Privacy statement

1. Who is responsible

This statement explains how Posward (“we” and “us”) handles personal information through its website, accounts, company workspaces, AI features and feedback forms. Questions and requests can be directed to the Posward operator using the contact route below.

Personal information means information about an identifiable individual. Business records can contain personal information, including a founder’s name, an action owner or a customer mentioned in a note. This statement does not replace a client organization’s own privacy responsibilities.

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) governs personal information handled in commercial activities where that law applies. Provincial privacy laws may also apply to particular people, activities or organizations, including in Alberta, British Columbia and Québec. Applicable legal rights are not limited by this statement.

2. Information we handle and why

Account and sign-in information

Email address, account identifiers, authentication and session records. These let us sign you in, protect your account and associate you with your saved companies. Visitors using certain public features may receive an anonymous session identifier before creating an email account.

Company information and website evidence

Submitted website addresses, retrieved website content, business profiles, goals, context and generated analyses. These support the positioning diagnosis and recommended course. Public website content may include personal information.

Decisions, actions and results

Saved constraints, evidence, decisions, action owners and dates, completion status, reported results, metrics, learning and next steps. These provide continuity and help you review your work over time. Reported results are observations supplied by users.

Orbit conversations

Your questions, relevant saved company context, generated answers and drafts, request identifiers, model and usage information. These provide AI assistance, retain your work and manage reliability and usage limits.

Feedback and privacy requests

Privacy requests collect your name, reply email, request type and message so we can handle the request. Other feedback may also include your role, offering of interest, rating and optional reply preference. Request records are restricted to authorized operators.

Billing, when enabled

Customer and subscription references, selected plan, subscription status and usage records. These administer paid access. Stripe collects payment and billing information through its checkout; Posward’s checkout integration does not receive full card numbers.

Technical and security information

Request and device information, such as IP address, browser details, timestamps, error and security events, may be handled by our hosting, authentication, security and diagnostic services to operate and protect Posward.

Please submit only what is needed. Use roles or initials instead of unnecessary names, and remove personal details from examples where possible. Do not submit passwords, payment credentials, government identifiers, health records or unnecessary confidential client information. If you act for another person or organization, make sure you have the authority and any required consent to provide their information.

3. AI guidance and Orbit

Posward uses Anthropic’s API to generate positioning analyses, courses and Orbit responses. Requesting a diagnosis sends relevant business inputs and retrieved website content for processing. Asking Orbit sends your question together with a limited selection of the selected company’s saved profile, diagnosis, course, confirmed constraint and decision, actions, recent check-ins and recent conversation.

Orbit attempts to remove email addresses and limit the size of this context before transfer. That is not complete anonymization: names, descriptions or other details may still identify people. Posward saves the original question, answer, a bounded context snapshot and technical usage details so you can revisit the work. Avoid including personal information that the task does not need.

AI output can be inaccurate or incomplete. Review it before use, particularly where it mentions a person. Orbit does not contact customers, send drafts or commit decisions for you. Its guidance does not make eligibility, credit, employment or other legal decisions about individuals.

Posward does not operate a model-training pipeline using your workspace content. Anthropic describes its default treatment of commercial API inputs and outputs in its commercial model-training policy. Provider processing is subject to the applicable service terms; this statement does not promise zero retention by AI providers.

4. Services and international processing

We use service providers to perform the functions below. The information they receive depends on the feature you use.

Information may be stored or processed outside your province or outside Canada, including in the United States. Foreign courts, law enforcement or other authorities may be able to access it under their laws. Posward does not promise exclusively Canadian data residency. Canadian privacy obligations continue to apply to information under our control when service providers process it. You can ask us about these arrangements. Read the federal guidance on cross-border processing.

Posward has no feature that sells your workspace information or shares it with advertisers. A practitioner subscription does not automatically give colleagues or client organizations access to another person’s company. We may disclose information where required or permitted by applicable law, including responding to a valid legal demand or addressing fraud or a security incident.

5. Consent and your choices

We explain collection and use through this statement and the relevant feature. You choose whether to provide optional context, submit a check-in, use Orbit or request a reply. Information necessary to provide a requested service is processed for that purpose; optional uses should not be a condition of unrelated features. A privacy statement alone is not consent to every possible future use.

You can stop using optional AI features, omit unnecessary details and ask to withdraw consent to further use or disclosure, subject to legal or contractual restrictions and reasonable notice. We will explain any effect on your account or the service you requested. Withdrawal does not undo processing that has already occurred. A materially new purpose requiring consent will be explained before that use begins. Learn about meaningful consent.

The feedback form’s reply choice is only for responding to that message. It does not subscribe you to marketing emails.

6. Cookies and browser storage

Posward uses cookies to maintain authentication and secure sign-in flows. Security providers may also use browser storage or related signals when performing their checks. Blocking necessary cookies or scripts can prevent sign-in or form submission.

Orbit uses local storage to remember whether you have hidden the companion. You can reopen it through “Meet Orbit” or clear that preference through your browser’s site-data settings. The sample demo keeps edits in the open page and does not save them as company records. Clearing browser data does not delete information already saved in your Posward account.

This release does not include advertising trackers or browser session replay. Technical error reporting, when configured, is used to investigate faults.

7. Retention and deletion

Saved workspace records and Orbit responses currently remain available without an automatic expiry date. Cancelling a paid plan does not delete them. You can request deletion of your personal information or closure of your account using the contact route below.

Retention must be tied to the purposes for which information is needed. When reviewing a deletion request, we consider ongoing service needs, an outstanding access request, security investigations, disputes and legal record-keeping obligations. We will explain any information that must remain and why. The operator handles access and deletion requests; there is currently no instant, self-service erasure.

Deletion from active records may not immediately remove copies in provider backups or operational logs. Their availability and retention depend on the relevant service configuration and legal requirements. Contact us about the retention arrangements that apply to your information. Read about limiting use and retention.

8. Safeguards and incidents

Posward uses HTTPS, verified account sessions, company ownership checks and database access policies to restrict workspace access. Privileged administrative functions are separated from ordinary account access. These safeguards reduce risk; no online service can guarantee that an incident will never occur.

If a breach involving personal information under our control occurs, we must assess it and meet applicable reporting, notification and record-keeping duties. Under PIPEDA, breaches creating a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and notified to affected individuals as soon as feasible. Records of all breaches of security safeguards must be kept for at least two years. See the federal breach guidance.

9. Your rights and requests

You can ask whether we hold personal information about you, request access and an account of its use and disclosure, and challenge its accuracy or completeness. You can request correction, withdraw consent or ask for deletion. The precise right and any exceptions depend on the applicable law. Deletion is not an unconditional right to remove records that must lawfully be retained.

Tell us what information or account your request concerns and how to contact you. We may need proportionate identity or authority verification before releasing or changing records. Do not include a password, magic link or identity document in the initial request. If a historical business record cannot simply be edited, we can review a correction or annotation without presenting the disputed information as established fact.

For access requests governed by PIPEDA, the usual response deadline is 30 calendar days after receipt. If a lawful extension is needed, we must notify you within that initial period with the reason and your right to complain. Access is generally provided at minimal or no cost. If access or a correction is refused, we will explain the applicable reason and available recourse, subject to lawful restrictions. Read the access-request guidance.