Privacy policy
The short version
- We are Adaptiwise AI Inc., a business-to-business company in Vancouver. We build and run browser automations ("workflows") for businesses.
- For the people who sign in, we hold a name, a work email address, a username, a password we can only check and never read, and security records. We use them to run, secure and bill the service. We do not sell personal information, show advertising or build profiles.
- What a workflow reads or produces belongs to our client. We handle it only on that client's instructions, and we never use it to train AI models.
- On the Online tier everything is on our server in OVHcloud's data centre in Beauharnois, Quebec, with encrypted backups in Toronto, and the AI that plans workflows runs on that same server. On the Private and Offline tiers the work stays on the client's own computer and does not reach us, apart from the status information our optional portal carries.
- A few things can leave Canada, such as email you exchange with us and a weekly security summary sent to our monitoring service in the European Union. Planning requests go to Anthropic in the United States only if a client asks for that in writing. Section 10 lists each one.
- This website sets no cookies and runs no analytics or tracking.
- You can ask to see, correct or delete your information by writing to info@adaptiwise.com. We answer within 30 days, at no charge.
This summary helps you find your way. The full policy below is what applies.
1. Who we are and what this policy covers
Adaptiwise AI Inc. ("Adaptiwise", "we", "us" or "our") is a corporation based in Vancouver, British Columbia, Canada. We design, build, operate and support browser-automation workflows for business clients ("Clients"). This policy explains how we handle personal information, meaning information about an identifiable individual.
It covers personal information we handle through:
- this website, workflow.adaptiwise.com;
- the Adaptiwise platform: the workflow Studio, the client portal at workflow.adaptiwise.com/client and the sign-in service behind them (together, the "Platform");
- Adaptiwise software installed on a Client's own computer under our Private and Offline tiers, and the optional cloud portal available for those installations;
- email, calls and meetings with us about our services, including support.
It does not cover other Adaptiwise AI products, such as the booking product at app.adaptiwise.com, which have their own policies. It also does not cover third-party websites and services, including the websites a Client's workflows visit, which are governed by their own terms and policies.
Our services are offered to businesses only. They are not offered to consumers for personal, family or household use.
We handle personal information in accordance with British Columbia's Personal Information Protection Act and, where it applies, Canada's Personal Information Protection and Electronic Documents Act. Where the two differ, we follow the requirement that gives you more protection.
2. Our two roles
Personal information reaches us by two different routes, and our responsibility differs for each.
Where we decide: accounts, contacts, website and support
We decide what is collected, and why, about the people who sign in to the Platform ("Authorized Users"), the business contacts we deal with, visitors to this website and the people who write to us. For this information we are the organization responsible under privacy law. Sections 4 and 6 describe it.
Where we act for a Client: the content of its workflows
The workflows we run for a Client read, enter, capture and produce information in the Client's own systems and in the websites and services it asks us to automate. That information ("Client Data") can include personal information about other people, such as the Client's customers, suppliers or staff. The Client decides what its workflows do and is responsible for having the right to use that information. We process Client Data only to provide our services to that Client, on its instructions and under our agreement with it. Section 5 describes it.
If your personal information is in a Client's systems, please contact that Client first. If you write to us instead, we will refer you to the Client and, where our agreement with it allows, pass your request on and help the Client answer it.
3. What reaches us under each tier
We deliver the service in three tiers. The tier a Client chooses decides whether its Client Data ever reaches a machine we operate.
| Tier | Where workflows run and Client Data is stored | What reaches Adaptiwise |
|---|---|---|
| Online | On our server, in OVHcloud's data centre in Beauharnois, Quebec, Canada. | Everything the Platform holds for that Client, kept on that server and separated from every other Client's data. |
| Private | On a computer the Client owns and operates. | Nothing during normal operation. If the Client adds our optional cloud portal, status information is sent to our portal server in Canada: whether each run succeeded and how long it took, failure reasons recorded as codes, workflow names, descriptions and outlines, the names (never the values) of saved logins, counts of runs and approvals, and the installation's health and licence status. Page content, website addresses, page element selectors, login values and files are never sent. |
| Offline (in development) | On a computer the Client owns and operates, with no network connection. | Nothing. |
On the Private and Offline tiers, information on the Client's computer is under the Client's control, and the Client is responsible for that computer's security and backups. If a Client gives us access to its computer to install, update or support the software, we use that access only for the purpose the Client agreed to.
