Privacy

1. About the examples

Nebula Mutual, Nebula Gulf Bank, Nebula Regional Health and Northline Advisory are fictional institutions constructed for illustration; any resemblance to a real organization is unintended. They come from the Nebula case universe, a set of fictional institutions. People are shown as roles (CRO, data lead, actuary, CISO, practitioner), never as names. Vendor names such as Corvane, Verrick, Meridian Language Systems and Northlight are fictional too. Regulators and instruments are real. Each status comes from the corpus with the date it was checked; the GCC rows are re-checked before launch.

2. Who we are

GovernanceOS by iSystematic Inc., Canada-based. [Placeholder: legal entity details and privacy officer contact.]

3. What we collect

For practitioners: email address, name, role, country and billing details where a card is used. For people who write to us through Contact: name, work email, organization, topic and message, used only to reply. For institutions: what the institution's identity provider sends at sign-in. [Placeholder.]

4. What we never collect

Payloads from your AI systems. The Boundary Gateway sends proofs, never payloads. [Placeholder.]

5. Analytics and campaign tracking

The public pages and the product screens use Google Analytics 4 to count visits, the steps people take and which campaigns brought them. The examiner's pages and the Verify a pack page carry no analytics. Analytics loads a few seconds after the page, or at your first interaction. It never receives names, email addresses, record identifiers or hashes.

The readiness check sends only that it was started and finished. Your answers and your result are never sent.

Two first-party items, gos_ft and gos_lt, keep the first and the latest campaign that brought you, for 90 days; Google Analytics sets its own _ga cookies. If your browser sends Global Privacy Control or Do Not Track, analytics does not load at all, and nothing is stored in your browser for it. Analytics runs only on governanceos.si, and the page address it receives carries no search, code or title you typed.

How-to videos in the guides that come from an outside host load only when you press play; until then, that host receives nothing from the page.

Kept in your browser only, never sent: your readiness result (gos-readiness), until you clear it, the Fit Call you booked in the open tab (gos-fitcall), so the confirmation preview can show it, the library document you chose (gos-lib-carry), for 30 days, so it opens once your access is approved, and, during sign-up, whether you asked to be listed and the role you chose (gos-listing, gos-role), for that tab only. If you install GovernanceOS as an app, the pages you open are kept on your device so they open without a connection; the address of a page is kept without anything you typed into it, and downloads are never kept. [Placeholder: legal basis per jurisdiction, retention set in Google Analytics, and how to object.]

6. Where it is held

In Canada for GovernanceOS Cloud; in the institution's own account for VPC. [Placeholder.]

7. How long we keep it

[Placeholder: retention per category, and the 90-day rule for frozen practitioner workspaces.]

8. Your rights

[Placeholder: access, correction and deletion requests, and how to make them.]

9. Job applications

An application is used only to consider you for the role you choose, and only the staff role that hires can see it. We ask for your name, email, the role, your résumé and whether you are legally entitled to work in Canada; everything else is optional. We never ask your age, date of birth, SIN, photo, marital or family status, origin, health or pay history.

An application is kept for 12 months after a decision, then deleted. If you also ask to be kept in mind for future roles, it stays in that pool for up to 12 months. No AI ranks or screens applications. Résumés are scanned before anyone opens them. You can ask to see, correct or withdraw your application at any time through [privacy contact, a role address].

10. Directory listings

Only the fields you choose are published; each starts hidden. A listing is public and can be indexed by search engines and AI crawlers. Your email and the source we check you against are seen only by the Directory editor and are never shown.

An application that is not approved is deleted after 6 months. When you unlist, the listing goes offline within 2 business days and is deleted within 30; we keep only the record of your consent and its removal, for 2 years. Relay messages are kept for 30 days.

11. Bot protection

Our contact forms use Cloudflare Turnstile to stop bots and spam, without a puzzle. To tell a person from a bot it reads your browser's signals: your IP address, a technical signature of your browser's secure connection (TLS), your browser's user agent, and the site you are on. We use its result only to accept or refuse the form. Cloudflare processes these signals for us, and also uses them, as a controller, to improve its bot detection. Cloudflare states the purpose is not to identify, profile or target anyone. The signals may be processed outside Québec and Canada, including in the United States. [Retention, the transfer assessment and whether consent is needed are set with counsel before launch.]

12. Credential candidates

If you take the certification path, we collect your name, your work email, your country, your answers and practical work, your result, your attempts and your credential’s status. A request for an accommodation is kept apart from your results and seen only by the people who arrange it.

We never collect your religion, an identity document number or image, biometrics such as face geometry, or recordings. There is no webcam proctoring. Your identity is checked live and briefly; we keep only the date it was checked. A person, not a program, decides every result, and you can appeal it.

Assessors see your work and result. Someone checking a credential sees what its ID shows: your name, the credential, its level, its dates and its status.

[Retention: answers until appeals close; the credential record for its validity plus a period set with counsel. The exam-delivery provider, where data is held and any transfer outside Canada are named before launch.]

Data is stored in Canada. [Draft for counsel.]

13. Enrollment waitlist

The enrollment waitlist on the certification page keeps your email and the role you chose, only to send you one email when enrollment opens. Then both are deleted. Data is stored in Canada.

14. Invitation requests

At launch, practitioners join by invitation: at the last step of sign-up you ask for an access code. With your request we collect the link to your LinkedIn profile, your firm or practice if you name one, and, from your sign-up, your name, your email, your role and the country you work from; we also collect the sectors and rules you work with, what you will use GovernanceOS for, how many clients you expect, and, if you tell us, how you heard about us. We ask you to name no client.

We use these details only to decide your request and to stop abuse. A person on our staff decides every request; no program accepts or declines one. That person opens your LinkedIn profile once, in a browser, to confirm your name, role and practice. We do not sign in to LinkedIn for you, use its API, or copy your profile.

If we approve, we email you a single-use code that works only for your address, and your request is kept with your account. If we decline, we email you the reason; you can ask for a second review by a different person. A declined or unanswered request is deleted 6 months after the decision. Each decision, and each time a request is opened, is written to our staff audit log.

Only the staff who review requests can see them. Data is stored in Canada. You can see, correct or withdraw your request at any time through [privacy contact, a role address].