Privacy Policy

1. Who we are and what this policy covers

Aurevus Innovations Inc., Calgary, Alberta, Canada (Aurevus, we, us), operates Railspike. This policy explains how we handle personal information in connection with our website, account administration, support, subscription services and business communications, and how we process information supplied through customer workspaces.

Our Privacy Contact can be reached at concierge@aurevus.ai. Use that address for privacy questions, access and correction requests, complaints, or information about service providers and processing outside Canada. Please identify the relevant organization or workspace where possible, without sending unnecessary sensitive information.

We handle information according to the privacy laws applicable to the circumstances, which may include Alberta's Personal Information Protection Act and Canada's Personal Information Protection and Electronic Documents Act. Applicable duties can differ by location, the type of information and our role.

2. Our role and your organization's role

For information we use to administer our own business—such as customer contacts, accounts, service security, support and subscription records—we determine the purposes described in this policy and are accountable for that handling.

When a customer organization supplies or connects records to its Railspike workspace, the organization generally determines the business purposes and permissions for that information. We process it on the organization's behalf under the service agreement, its authorized instructions and applicable law. The organization may be a property owner, developer, manager, employer or another operator; an affected individual need not be its employee.

Workspace administrators may control user access, connected systems, processing settings and retention instructions within the Service. The organization's own privacy notice should explain its handling of information about residents, applicants, employees, contractors and other people. Its subscription to Railspike does not eliminate its notice, consent, access or other legal responsibilities, and does not eliminate our own responsibilities.

Independent payment providers and customer-selected third-party services may also handle information for their own purposes under their privacy notices. Their role depends on the service and arrangement, not simply on whether Railspike connects to them.

3. Personal information we handle

Depending on the features used and information supplied, we may handle:

Category	Examples and source
Account and organizational information	Names, work contact details, organization and workspace identifiers, invitations, roles, permissions and administrative contacts supplied by customers, users or authorized identity services.
Authentication and security information	Authentication identifiers, login/session records, security events, and password-verification information where password sign-in is used. Federated sign-in is handled with the selected identity provider.
Subscription and transaction information	Billing contact and address, tax information where required, agreed scope, door counts, subscription identifiers, payment status, invoices, refunds and limited payment-method details supplied by customers or payment providers. Payment credentials are entered through the payment provider's collection flow; we do not require users to send full card numbers to Railspike support.
Workspace content	Documents, project and property records, resident and vendor information, asset and service history, communications, schedules and other information uploaded, entered or obtained from authorized connections. The contents depend on the customer's use.
AI and workflow information	Prompts, relevant source passages, generated outputs, extracted fields, retrieval indexes, task instructions, tool results, approvals, audit records and usage information created in delivering enabled functions. Derived information may itself be personal information.
Technical information	IP addresses, device/browser information, request and error records, access events, necessary identifiers and feature/processing usage used to operate, secure and diagnose the Service.
Support and business communications	Messages, attachments, feedback and contact preferences supplied when communicating with us or an authorized support provider.

We receive information directly from individuals, from the customer organizations they interact with, from authorized integrations and identity/payment services, and through operation of the Service. Some customer-enabled functions may use publicly available information or external research results; public availability does not remove privacy obligations.

Do not supply information that is unnecessary for the task. Sensitive or specially regulated information requires particular care and may be outside the supported use of the Service. Customers must verify that their proposed data and use are permitted before connecting them.

4. Why we use personal information

We use personal information as reasonably necessary to:

• establish accounts, authenticate users, administer workspaces and apply permissions;
• provide the functions the customer enables, including retrieval, analysis, drafting, forecasting, workflow assistance and authorized actions;
• operate subscriptions, calculate and verify agreed scope and usage, issue records of payment and resolve billing discrepancies;
• provide support, investigate errors, maintain service quality and protect people, information and systems against misuse;
• communicate about service operation, account changes, incidents, subscription matters and legal notices;
• respond to rights requests, comply with law, maintain required records and establish or defend legal claims;
• send optional marketing communications where we have a lawful basis to do so, respecting the recipient's choices.

Where we rely on consent, we explain the relevant purpose and obtain the form of consent required for the sensitivity and circumstances. Where law permits or requires handling without consent, we limit that handling accordingly. Accepting general terms is not blanket consent to unrelated uses of personal information.

We may use appropriately aggregated or de-identified operational information to understand reliability, capacity and service usage, provided it cannot reasonably identify an individual or expose a customer's confidential operations. We do not treat a dataset as anonymous merely because names have been removed, and we do not attempt to re-identify de-identified information except where necessary to verify that the de-identification is effective and lawful.

5. AI processing and customer content

Railspike may use multiple AI models and service providers. Different functions may use different processing methods, including document extraction, embeddings and retrieval, generation, research, classification and workflow assistance. The relevant information sent for processing can include a prompt, selected source material, context needed for the task and resulting outputs. We limit processing to the information reasonably needed for the enabled function and authorized purpose.