4. What we collect, and why
This table covers the information we are responsible for (section 2). We collect only what we need for the purposes listed.
| Information | Where it comes from | Why we use it |
|---|---|---|
| Business contact and contract details: name, job title, work email address, telephone number, company, what we discuss, contracts and invoices | You, or the business you work for | To discuss and provide our services, enter into and manage contracts, invoice, and keep business records |
| Account details: name, work email address, username, role (for example viewer, approver, operator or administrator) and the Client workspace the login belongs to | The Client that employs or engages you names you, and we create the login | To create and identify your login, show you only your own organization's information, and control what you can do |
| Sign-in details: a temporary first password, which you replace at your first sign-in, then your own password, held by our sign-in service only as a one-way hash, the two-step sign-in authenticator set up for your login where two-step sign-in is enabled, and your active sessions | You, when you set them up and sign in | To confirm that the person signing in is you |
| Security records: the time, username, IP address and outcome of each sign-in attempt, changes to accounts and settings, and requests the Platform refused | Generated automatically when the Platform is used | To protect accounts (including automatically blocking repeated failed sign-ins), and to detect and investigate misuse |
| Web request logs: IP address, time, the page or file requested (with access tokens, keys and sign-in codes removed from the address before it is written), the response, and the request headers your browser sends, such as its user-agent string and the referring page. Cookies and authorization headers are not written | Generated automatically when you visit this website or use the Platform | To keep the website and Platform secure, diagnose faults, and investigate incidents |
| Activity records: runs you start, approve or reject, changes to workflows and settings, each use of a saved login, and who did each of these | Generated when you use the Platform | To show you your organization's work, keep a reliable record of who did what, support you, and bill the Client |
| Demonstration recordings: when someone records a task to build a workflow from it, a log of the clicks, typed values, choices, uploads and pages visited, and, only if that person turns the microphone on, a text transcript of their narration | The person recording, who starts each recording deliberately and sees a recording indicator throughout | To build the workflow that was demonstrated. Password fields are never captured, the audio is transcribed on the machine that runs the workflows and then discarded, and no video is kept |
| Support communications: what you tell us by email, phone or in meetings | You | To answer you, solve problems, and keep a record of what was agreed |
| Billing records: per-run usage records (the Client, run, workflow, counts and timings) and invoices | Generated by the Platform and by us | To invoice accurately, answer billing questions, and meet our accounting and tax obligations |
Visiting this website creates only the web request logs described above. The website has no forms, sets no cookies and runs no analytics. If you write to us from it, your message is a support communication.
We do not ask for, and do not want, social insurance numbers, government identification, health information or payment card numbers. The Platform does not take card payments.
5. Information we process for our clients
Depending on what a Client's workflows do, Client Data can include:
- the content and screenshots of web pages a workflow visits, and video of a run where video is enabled;
- values a workflow extracts from or enters into websites and systems;
- files a workflow downloads or uploads, and, on the Private and Offline tiers, Word and Excel documents on the Client's computer that a workflow reads or fills;
- the logins ("credentials") the Client stores for the websites and services its workflows use;
- information a workflow sends to services the Client chooses, such as Google Sheets or ClickUp;
- demonstration recordings, which capture the systems being demonstrated as well as the person demonstrating.
Our commitments for Client Data:
- We use it only to provide, support and secure our services for that Client, on its instructions.
- We do not sell it, use it for our own marketing, combine it with other Clients' data, or use it to train or improve any AI model.
- Only people at Adaptiwise who need it to provide the service can access it, and they are bound to keep it confidential.
- We help the Client respond to requests from the people its data is about.
- We delete it on the schedule in section 11 and when the Client relationship ends.
Credentials receive particular care. They are stored on the machine where the Client's workflows run and in that machine's backups, which are encrypted before they leave it. They are never shown back on screen to anyone, are handed to a workflow only at the moment of use, and are kept out of logs. AI planning sees only a reference to a credential, never its value, and the detailed technical trace of any run that used a credential is deleted.
