Privacy

Privacy Policy

What information Studio Zero handles, why, where it is kept, who can see it, and your rights, in Canada and the United States.

1. Who we are, and your role

Studio Zero ("we", "us") provides an online operating system where organisations manage work: tasks, phases, group chat, comments, files, sheets (such as RFIs, submittals and change requests), schedules, financial figures, and people. This policy explains what information that involves and what we do with it.

There are two roles, and they matter. When an organisation (a company, school, public body or family) opens a workspace, it is the Customer, and it decides who is added and what goes in. For the information the Customer and its people put into the workspace, the Customer is responsible for it and we process it on the Customer's behalf. For our own business, such as a billing contact, how people use our website, and security records, we are responsible for it.

2. What information is involved

• Account details: an email address and a password (the sign-in; the password is stored only as a one-way hash), a mobile number, a name, a role, and a photo if the person adds one.
• Work content: tasks and their phases, comments, group and one-to-one chat, files and drawings, sheet entries, schedules and financial figures.
• Activity and time: what was done and when (for example a task added or a phase completed), time worked where a person records it, and the figures built from these (team activity, key figures).
• Technical and security records: sign-in events, device and browser type, and error reports, kept so the service works and can be protected.
• Billing: a billing contact and the plan (seats, price, next payment). Cards are handled by our payment provider; we never see or store full card numbers.
• Information about children: only where a school or family Customer adds students or children (see section 8).

2a. The phone app

The phone app collects only what it needs to work:

• the person's email address and account, to sign them in and show the right organisation's workspace;
• the messages, comments and files the person sends or attaches in it;
• a push-notification token, so we can alert the person to new messages and updates. Notifications can be turned off at any time in the phone's settings.

The phone app does not track anyone across other apps or websites, does not collect location, does not include the AI assistant or send anything to an AI provider, and does not show advertising or share information with advertisers.

2b. Cookies and browser storage

Studio Zero keeps only what it needs in your browser, so the service works:

• your sign-in, so you stay signed in on that device until you sign out;
• your settings, such as theme, language and the last screen you were on;
• a recent copy of your workspace, so it opens quickly and keeps working through a dropped connection.

We do not use cookies or similar technology for advertising or analytics, and we do not track you across other websites or apps. Because this storage is strictly necessary to give you the service you asked for, it does not need separate consent. You can clear it at any time in your browser's settings; you will then be signed out on that device.

When you pay, you do so on Stripe's checkout page, which uses its own cookies under Stripe's privacy policy. If we ever add analytics or advertising measurement, we will update this policy first and ask for your consent where the law requires it.

2c. Our Instagram and Facebook accounts

When you comment on, or send a message to, Studio Zero's own Instagram account or Facebook Page, Instagram or Facebook gives us what you sent and your public username or page-scoped ID. We use it only to answer you: for example, when you comment "demo" we reply with a link to our demonstration, publicly under your comment or in a private message, and may send one follow-up a few days later. We do not use it for advertising, we do not sell or share it, and we never use it to build a profile of you.

We keep these comments and replies for up to 12 months, then delete them. To have them deleted sooner, email info@studio-zero.ca or follow the steps at studio-zero.ca/delete-account. Your use of Instagram and Facebook themselves is covered by their own privacy policies.

3. Why we use it

To run the workspace the Customer asked for; to keep it secure and fix problems; to back it up; to bill; to give support; to improve the service in general, without using Customers' content to train AI models; and to meet legal duties. We do not sell personal information, and we do not show advertising inside workspaces.

4. The AI assistant

The assistant reads the text a person gives it, or that the workspace shows it, in order to answer. It processes text only when it is used. It informs; people decide. It must not be used on its own to hire, promote, discipline or dismiss anyone. Our AI provider does not use Customers' data to train its models.

5. Where it is kept, and who helps us run it

• Hosting is provided by Cloudflare, on servers currently in the United States. Data is encrypted while it travels and while it is stored.
• Each Customer's data is kept in its own database, separate from every other Customer's.
• Our AI provider processes text only when the assistant is used. Payments are handled by Stripe.
• We publish the full list of companies that help us process data, what each does and the country it works in, and we give Customers notice before adding one. They are:
  • Cloudflare (United States): hosting, storage, backups, and the translation of text between languages.
  • Our AI service provider (United States): the AI assistant, only when a User uses it. A Customer can ask us for its name.
  • Stripe (United States and Canada): payments.
  • Microsoft (Canada and United States): sends the invitation and waitlist confirmation emails from info@studio-zero.ca. Only the recipient's name, email address and company name pass through it.
• Where data leaves the country it came from, we use the safeguards that country's law requires. For example, before personal information leaves Quebec, a Quebec Customer carries out the privacy impact assessment required by section 17 of Quebec's Act respecting the protection of personal information in the private sector (CQLR c P-39.1, as amended by Law 25), and we provide the information it needs.