We may change or update models and versions to operate, maintain and improve those functions. We do not promise a particular model brand or version unless expressly agreed. A technology update does not authorize new unrelated purposes, weaken agreed protections, override a geographic restriction or bypass a required notice or consent.

We do not use customer workspace content to train or fine-tune AI models for ourselves, our providers or other customers. Providers that process such content on our behalf must be engaged under arrangements and configurations that prohibit that training. Indexing records, creating retrieval representations and generating an answer for the customer's own authorized use are processing functions, not permission to train a general-purpose model on the content.

This does not mean there is no temporary retention, security logging or authorized human access. Relevant information may be retained or reviewed where necessary for the contracted function, security, support or legal obligations, under the applicable protections. We do not promise zero retention by every provider unless that is specifically agreed and verified.

We do not use one customer's confidential workspace information to answer another customer's questions. Where a customer deliberately connects an independent service or its own provider account, that service's terms and settings also apply. We will not silently treat a customer-selected arrangement as permission to bypass commitments that apply to Aurevus's own processing.

AI-generated statements about a person may be wrong. Customers must use appropriate verification and human judgment, particularly for decisions with significant consequences. Individuals may raise concerns or correction requests through the channels below. The existence of an audit record does not prevent an appropriate correction, annotation or legally required deletion.

6. Who receives information

We disclose or make personal information available only for an appropriate, identified purpose, including to:

• Authorized customer users and recipients. Information may be available to the workspace administrators, users and destinations authorized by the customer's permissions and instructions. Customers must consider the effects of shared workspaces, exports and outbound actions.
• Service providers acting for Aurevus. These may provide hosting, storage, databases, security, authentication support, communications, customer support, AI processing, document processing or other infrastructure needed for the Service. Their access must be limited to their function and subject to appropriate confidentiality, security and use restrictions.
• Payment and merchant-of-record providers. The provider identified at purchase receives the information needed to process and administer the transaction, taxation, fraud prevention, disputes and its legal duties. For Stripe Managed Payments purchases, Stripe and the designated merchant-of-record entity may also handle information for their own transaction and compliance purposes under the notices supplied at checkout. They are not described here solely as processors under Aurevus's instructions.
• Customer-selected integrations and recipients. A customer may authorize connections or communications with its existing systems, providers, owners, residents, contractors or other recipients. These parties may have independent obligations and privacy policies.
• Professional advisers and lawful authorities. Limited information may be disclosed for legal, accounting, security and other legitimate professional purposes, or when required or permitted by law, with appropriate safeguards. Where lawful and appropriate, we notify the affected customer of a compulsory request.
• A potential or actual business successor. Necessary information may be handled in a genuine financing, reorganization or business-transfer process under confidentiality and applicable privacy requirements. A transaction does not create unrestricted permission to use existing information for a new purpose.

We do not sell personal information or share it for cross-context behavioral advertising. We do not license customer workspace content for third-party advertising or data brokerage.

7. Processing locations and provider information

Railspike is operated by a Canadian company. Information may be stored or processed in Canada and outside Canada, including the United States, depending on the function, provider and customer configuration. Hosting location, AI inference location, support access and backup location are different questions. A Canadian primary data store does not mean every processing operation remains in Canada.

We maintain a Service-provider and processing-location notice describing the relevant provider functions, countries in which information is or may be handled, and applicable arrangements. To obtain that written information before supplying data, or to ask about a particular configuration, contact our Privacy Contact at concierge@aurevus.ai. We also make any contractually required provider register available through the agreed channel.

When information is handled abroad, the laws of that country may permit access by its courts, regulators or other lawful authorities. We use appropriate contractual and other safeguards for processing on our behalf and remain accountable for the responsibilities that apply to us. Customer-approved geographic restrictions must be expressly documented and technically supported; do not assume that a Canada-only or other regional restriction applies merely from the location of our company or a hosting service.

We provide information and any required notice, consent process or opportunity to object when a change in provider, country, purpose or processing arrangement requires it under law or an agreed contract. Routine model/version changes within the same authorized processing arrangement do not automatically require a rewrite of this policy; they remain subject to the same limits and protections.

8. Retention, cancellation and deletion

We retain personal information only as long as reasonably necessary for the identified purposes, applicable customer instructions and legal requirements. Relevant factors include the subscription and agreed retrieval period, the type and sensitivity of the record, security needs, accounting duties, unresolved disputes and legal holds.

Record category	Retention approach
Workspace content and derived records	Retained to provide the contracted service and the agreed post-termination retrieval period, then deleted or de-identified through the documented deletion process, subject to lawful exceptions. The standard Terms provide a 30-day retrieval window after service ends; the accepted agreement controls.
Account and subscription records	Retained while needed to administer the relationship and subsequently for applicable financial, legal, dispute and compliance obligations. Not every record requires the same retention period.
Audit and approval records	Retained for justified operational, evidentiary and legal purposes under the relevant schedule. An audit trail does not justify keeping every personal detail indefinitely. Corrections may be recorded through an amendment or annotation where preserving evidence is necessary.
Operational and security logs	Retained for documented troubleshooting, security and accountability periods, with longer retention where a specific incident or legal obligation requires it.
Support communications	Retained as necessary to resolve the issue, maintain a proportionate support history and meet applicable record obligations.
Backups and residual copies	Restricted from ordinary use after active deletion and removed through the documented rotation or expiry process. If a backup is restored, applicable deletion instructions must be reapplied.