Clients agree not to have us process health records, payment card data or other specially regulated information unless we have agreed to it in writing.
6. How we use information, and what we never do
We use the personal information described in section 4 to:
- provide, operate, maintain and support the Platform and our services;
- authenticate users and keep the Platform, our clients and their data secure;
- send service messages, such as first sign-in details, invoices, and notices of changes to our services or terms;
- invoice and keep accounting records;
- meet legal and regulatory obligations, and establish, exercise or defend legal claims;
- improve the reliability of our services, using operational information such as run counts, durations and failure codes.
We never:
- sell, rent or trade personal information;
- share it for advertising, or use advertising or tracking technology;
- build profiles of individuals;
- use personal information or Client Data to train or improve AI models;
- make decisions about individuals that have legal or similarly significant effects based solely on automated processing.
If we ever want to use personal information for a purpose not described here, we will update this policy first and, where the law requires it, ask for consent.
7. Artificial intelligence and automated processing
The browser actions a workflow performs are deterministic: the workflow does what its definition says, and actions marked as sensitive, such as a payment or a submission, stop and wait for a person to approve them. We use AI models to plan and repair workflow steps, propose improvements to workflows, locate elements on a page, and transcribe demonstration narration.
Where the AI runs
- Online: on models running on our own server. No outside AI provider receives anything.
- Private and Offline: on models running on the Client's own computer.
The optional hosted planner
A Client may ask in writing to have its workflow planning done by a hosted model. Only then, and only for that Client, do planning requests go to Anthropic, PBC in the United States. A planning request contains the workflow's instruction, the outline of the plan and the run's status information. The Platform withholds page content, screenshots and recordings from these requests, and credentials travel only as references, never as values. Anthropic's Commercial Terms of Service state that it may not train models on customer content from its services, and Anthropic deletes what is sent to its API as itspublished retention policy describes. The opt-in is recorded, and can be withdrawn at any time, for each Client separately. Every other Client's planning stays on our server.
No automated decisions about people
AI in our services plans and carries out tasks. It does not make decisions about individuals that have legal or similarly significant effects. Any decision a Client takes using what a workflow produces is the Client's decision.
8. Cookies and browser storage
This website sets no cookies, stores nothing in your browser, runs no analytics and loads nothing from other websites. Its fonts and images are served from our own server.
The Platform uses only what signing in and working in it require:
- cookies set by our sign-in service while you sign in and while your sign-in session lasts;
- per-tab browser storage for your sign-in tokens, cleared when you close the tab or sign out;
- browser storage for preferences, such as the workspace you last chose and your display theme;
- browser storage, in the workflow Studio, for drafts of workflows you are editing and spreadsheet addresses you entered. These stay in that browser until you or your browser clear them; signing out does not remove them, so use the Studio only on a device your organization controls.
These are necessary for the service you asked for, so we do not show a consent banner. If you block them, you will not be able to sign in. The Platform uses no advertising or analytics cookies.
9. Who receives information
Our service providers
We use a small number of service providers. Each receives only what it needs to provide its service to us, and is bound by its terms to protect it and use it only for that purpose.
| Provider | What for | What it receives | Where |
|---|---|---|---|
| OVHcloud (OVH Hosting Inc.) | Hosting our servers and our backup storage | Everything stored on our servers, as their host. Offsite backups are encrypted on our server before upload, with a key only Adaptiwise holds, so OVHcloud cannot read them | Canada: the Platform server and the portal server in Quebec, backup storage in Toronto, Ontario |
| Healthchecks.io (SIA Monkey See Monkey Do, Latvia) | Alerting us when a health check, a backup or a scheduled job stops running | Check results and, once a week, a security summary of the past week, which includes: sign-ins, failed sign-ins and account changes by username and IP address; refused requests and server logins by IP address and username; operator changes; the names (never the values) of saved logins each Client's runs used; and failed runs by Client with the reason recorded, which can be the first 100 characters of an error message | European Union |
| Hostinger (Hostinger International Ltd.) | Our email at info@adaptiwise.com | Emails you send us and emails we send | Outside Canada, including the European Union and the United States |
| Our password manager's sharing service | Delivering first sign-in details through an expiring, single-use link | Your username and temporary first password, which you replace at your first sign-in | May be outside Canada |
| Anthropic (Anthropic, PBC), only for a Client that has opted in | The optional hosted planner (section 7) | Planning requests for that Client: instruction, plan outline and run status information | United States |
We will update this list before a new provider receives personal information, and Clients receive advance notice under their agreements. For example, if the optional cloud portal begins sending account emails, the email delivery provider will be added here before the first email is sent.
