1) Scope & Who We Are

This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our B2B SaaS platform for document and project workflows, optional AI features, e-signature routing, email/calendar integrations, and related websites, apps, and APIs (the "Services").

For data you load into your Business workspace (e.g., documents, templates, contacts, project notes) you are typically the controller, and we act as your processor. For our own account, billing, support, product diagnostics, and marketing sites, we act as a controller.

This policy is intended to comply with BC PIPA, Canada’s PIPEDA, the GDPR/UK GDPR, and the CCPA/CPRA (California), as applicable.

2) What We Collect

A) Information you provide (controller context)

• Account & Profile: name, email, password (hashed by Supabase Auth), phone (optional), role/title, business name and details.
• Billing & Plan Data: plan tier/seat allocation; payment records handled by our payment provider (we don’t store full payment card numbers).
• Support & Communications: messages and attachments sent to support@adminark.com or via in-app forms.

B) Customer Data you load into your workspace (processor context)

• Content: documents, templates, comments/approvals, versions, generated outputs.
• Contacts: names, emails, phone numbers, notes, task assignments, imports/exports.
• Projects: activity logs, notes, tasks/assignees, linked document events.
• Integrations: OAuth tokens and settings (e.g., Google Calendar/Gmail), custom SMTP credentials, e-signature packages/signers (OneSpan).
• Operational Logs: project_audit_log, integration events, limited diagnostics.

C) Automatic information

• Product Diagnostics: device/browser metadata, truncated IP hashes, sanitized user agent, error/performance events (in-app; no default third-party APM).
• Authentication State: Supabase session tokens in localStorage/sessionStorage (adminark_auth_session).
• Cookies/Local Storage: essential for auth and session continuity; we do not set tracking/advertising cookies by default.

D) Optional AI inputs

Text and document snippets you explicitly submit to AI features (e.g., “Analyze with AI”), plus generated outputs and metadata.

3) How We Use Information

A) As Controller

• Provide and administer accounts, plans, and support.
• Secure and monitor the Services (rate limits, circuit breakers, fraud/abuse prevention).
• Improve features, quality, and reliability (aggregate, de-identified analytics).
• Legal compliance and enforcing our Terms.

B) As Processor (on your instruction)

• Host, process, display, and transmit Customer Data to deliver workspace features.
• Run optional AI jobs only when you enable or invoke them.
• Route e-signature packages via OneSpan on your instruction.
• Send emails via SendGrid or your connected Gmail/SMTP on your instruction.
• Provide export/deletion tools and consent logs.

C) AI specifics

• When AI is used, we send only the data needed to fulfill that request to OpenAI (and, if enabled in the future, Anthropic).
• No model training by default on your Customer Data; if training options are ever introduced, they will be opt-in.
• Outputs may be inaccurate; you must review before critical use.

Use of Artificial Intelligence

AdminARK may provide features powered by artificial intelligence or machine learning. Outputs generated by these features may be inaccurate, incomplete, or misleading. Customers remain solely responsible for reviewing outputs and determining their suitability for any use. AdminARK disclaims any liability arising from reliance on AI-generated outputs.

4) Lawful Bases (GDPR/UK GDPR)

• Contract necessity: operating the platform, support, billing.
• Legitimate interests: security, fraud prevention, service improvement (balanced against your rights).
• Consent: optional AI features; marketing emails (opt-in).
• Legal obligation: complying with applicable laws and record-keeping.

5) Sharing & Subprocessors

We use carefully selected subprocessors to help deliver the Services. They process data only under contract and only as needed.

Core subprocessors (feature-dependent): Supabase (authentication, database, storage); OpenAI (AI processing when invoked); SendGrid (email delivery); Google (OAuth for Calendar/Gmail; calendar metadata/events; optional Gmail send); OneSpan (e-signature workflow; signer data; signed files).

We may update this list and will reflect changes here or on a dedicated subprocessors page. We do not sell or “share” personal information for cross-context behavioral advertising under the CCPA/CPRA.

