Privacy Policy

1. Who We Are

IbnaticsOS is operated by Ibnatics Group ("we", "us", "our"), based in Toronto, Ontario, Canada. We provide a SaaS campaign execution platform for marketing agencies at ibnaticsos.com.

For privacy inquiries: privacy@ibnaticsos.com

Data Protection Officer: dpo@ibnaticsos.com

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password (managed by Clerk). If you subscribe, we collect billing information processed by Stripe — we do not store your credit card details.

Usage Data

We collect information about how you use IbnaticsOS including features accessed, campaigns created, AI prompts submitted, and actions taken within the platform. This data is used to improve the service and provide analytics.

Technical Data

We collect IP addresses, browser type, device information, and session data for security, fraud prevention, and rate limiting purposes. IP addresses are considered personal data under GDPR and are stored for up to 30 days.

Content You Create

We store campaign content, brand assets, templates, AI-generated outputs, and other content you create within IbnaticsOS. This content is owned by you and processed on your behalf.

3. How We Use Your Information

• To provide, operate, and maintain the IbnaticsOS platform
• To process payments and manage your subscription
• To send transactional emails (account confirmation, billing receipts, service notifications)
• To improve platform features using aggregated, anonymized analytics
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations
• To respond to support requests and inquiries

Legal Basis (GDPR): We process your data under: (a) contract performance — to deliver the services you subscribed to; (b) legitimate interests — for security, fraud prevention, and platform improvement; (c) consent — for optional analytics tracking; (d) legal obligation — for tax, billing, and compliance requirements.

4. Sub-Processors

We share your data with the following third-party service providers to operate IbnaticsOS. Each is bound by data processing agreements or standard contractual clauses:

5. Cookies & Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication and security (Clerk session cookies). These cannot be disabled.
• Analytics cookies: PostHog analytics to understand product usage. These are only set after you provide explicit consent via our cookie banner.

You can withdraw analytics consent at any time by clicking "Manage Cookies" in the footer or clearing your browser's local storage. For the CCPA "Do Not Sell" right, see Section 9.

6. Data Retention

• Account data: Retained while your account is active and for 90 days after deletion
• Session data: Automatically deleted after 30 days
• Audit logs: Retained for 30 days, then automatically pruned
• Billing records: Retained for 7 years as required by Canadian tax law
• Expired invitations: Automatically deleted daily
• AI-generated content: Retained while your account is active

7. Your Rights

Depending on your jurisdiction, you have the following rights:

GDPR (EU/EEA residents)

• Right of access — Request a copy of your personal data
• Right to rectification — Correct inaccurate data
• Right to erasure — Request deletion of your data
• Right to portability — Receive your data in a portable format
• Right to restrict processing — Limit how we use your data
• Right to object — Object to processing based on legitimate interests
• Right to withdraw consent — For analytics and marketing at any time

CCPA (California residents)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising your rights

PIPEDA (Canadian residents)

• Right to access personal information we hold about you
• Right to challenge accuracy and completeness of your information
• Right to withdraw consent where processing is consent-based

To exercise any of these rights, contact us at privacy@ibnaticsos.com. We will respond within 30 days. You may also submit a deletion or export request directly from your account settings.

8. Do Not Sell My Personal Information (CCPA)

We do not sell your personal information to third parties. We share data with sub-processors solely to operate IbnaticsOS on your behalf. PostHog analytics (which may constitute "sharing" under CCPA) can be disabled by declining analytics cookies via our cookie banner or by emailing privacy@ibnaticsos.com.

9. International Data Transfers

IbnaticsOS is operated from Canada. Our sub-processors are primarily based in the United States. For transfers of EU personal data to the USA, we rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable. For enterprise customers requiring a Data Processing Agreement (DPA), contact legal@ibnaticsos.com.

10. Security

We implement industry-standard security measures including: TLS encryption in transit, AES-256 encryption at rest, CSRF protection on all state-mutating endpoints, rate limiting, audit logging with PII hashing, and regular security reviews. Payment data is handled exclusively by Stripe — we never store credit card numbers.

11. Children's Privacy

IbnaticsOS is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected such data, contact us immediately at privacy@ibnaticsos.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notification at least 30 days before the changes take effect. Continued use of IbnaticsOS after changes constitute acceptance.

13. Contact & Complaints

For privacy questions or to exercise your rights:

• Email: privacy@ibnaticsos.com
• DPO: dpo@ibnaticsos.com
• Address: Ibnatics Group, Toronto, Ontario, Canada

EU residents have the right to lodge a complaint with their local supervisory authority. Canadian residents may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.