Others
- Websites and services a Client's workflows use. When a workflow signs in to a website or writes to a service such as Google Sheets or ClickUp, it does so on the Client's instructions, and those parties handle the information under their own terms with the Client. They are not our service providers.
- Other users in your organization. Authorized Users of the same Client see that Client's information according to their roles. No Client can see another Client's information.
- Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
- Authorities, only when the law requires it, such as under a court order or warrant. We disclose only what is required and, where the law allows, tell the Client concerned first.
- A successor business. If Adaptiwise is merged, sold or reorganized, personal information may be transferred to the successor, which must continue to protect it as this policy describes.
10. Where information is stored
Platform data, its backups and the optional cloud portal are stored in Canada (section 9). These things are stored or processed outside Canada:
- email you exchange with us (Hostinger);
- first sign-in details, while the expiring link that delivers them is open (our password manager's sharing service);
- the weekly security summary and check results (Healthchecks.io, European Union);
- planning requests for a Client that has opted in to the hosted planner (Anthropic, United States).
Information stored or processed in another country is subject to that country's laws and may be accessible to its courts, law enforcement and national security authorities.
11. How long we keep it
We keep personal information only as long as we need it for the purposes in this policy or as the law requires, and then delete it. These are the periods on the Online tier. On the Private and Offline tiers, the periods for run records, files, video, recordings, workflow definitions and usage records apply on the Client's computer, under the Client's control, and the other rows do not arise.
| Information | Kept for |
|---|---|
| Run records (what each run did, step by step) | 90 days |
| Screenshots and other files produced by runs | 90 days |
| Run video | 30 days |
| Demonstration recordings and transcripts | 90 days, or sooner if the run they belong to is deleted |
| Workflow definitions | For the Client relationship, plus 30 days |
| Account details and sign-in details | While the login is active. A login is disabled when the Client asks or the relationship ends, and deleted when the Client's data is deleted |
| Sign-in records kept by our sign-in service | 30 days |
| Records of changes to logins (who created, changed or disabled a login, and when) | 365 days |
| Security audit records | 365 days |
| Activity records | 365 days for actions recorded in the security audit, such as changes and uses of saved logins; 90 days for actions recorded with a run, such as approvals |
| Web request logs | 30 days |
| Other technical logs (the Platform's own request logs, which include IP addresses, and the server's system log) | Until overwritten when they reach their size limit; the Platform's own logs are also cleared each time it is updated |
| Weekly security summary at Healthchecks.io | Healthchecks.io keeps a limited number of recent summaries for each check, which for a weekly check can amount to about two years, and its backups for up to 2 months |
| Billing and usage records, invoices and contracts | 7 years, for accounting, tax and billing disputes |
| Business contact details and support communications | For the business relationship, plus 2 years |
| Complete export made when a Client leaves | Only until it is delivered to the Client, then destroyed within 30 days |
| Backups | Nightly snapshots on our server for 14 days, hourly database copies for 48 hours, and one encrypted offsite copy a day for 90 days. An offsite copy cannot be deleted during its first 30 days, which protects it from tampering |
| Hosted planner requests at Anthropic (opted-in Clients only) | As Anthropic's terms provide (section 7) |
We may keep specific information longer when we need it to deal with a legal claim, a regulatory requirement or a security investigation, and only for as long as that lasts.
When a Client leaves, its logins are disabled, its data is exported to it on request, and its data is then deleted from the Platform and the deletion is verified. Copies in backups expire on their own within 90 days, and web request logs within 30 days.
