securing accounts, supporting governed AI workflows, processing billing, responding to support requests, and meeting legal obligations. Where consent is required, we seek consent through the relevant interaction, workspace setup, checkout flow, or customer relationship.

You may withdraw consent for some processing, subject to legal, security, and contractual limits. Withdrawing consent may affect our ability to provide parts of the service.

5. AI processing and governance

We check every prompt against your organization’s policies before a model is called. Depending on your configuration, we may detect and redact sensitive data, route requests only to approved models, require human review, or block a run. When a request is sent to a model provider, only the cleaned, policy-approved request is transmitted, and only to the provider your organization selects. We record the policy decision and supporting evidence so the run can be reviewed later.

6. How we share information

We share information only as needed to run the service:

Model and infrastructure providers that process requests or host the platform, under contract and limited to what the service requires.
Connectors you authorize, strictly within the scope you grant and revocable at any time.
Legal and safety disclosures where required by law or to protect rights and safety.
Corporate transactions, where data may transfer as part of a merger or acquisition, subject to this policy.

We maintain a current list of subprocessors and provide it on request.

7. Data retention and residency

We keep information for as long as your organization maintains its account or as required by law, then delete or de-identify it. Where your configuration sets a residency boundary (for example a Canada-only residency lock for healthcare data), we honor that boundary for the data it covers.

Our default production posture is Canada-hosted storage and Canada-focused operations. If a connector, support workflow, or customer-directed integration would move data outside Canada, we expect that to be covered by the relevant customer instructions and provider terms.

8. Security

We protect data with encryption in transit and at rest, least-privilege access, row-level data isolation between organizations, audit logging, and session isolation for notes and memory. No system is perfectly secure, but we design for regulated workloads and review our controls regularly.

9. Your privacy rights

Canada

Under PIPEDA and applicable provincial privacy laws, individuals generally have rights to know how their information is used, to request access to personal information, to challenge its accuracy and seek correction, to withdraw consent where applicable, and to raise concerns with the person accountable for our privacy program. We aim to respond to access requests in a complete and timely way and at minimal or no cost unless the law allows otherwise.

United States

Depending on your state (including California under the CCPA/CPRA, and Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws), you may have the right to access, correct, delete, or port your personal information, to opt out of sale or targeted advertising (we do neither), and to be free from discrimination for exercising these rights. Sector rules also apply: HIPAA for protected health information and GLBA for financial data.

Nigeria

Under the Nigeria Data Protection Act 2023 and the NDPR, you have the right to be informed, to access and rectify your data, to object to or restrict processing, to data portability, and to erasure. We process Nigerian personal data lawfully and fairly, and we honor data-subject requests in line with the Act.

To exercise any of these rights, contact us using the details below. If your organization administers your account, we may direct your request to them as the controller. We will not retaliate for a privacy request.

10. Access, correction, and account review

Account holders can review and update basic profile and billing-contact details inside the product where those settings are available. For other access, correction, deletion, or export requests, contact us using the details below. If the request relates to workspace content controlled by your organization, we may ask the workspace administrator to handle or approve the request.

If we deny or limit a request, we will explain the reason where required. If you believe we have not met our obligations, you may escalate the concern to our privacy contact below and, where applicable, to the Office of the Privacy Commissioner of Canada.

11. Sector-specific handling

Healthcare: we govern PHI before execution with detection, redaction, minimum-necessary checks, consent evidence, clinical-review gating, role-based access, and approved-model routing.
Finance: we support confidentiality controls and audit evidence consistent with financial-data obligations.
Government and HR: we apply sector policy templates for restricted data, retention, and audit.

12. Cookies

We use cookies and similar technologies that are necessary to sign you in and keep the service secure, plus limited analytics to operate the site. You can control non-essential cookies through your browser.

13. Email communications and CASL

We use business contact information to send account, billing, product, security, and support communications. Where we send commercial electronic messages that require consent under Canada’s Anti-Spam Legislation (“CASL”), we rely on the appropriate form of consent or another lawful basis and provide an unsubscribe mechanism where required. Operational, transactional, and security notices are still sent when needed to run the service.

14. Do Not Track and third-party tracking

The governed workspace does not currently respond to browser Do Not Track signals with a separate workflow. We do not sell personal information or use cross-context behavioral advertising. Our service providers may collect limited technical data such as IP address, device information, and security telemetry when you use our site or application, but only to help us operate, secure, and measure the service.

15. Breach response

If a breach of security safeguards creates a real risk of significant harm, we will assess, record, and respond to the incident under our incident-response program. Where the law requires it, we will notify affected individuals, relevant organizations that can reduce the risk of harm, and the appropriate regulator, including the Office of the Privacy Commissioner of Canada.

16. Children

The governed workspace is a workplace product and is not directed to children. We do not knowingly collect personal information from children.

17. Changes to this policy

We may update this policy as the product and the law evolve. We will post the new version here and update the date above; material changes will be communicated to account administrators.

18. Contact us

For privacy questions, privacy requests, or complaints about our handling of personal information, contact our Privacy Officer at [email protected]. To report a suspicious message or a verification code you did not request, email [email protected].

The governed workspace operates from Calgary, Alberta, Canada.