← Back to SummitOS

SummitOS Controlled Paid Pilot — Privacy Policy (Draft)

1. Introduction & Scope

NEXORA Technologies Corp. ("NEXORA", "we", "us", or "our") provides this Draft Privacy Policy to describe how personal and business information is collected, used, and protected when applying for or participating in the SummitOS Controlled Paid Pilot (the "Service"). This draft has been prepared for owner and legal counsel review with Canadian privacy considerations under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the Alberta Personal Information Protection Act (PIPA).

2. Information We Collect

We collect information strictly necessary to evaluate pilot inquiries and operate, maintain, and deliver SummitOS to approved pilot participants:

• Pilot Inquiry & Account Details: Company name, contact name, business email address, phone number, and selected pilot tier.
• Operational Business Data: Client contact records, project estimates, work orders, material SKU catalogs, purchase orders, and invoices created within an approved workspace.
• Authentication Data: User email addresses, salted password hashes (managed via Supabase Auth), session tokens, and access logs.
• Billing & Payment Metadata: Stripe customer IDs, subscription status, billing period dates, and transaction receipts where billing is authorized. SummitOS does not store or process raw credit card numbers or CVVs.
• Technical & Telemetry Data: IP addresses, browser user-agent headers, and application error logs.

3. How We Use Your Information

We use collected data solely for the following purposes:

• To review pilot applications and onboard approved organizations into an isolated tenant workspace.
• To calculate material pricing, estimate margin impact, and generate procurement documents.
• To process authorized pilot billing via Stripe.
• To dispatch essential transactional emails (invitations, password resets, and pilot onboarding notices).
• To protect our infrastructure against DDoS attacks, brute force attempts, and unauthorized data access.

4. Third-Party Subprocessors

We engage cloud service providers to support our operations:

• Supabase, Inc. (AWS): Cloud PostgreSQL database hosting, Row-Level Security (RLS) enforcement, and user authentication.
• Stripe, Inc.: Payment processing and billing management for approved pilot accounts.
• Transactional Mail Infrastructure: Delivery of account invitations and password recovery links.

5. Database-Level Tenant Isolation & Security

Database-level tenant isolation using PostgreSQL Row-Level Security (RLS). Every approved customer workspace is partitioned by a unique tenant_id enforced by PostgreSQL Row-Level Security policies. Customer workspaces are isolated so one organization cannot query or view another organization's estimates, clients, or supplier pricing feeds.

6. Data Retention and Deletion

We retain your workspace operational data for as long as your subscription remains active. Following subscription cancellation, your data is retained in a secure, read-only state to permit reactivations or historical accounting audits. You may request permanent deletion of your organization's data at any time by contacting our Privacy Officer.

7. Your Privacy Rights

Under Canadian privacy legislation (PIPEDA / PIPA), you have the right to: (a) request access to the personal information we hold about you; (b) request correction of inaccurate or incomplete records; and (c) withdraw consent to data processing (subject to legal or contractual restrictions). To exercise these rights, please contact our Privacy Officer.

8. Contact Our Privacy Officer

If you have questions or concerns regarding our privacy practices, please contact:
Privacy Officer
NEXORA Technologies Corp.
Email: growth@nexorayyc.io