Privacy Policy
Last updated: · Draft version: draft-2026-10-13.1
Template structure adapted from Automattic Legalmattic. Adapted for this service; this policy text is available under CC BY-SA 4.0.
Who we are and what this policy covers
This draft describes privacy topics for Observagent public websites and the SaaS application, currently offered to customers in Canada and the United States. Legal operator: [TODO: registered company name]; privacy contact: privacy@observagent.cloud.
[TODO: Confirm controller/processor roles, full mailing address and privacy officer: [TODO: privacy officer name or title]]
Information we collect
Information provided through the service may include business account and organization details, email addresses, support messages, subscription records, and telemetry uploaded by customers. Authentication and security flows use account credentials and verification records. Request logs may include IP addresses and technical information. Stripe handles payment-method details through hosted payment pages.
[TODO: Confirm the complete data inventory, cookie inventory, categories of telemetry, precise security logs, and whether any sensitive information or children’s information is accepted.]
How and why information is used
The service uses account and organization information to provide access, provision workspaces, operate billing, communicate about the service, and investigate security or support issues. Newsletter subscriptions are handled separately from transactional messages.
[TODO: Confirm all purposes, legal bases where applicable, marketing consent records, disclosures and any secondary use. Do not add advertising, AI training, sale/sharing declarations or profiling assertions without verification.]
Sharing information and third-party processors
Detected services are listed below. Contracting entities, processing locations and production enablement remain subject to verification. A detected integration is not proof that it receives customer data.
| Provider | Purpose | Status / locations |
|---|---|---|
| Stripe | Hosted checkout, subscription billing and refunds | Detected in billing code [TODO: verify processing locations and contracting entity] |
| Amazon Web Services | Hosting, tenant infrastructure, backups and SES transactional email | Detected in infrastructure and email code [TODO: verify all account, telemetry, backup and email regions] |
| Brevo | Newsletter subscription and marketing email | Detected in newsletter code [TODO: verify processing locations and contracting entity] |
| Google reCAPTCHA | Newsletter form abuse prevention | Detected in form code; cookie classification pending review [TODO: verify processing locations and contractual role] |
| Microsoft Entra ID | Single sign-on authentication | Detected in configured SSO issuer [TODO: verify configured tenant and processing locations] |
| Google Firebase / Firestore | Optional telemetry backup | Conditional code path; production use not confirmed [TODO: confirm whether enabled; remove if unused] |
[TODO: Verify signed processor agreements, applicable safeguards, locations and notification procedures.]
How long information is kept
Retention depends on the data type and the applicable subscription and deletion process. The current published policies describe organization cancellation and deletion, billing/audit records and shared recovery snapshots.
[TODO: Specify verified retention and backup-expiry periods for each data category, and applicable legal holds.]
Choices, access and privacy requests
Use Cookie settings in the footer for the existing cookie choices. Contact privacy@observagent.cloud to request access, correction, deletion or a copy of personal information, or to raise a privacy concern. We may need to verify your identity; do not send passwords or payment-card details.
[TODO: Confirm available backend paths, response timelines, appeals, withdrawal of consent, Canadian provincial/PIPEDA applicability, and applicable US state rights. Do not claim self-service export or individual account erasure is implemented.]
Security and international processing
Security measures and service-provider locations must be assessed against the data actually processed. No system can guarantee absolute security. A selected tenant hosting region does not necessarily describe the location of every billing, authentication or email processor.
[TODO: Document actual safeguards, incident notification, transfers and contractual protections.]
Policy changes
[TODO: Define notification and re-acceptance rules. Draft version draft-2026-10-13.1 is not the active account acceptance version.]