COMMARKAI1Who we are
COMMARKAI is a sole proprietorship established in Ontario, Canada, operating the website at commarkai.net and the COMMARKAI Incident Simulator service. In this policy, "we", "us" and "our" mean COMMARKAI.
Our registered mailing address is 197 Yonge St, Ste 201 #1003, Toronto, ON M5B 0C4, Canada. Our contact address for all privacy matters, including the rights described in section 9, is support@commarkai.com.
We are the controller of the personal information described in section 2. We act as a processor for the separate category of information described in section 6.
Where the service is available. COMMARKAI Incident Simulator is currently available to customers in Canada and the United States. It is not yet available in the European Economic Area or the United Kingdom. If that changes, we will update this policy before it does.
2What we collect
Information you give us
- When you join our email list: your first name, last name and email address, and, only if you choose to give them, your company, website, industry, company size and message. We also record that you ticked the consent box.
- When you create an account: your email address and password (stored only in scrambled, hashed form by our authentication provider), and whether you asked to receive product updates.
- When you save or email a run: the service and failure you chose and the simulated results of that run.
- When you subscribe: your name, email address and billing details. We never see or store your full card number. Card details are entered directly with Stripe, our payment processor, and we receive only a token, the last four digits, the card brand and the expiry.
- When you email us: the contents of your message and your email address.
Information collected automatically
Our marketing pages run no analytics, no advertising pixels and no session tracking. The app keeps you signed in using storage in your browser (see section 4). Our hosting provider records standard server logs, which include IP addresses, for security and abuse prevention.
What we do not collect
- We do not collect sensitive personal information, such as health details, identity documents or financial account numbers. Please do not include it in our forms or the simulator. If we receive it by mistake, we will delete it.
- We do not buy personal information from data brokers.
- We do not build advertising profiles, and we do not sell personal information to anyone, ever.
3Why we collect it
| Purpose | Information used | Why that is permitted |
|---|---|---|
| Sending the email list you joined | Name, email, and any optional company details you gave | Your consent, withdrawable at any time |
| Providing the service | Account and billing details | Necessary to deliver what you subscribed to |
| Taking payment | Billing details, payment token | Necessary to deliver what you subscribed to |
| Service emails (receipts, outages, changes) | Email address | Necessary to deliver what you subscribed to |
| Onboarding and product emails | Name, email | Your consent, withdrawable at any time |
| Tax and accounting records | Billing records | Required by Canadian tax law |
| Security and abuse prevention | Server logs | Our legitimate business interest in keeping the service available and secure |
We collect only what we need for the purpose stated, and we do not repurpose it later for something you would not expect. Where we rely on your consent, you can withdraw it at any time (see section 9).
4Cookies and tracking
Our marketing pages set no cookies. They use no analytics, no advertising or social media pixels, no session tracking and no cross-site tracking. That is why you are not asked to accept anything when you arrive.
The app uses strictly necessary browser storage. When you sign in at commarkai.net/app, your login session is kept in your browser's local storage so you stay signed in between pages. If you choose a plan before signing in, the plan is remembered briefly so you can be taken to checkout afterwards. Blocking this storage will stop you from staying signed in.
Checkout takes place on Stripe's own pages, where Stripe's cookie policy applies. Our fonts are served from our own site, so displaying them sends no request to Google or any other font provider.
If we ever add analytics or any other technology that stores information on your device, we will update this section and ask for your consent first where the law requires it.
5Who we share it with
We share personal information only with the service providers we need to run the business. Each is bound by contract to protect it and to use it only on our instructions. The current list is:
| Provider | What it does for us | Where |
|---|---|---|
| Netlify | Website hosting and form submissions | United States |
| Supabase | Database and account authentication | United States |
| Stripe | Payment processing and receipts | United States, Ireland |
| Systeme.io | Email list and product email | European Union |
We will also disclose information where we are legally required to: a court order, a valid request from a regulator, or to establish or defend a legal claim. If we are ever compelled to hand over your information, we will tell you unless the law forbids it.
If the business is ever sold or transferred, personal information may transfer with it. You will be told before that happens, and this policy will continue to apply until you are given notice of a new one.
6The service models you create
The service lets you model your own service topology and run simulated failures against it. The content you put into it (your systems, dependencies, owners, staffing and capacity figures, and scenarios) is your data, not ours. We never connect to your systems; we only hold what you choose to enter or send us. Please do not enter customers' or employees' personal details. The model does not need them.
For that material you are the controller and we are the processor. We process it only to provide the service to you and on your documented instructions. We do not use it to train models, we do not use it to market to anyone, and we do not disclose it to other customers.
Business customers whose own compliance obligations require a written data processing agreement, or a current list of the providers we use, can request one at support@commarkai.com.
7Where data is stored
COMMARKAI operates from Canada. The providers listed in section 5 are located mainly in the United States, with one in the European Union. Your personal information is therefore stored and processed outside Canada, and while it is there it may be accessible to the courts, law enforcement and national security authorities of those countries.
We contract with each provider to protect it and to use it only on our instructions, and we choose providers that maintain recognised security standards. We do not currently offer Canada-only data storage. If your organization needs it, contact us before subscribing.
8How long we keep it
| What | Kept for |
|---|---|
| Email list sign-ups | Until you unsubscribe or ask us to delete them |
| Saved runs | Until you delete them or close your account, then 30 days |
| Account and topology data | While your account is active, then 30 days, then deleted |
| Billing and tax records | 7 years. This is our own policy; Canadian tax law generally requires at least 6. |
| Email correspondence | 24 months |
| Server logs | As retained by our hosting provider, typically under 30 days |
You can ask us to delete your data sooner. We will do so unless we are legally required to keep it, in which case we will tell you which records we must retain and for how long.
9Your rights
You can ask us to:
- Give you a copy of the personal information we hold about you.
- Correct it if it is wrong or incomplete.
- Delete it, subject to records we must keep by law.
- Stop or limit what we do with it.
- Send it elsewhere in a structured, machine-readable format.
- Object to processing we base on legitimate interests.
- Withdraw consent at any time, where consent is what we relied on. Every marketing email carries a one-click unsubscribe.
Email support@commarkai.com. We will respond within 30 days, and we will not charge you for a reasonable request. We may need to verify your identity first, so that we do not hand your information to someone else.
Some of these rights depend on the law where you live. Where the law gives you more, that applies.
Asking about your rights will not affect your service or price. If a deletion request means we can no longer provide a feature, we will explain that before acting on it.
If you are not satisfied
You can complain to the Office of the Privacy Commissioner of Canada, which oversees compliance with Canadian federal privacy law, or to the privacy regulator in your own province. You can contact us or the regulator at any time.
10Security
- All traffic to and from our site and service is encrypted in transit using TLS.
- Card details never reach our systems. Stripe handles them directly.
- Access to production data is limited to those who need it, and protected by multi-factor authentication.
- Each customer's data is protected by access rules in the database itself, so an account can read only its own records.
No system is perfectly secure, and we will not pretend otherwise. If a security breach involving your personal information creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada as soon as feasible, as Canadian privacy law requires. We keep a record of every breach, and we will meet any stricter rule that applies where you live.
11Children
This is a business product. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If we discover that we have, we will delete it. If you believe a child has given us information, email support@commarkai.com.
12Changes to this policy, and how to reach us
If we change this policy we will update the effective date at the top. For any change that materially affects your rights, we will email account holders at least 30 days before it takes effect, so you can object or close your account first.
Questions, requests and complaints all go to the same place: support@commarkai.com, or by post to COMMARKAI, 197 Yonge St, Ste 201 #1003, Toronto, ON M5B 0C4, Canada.