12. How we protect it
We use administrative, technical and physical safeguards suited to the sensitivity of the information, including:
- encrypted connections (HTTPS) for the website and the Platform;
- each Client's data kept apart by row-level security enforced in the database itself, and separate storage credentials for each Client's files;
- passwords of at least 12 characters that cannot reuse your last five, two-step sign-in available for any login, and automatic blocking of repeated failed sign-ins;
- server administration only with cryptographic keys, a firewall, automatic blocking of repeated failed server logins, and administration consoles kept off the public internet;
- role-based access, so each person sees and does only what their role allows;
- credentials handled as described in section 5;
- security records, a weekly summary of them, and monitoring that alerts us when something fails;
- daily encrypted offsite backups, protected against deletion for 30 days.
The disk of our Platform server is not encrypted at rest, a limit of the hosting product it runs on; the controls above are designed to compensate for it. No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorization.
13. If something goes wrong
If we become aware of a breach of security safeguards involving personal information we hold:
- we act at once to contain it and limit any harm;
- we tell each Client affected without undue delay, with the information it needs to meet its own obligations;
- where the breach creates a real risk of significant harm to individuals, we report it to the Office of the Privacy Commissioner of Canada and notify the individuals affected, as soon as feasible, as the law requires;
- we keep a record of every breach for at least 24 months.
To report a security problem, write to info@adaptiwise.com with "Security" in the subject line.
14. Your rights and how to use them
You can ask us:
- whether we hold personal information about you, for a copy of it, how it has been used and to whom it has been disclosed;
- to correct information that is inaccurate or incomplete;
- to delete information we no longer need or have no right to keep;
- to withdraw a consent you gave, subject to legal or contractual limits and reasonable notice.
Write to the Privacy Officer at info@adaptiwise.com. We may ask you to confirm your identity before we act, and we use what you give us for that purpose only. We answer within 30 days. If we need more time, we will tell you why within those 30 days and how long it will take, which will be no more than 30 more days. We do not charge for requests. If we cannot do what you ask, for example because the law requires us to keep the information, we will explain why and tell you how to complain.
Withdrawing consent. Some information is essential to the service. A login cannot work without a username and sign-in records, for example, and an employer's choices about the logins it asks us to create are made by the employer. If you withdraw consent, we will explain what follows before we act on it.
Information in a Client's workflows is the Client's to answer for (section 2). We will refer you to the Client and help it respond.
15. Email from us
We send service messages that are part of using our services, such as first sign-in details, invoices and notices of changes. We do not run a mailing list. If we ever send commercial messages, we will do so only as Canada's anti-spam legislation allows, identify ourselves in each one, and include a free way to unsubscribe that we honour within 10 business days.
16. Children
Our services are for businesses and the adults who work for them. They are not directed at children, and we do not knowingly collect personal information from anyone under the age of majority in their province or territory. If you believe we have, contact us and we will delete it.
17. Changes to this policy
We will post any change on this page with a new version number and date. If a change materially affects how we handle personal information, we will tell our Clients by email at least 30 days before it takes effect, unless the law requires it sooner, and ask for consent where the law requires it.
- Version 2.0, 29 October 2026. Rewritten as a complete policy: it now follows British Columbia and federal privacy law (the first draft was written for Quebec), describes the three tiers, artificial intelligence, every provider and transfer outside Canada, all retention periods, browser storage and incident handling.
- Version 1, 1 October 2026. First version, published as a draft.
18. Contact and complaints
Our Privacy Officer is responsible for our compliance with this policy and with privacy law:
Privacy Officer
Adaptiwise AI Inc.
Vancouver, British Columbia, Canada
info@adaptiwise.com (please put "Privacy" in the subject line)
If you have a concern about how we handle personal information, write to the Privacy Officer first. We acknowledge every complaint within 5 business days, look into it, and tell you what we found and what we will do within 30 days. If we find a complaint is justified, we will fix the problem and, where needed, change our practices.
If you are not satisfied with our answer, you can complain to:
- the Office of the Information and Privacy Commissioner for British Columbia,oipc.bc.ca; or
- the Office of the Privacy Commissioner of Canada, priv.gc.ca, in particular about information that crossed a provincial or national border.