Privacy Policy

Overview

Collective Agents ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you use our website and services. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. By using our Services, you consent to the practices described here.

Information We Collect

We collect the following categories of personal information:

• Account informationYour email address and username/handle when you create an account or claim an invite.
• Application dataBusiness name, social profile URLs, goals, and any other details you provide when applying for membership.
• Order & payment dataEmail address, order IDs, and transaction records. Payment card details are processed directly by Stripe and are never stored on our servers.
• CommunicationsMessages and inquiries you send us through our contact form or by email.
• AI interaction dataPrompts, inputs, and outputs when you use AI tools within our platform, used to deliver the service and monitor for abuse.
• Technical dataIP address, browser type, and general usage information collected automatically when you visit our site.

How We Use Your Information

We use personal information only for the purposes for which it was collected:

• Service deliveryProcessing applications, managing member access, and fulfilling orders.
• CommunicationsSending account-related notices, purchase confirmations, and responses to your inquiries.
• Service improvementUnderstanding how our tools are used to improve quality and reliability.
• Security & fraud preventionDetecting and preventing unauthorised access, abuse, or fraudulent transactions.
• Legal complianceMeeting obligations under applicable law.

We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. We share information only as necessary to deliver our Services (see Section 05) or when required by law.

Third-Party Services

We work with the following trusted service providers who may process personal data on our behalf:

• SupabaseOur database and authentication infrastructure. Your account and application data are stored in Supabase-hosted databases. Supabase processes data under a Data Processing Agreement.
• StripePayment processing. When you make a purchase, payment data is handled entirely by Stripe under their own privacy policy. We receive only a transaction confirmation.
• AI providers (e.g., OpenAI)Certain AI-powered features process prompts through third-party model providers. We do not send personally identifiable information to AI providers unless necessary for the feature and subject to appropriate contractual safeguards.

Cookies & Tracking

We use only the cookies necessary for authentication — specifically, session tokens that keep you logged in. We do not use advertising cookies, cross-site tracking pixels, or third-party analytics scripts. You can disable cookies in your browser settings; doing so will prevent you from accessing authenticated areas of the site.

Data Retention

We retain personal information for as long as your account is active or as needed to provide services and comply with legal obligations. Application data from applicants who were not approved is deleted after 180 days. You may request deletion of your account and associated data at any time by contacting us (see Section 10). Some information may be retained in aggregate, anonymised form for internal analysis.

Your Rights (PIPEDA)

Under PIPEDA, you have the right to:

• AccessRequest a copy of the personal information we hold about you.
• CorrectionAsk us to correct inaccurate or incomplete information.
• WithdrawalWithdraw consent for non-essential data processing at any time, subject to legal or contractual restrictions.
• DeletionRequest that we delete your account and associated personal data.
• ComplaintLodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) if you believe your rights have been violated.

Security

We apply industry-standard technical and organisational measures to protect personal information, including encrypted connections (TLS 1.2/1.3), row-level security controls on our database, and restricted access to production systems. No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will notify affected users in the event of a data breach as required by applicable law.

Children

Our Services are not directed at persons under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. The revised Policy will be posted at this URL with an updated "Last updated" date. Material changes will be communicated via email if you have an account with us. Your continued use of the Services after changes are posted constitutes acceptance of the revised Policy.

Contact & Privacy Inquiries

For access requests, corrections, complaints, or any questions about this Privacy Policy, contact our privacy contact by email. We aim to respond within 30 days. hello@collectiveagents.ai Collective Agents Toronto, Ontario, Canada