Legal
Privacy Notice
Last updated 2026-10-14. Operator: AINT Labs (Alberta, Canada).
What we collect
- Account data: name, email, password hash, organization details you enter.
- Workspace content: inventories, assessments, policies, vendor records, evidence files, incidents and reports you create. You control this content and can export or delete it.
- Free tool inputs: assessment answers are processed in your browser; they are stored only if you choose to save or download results. Website scanner inputs (the URL) are cached for 24 hours.
- Usage analytics: page views and tool events with a daily-rotating hashed visitor identifier. No cookies are used for analytics and raw IP addresses are not stored. We honour Do Not Track.
- Leads and enquiries: contact details and messages you submit, with your consent choices.
How we use it
To provide the service, secure it, send transactional messages (verification, invitations, task and review notifications, subscription events), respond to enquiries, and, only with your opt-in, send product and regulatory updates. Marketing messages include an unsubscribe link and your preference is stored in Settings.
Processors
Cloudflare (hosting, database and file storage; primary data region North America), Resend (transactional email), Stripe (payments; we never store card numbers). We do not use customer documents to train AI models. Optional AI-assisted drafting, when enabled, is labelled in the interface and described here before use.
Hosting location
Primary infrastructure runs on Cloudflare with data stored in a North American region. We do not claim Canada-only hosting for every subsystem.
Your rights
Access, correction, deletion and portability requests: contact us. Canadian users may contact the Office of the Privacy Commissioner of Canada; EU users have rights under the GDPR including complaint to a supervisory authority.
Retention
Workspace data is retained while your organization exists and for 30 days after deletion requests to allow recovery, then deleted. Audit logs are retained for 24 months. Anonymous assessment results not claimed within 90 days are deleted.