6) International Transfers

Data may be processed in regions where our subprocessors operate. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) for EEA/UK transfers. Contact us if you need signed copies of transfer terms relevant to your data flows.

7) Security

We implement reasonable administrative, technical, and physical safeguards:

• Auth & Access: Supabase Auth (JWT); business-scoped Row-Level Security; user-scoped clients.
• Transport & Storage: encryption in transit (TLS) and at rest (provider-level).
• Storage Controls: private buckets (documents, generated-documents, secure-uploads) accessed via secure proxy with business checks, CORS allowlist, secure headers, Range support.
• Headers/CSP: HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP/CORP; X-Powered-By disabled.
• Resilience: rate limiting (edge/enterprise), circuit breakers, draft visibility limits, audit/event logs.

No security program can guarantee absolute protection, but we work continuously to reduce risk. If we become aware of a security incident affecting personal information, we will notify you without undue delay and share available details consistent with law-enforcement and confidentiality needs.

Data Breach Notification

In the event of a data breach involving Personal Information, AdminARK will notify affected individuals and regulators as required under applicable privacy laws (including PIPEDA, BC PIPA, GDPR, and CCPA/CPRA). Notification will be made without undue delay and will include, at a minimum: (i) a description of the incident, (ii) the categories of affected information, (iii) measures taken or proposed to address the incident, and (iv) recommended steps for individuals to mitigate potential harm.

Data Retention and Deletion

Customer Data will be retained only for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Upon termination of the Services, Customer may request deletion of all Customer Data, and AdminARK will permanently delete such data within ninety (90) days unless otherwise required by law. Backups will be purged on a rolling basis in accordance with our retention schedules.

International Data Transfers

Where Personal Information is transferred outside of Canada, AdminARK ensures appropriate safeguards are in place, including the use of Standard Contractual Clauses or equivalent mechanisms approved by relevant authorities. By using the Services, you consent to such transfers.

Survival

The provisions concerning disclaimers, limitations of liability, indemnification, confidentiality, intellectual property, governing law, and dispute resolution shall survive termination of your account or this Agreement.

8) Retention

• Workspace data (processor): retained while your subscription is active and deleted/soft-deleted per your instructions or when accounts are terminated.
• Account/controller data: retained as necessary for the purposes above and legal obligations (e.g., records/defense).
• Exports: delivered via expiring signed URLs; copies saved to your private storage when you request.

We currently do not provide specific backup/DR commitments unless agreed in writing.

9) Your Rights & Choices

A) Access, Correction, Deletion, Portability

Depending on your region, you may have rights to access, correct, delete, or port your personal information. Workspace users should contact their Business admin (controller) first. You can also contact us at support@adminark.com.

B) Consent Logs & Preferences

We provide endpoints/UI to record consent types/versions with audit metadata. You may manage integration connections (e.g., disconnect Google Calendar/Gmail) in settings.

C) Marketing & CASL

We send marketing emails only with your consent. You can opt out anytime via unsubscribe links or by emailing support@adminark.com. Service/transactional emails may still be sent.

D) California (CCPA/CPRA)

We do not sell or “share” your personal information for cross-context behavioral advertising. You may exercise your California rights (access, deletion, correction, limit use of sensitive PI, etc.) via support@adminark.com. If you are an end user of a Business customer, contact that Business (controller).

E) EEA/UK (GDPR)

You may have rights to access, rectification, erasure, restriction, objection, and portability, and the right to lodge a complaint with your supervisory authority. Where processing is based on consent, you can withdraw it at any time.

10) Children

Our Services are for businesses and not directed to children. We do not knowingly collect personal information from children.

11) Third-Party Links & Services

Your use of Google, Gmail/SMTP, SendGrid, OneSpan, and any other integrated services is governed by those providers’ terms and privacy policies.

12) Changes to this Policy

We may update this Privacy Policy. Material changes will be notified via the Services or email and take effect on the stated effective date.

13) Contact

Questions or requests? Email support@adminark.com. Postal (optional): [AdminARK, Attn: Privacy, [Address], Vancouver, BC, [Postal Code], Canada]