Cancelling renewal, ending service, disconnecting a system and requesting deletion are different actions. Disconnecting stops future authorized access to the source; it does not necessarily erase previously imported information. Deletion requests are assessed against the customer's authority, the agreed service and applicable rights and obligations. Legal holds and required financial records may prevent immediate deletion of particular information. Such retained information remains protected and restricted to the permitted purpose.

Ask the Privacy Contact for the retention information relevant to your record or deployment. We will explain a material retention exception where appropriate and lawful. Independent payment providers apply their own lawful record-retention duties.

9. Security and incidents

We use reasonable administrative, technical and physical safeguards appropriate to the information and risk. These include appropriate access controls, protection of transmitted and stored information, customer access separation, logging and controlled access by personnel and providers. Security depends in part on customer permissions, device security and the settings of connected services.

No online service can guarantee absolute security. We do not claim a certification, audit result, particular isolation architecture or recovery commitment unless it is specifically substantiated and stated in the applicable documentation or agreement.

If an incident affects customer personal information processed on the customer's behalf, we notify and assist the customer under the applicable processing agreement. Separately, where law requires notification to individuals, regulators or other organizations, we provide it within the required period. We assess the relevant obligations and maintain incident records as required; the threshold for public or individual notification is not a reason to withhold a contractually required customer notice.

10. Cookies, browser storage and third-party sites

Railspike uses cookies or similar technologies needed for authentication, sessions, security and operation. Our website also uses browser storage for preferences such as the selected display theme. These technologies are distinct from advertising trackers.

We do not use advertising tracking or cross-site behavioral profiling on our marketing website. Any introduction of non-essential analytics or similar technology must be assessed, disclosed and subject to the choices required by applicable law. This policy is not advance consent to an unspecified future tracker.

Payment pages, identity-provider pages and independently operated services have their own technologies and notices. Following an external link takes you to that provider's environment. If an embedded third-party service is enabled, its handling and any required choice must be explained at the relevant interaction. Browser controls can limit cookies and local storage, although blocking necessary technologies may prevent sign-in or other functions.

11. Your rights and choices

Depending on applicable law and our role, you may request access to personal information, information about its use or disclosure, correction, deletion, a copy or portability where available, withdrawal of consent, or other applicable restrictions or objections. These rights can be subject to lawful exceptions, including protection of others' information, privilege, security and required recordkeeping. Withdrawing consent does not necessarily undo lawful past handling and may prevent us from providing a function that requires the information.

Contact concierge@aurevus.ai, describe the request and identify the relevant context. We may reasonably verify identity or authority before acting and may ask for information necessary to locate the records. We will not ask for unnecessary sensitive documents. An authorized representative may act where permitted, with appropriate verification.

For workspace information controlled by a customer organization, we normally coordinate with that organization or explain how to contact it, and assist as required by our agreement and law. We do not use that referral to avoid responsibilities that apply directly to us. Where we cannot grant a request, we explain the applicable reason and available complaint route to the extent permitted.

We respond within the period required by the applicable law and provide notice of a permitted extension where required. Access responses under PIPEDA are generally due within 30 calendar days; Alberta PIPA generally provides 45 calendar days. Other jurisdictions can have different rules. We will not discriminate against a person for exercising a legally protected privacy right.

Optional marketing messages include a means to unsubscribe, and choices can also be sent to the Privacy Contact. Necessary service, security, contractual and transactional communications may continue while they are required for the relationship. Marketing consent is not bundled into acceptance of the subscription terms.

12. Information about children and sensitive information

Railspike is a business service; individuals opening customer accounts must be adults with the necessary authority. The Service is not marketed directly to children.

Customer records can nevertheless contain information about minors, such as information lawfully held by a property manager about a household. Customers must limit such information to what is necessary, establish the applicable authority and protections, and avoid inappropriate profiling or AI use. If we learn that information has been supplied or used unlawfully, we take appropriate steps with the responsible customer. Account eligibility must not be read as a claim that no customer record could ever contain a child's information.

13. Policy changes

We update this policy when our relevant practices change and identify the effective date. We provide appropriate notice of material changes and obtain additional consent where law requires it. A change to the policy does not retroactively authorize a new purpose for previously collected information.

Minor clarifications and technology changes that do not materially change purposes, recipients, countries, rights or protections may not require a separate email. Required legal or contractual provider-change notices still apply. Urgent legal or security changes may require different timing, with notice as appropriate.

14. Questions and complaints

Privacy Contact — Aurevus Innovations Inc. Calgary, Alberta, Canada concierge@aurevus.ai

We will investigate privacy concerns and explain available next steps. You may also contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta, or another authority responsible under the law applicable to you. You do not lose the right to contact a regulator by raising a concern with us first.