6. Who can see a workspace

• A Customer's own people see what that Customer's settings and roles allow. Guests (clients, consultants, contractors) are invited to one job and see only what the administrator allows there.
• Our platform owner account can open any workspace to support it, repair it or investigate misuse. Every entry is recorded, and a Customer can ask us for the record of entries into its workspace.
• Our other staff have access only where they need it to run or repair the service, and that access is logged.
• We disclose information to others only where the Customer tells us to, the law requires it, or it is needed to protect people.

7. How long we keep it

• Customer content stays for as long as the Customer has a workspace. Deleted items are first hidden and kept so that a mistake can be undone; a Customer who needs information permanently erased asks us and we do it.
• Removing a person. A Customer's administrator can remove or disable a person in People & Access at any time, which ends their access at once.
• Deleting your own account information. Write to info@studio-zero.ca (or follow the steps on Delete your account) and we delete your personal account information within 30 days, except what the law requires us to keep. If a Customer added you, we work with that Customer to do it.
• When a Customer leaves. After its agreement ends we keep its data for 30 days, in case it comes back, and then delete it permanently, including from our nightly backups as they expire (they are kept 30 days) and from our monthly archive copies.
• Billing records are kept as long as tax and accounting law requires. Security records are kept for a limited period.
• When an agreement ends, the Customer can ask for its data back within those 30 days, and we provide it in a standard format.

8. Schools, children and families

Where a school or an organisation working with students uses the workspace, the school (or the parent, for a family workspace) controls the accounts and the children's information, and we act on their instructions. We do not market to children or inside school workspaces, we use no advertising or tracking pixels in the app, and we do not use students' information for anything other than providing the service. Schools remain responsible for their own legal duties, including those in:

• United States: FERPA, COPPA, and state student-privacy laws.
• Canada: the school's provincial privacy law (for example Ontario's MFIPPA, and Quebec's Law 25).

Parents can ask the school to see, correct or delete their child's information, and we help the school do so.

9. Employers and employees

Where an employer uses the workspace, the employer is responsible for telling its own employees, in writing, what is collected and how it is used (including task and activity figures, time figures, and any AI notes), as the law of their place requires. The employer does this in its own employment agreement or by written confirmation. We do not supply that notice and are not responsible for it. The assistant and the figures must never be used to infer a person's health, mental state or any protected characteristic.

10. Your rights

Wherever you live, you can ask to see, correct or delete your personal information, or object to how it is used. In Canada, access and correction under your province's law and PIPEDA; in the United States, the rights of your state (for example California, Colorado and others).

• If a Customer put your information in, send the request to that Customer; we help them answer it.
• If the information is ours (a billing contact, for example), write to us and we answer directly.
• You will not be treated worse for using a right.

11. Security, and if something goes wrong

We encrypt data, keep each Customer's data separate, log staff access, back up nightly, check that data is complete and consistent, and test changes before they reach you. If personal data is accessed without permission, we tell the affected Customer without undue delay and within 72 hours, and help them meet their own notice duties. In Quebec, an incident that presents a risk of serious injury is reported promptly to the Commission d'accès à l'information and to the people concerned, as section 3.5 of that Act requires, and we help the Customer do so. Our incident process is owned by the Studio Zero Privacy Officer (info@studio-zero.ca): we contain the problem, assess the risk, tell affected Customers without undue delay, report to the regulators where the law requires it, and keep a record of every incident. Please report security problems to info@studio-zero.ca.

12. Messages we send

Service messages (sign-in, welcome messages, and notifications you turn on). Marketing only to people who agreed to it, with a way to unsubscribe, and never to children or inside a school workspace.

13. Changes to this policy

We will tell Customers before a change that matters. The date at the top shows the latest version.

14. Contact

1548705 B.C. Ltd., operating as Studio Zero, a company registered in the Province of British Columbia, Canada, 351 Copper Drive, Britannia Beach, BC V8B 1C5, Canada. Privacy contact: info@studio-zero.ca. Privacy officer: Studio Zero Privacy Officer, info@studio-zero.ca. Under Quebec's private-sector privacy Act (section 3.1), the person with the highest authority in the company is the person in charge of protecting personal information unless that role is delegated in writing, and that person's title and contact details are published here.