1. Who we are and our accountability
Codex Giga Technologies (operating entity — confirm registered name) operates Codex Giga AI Business Platform. We are accountable for personal information under our control in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law. Our Privacy Officer can be reached at privacy@codexgiga.app.
For information about your own clients that you upload, you are the organisation responsible for that information and we act as your service provider, processing it only on your instructions.
2. Information we collect
- Account information: name, email address, password hash, language, authentication provider (including Google sign-in identifiers), and role.
- Workspace information: business name, industry, address, currency, tax settings, logo and branding.
- Customer Content: clients, contacts, quotes, invoices, payments, purchase orders, contracts, tasks, documents, photographs, blueprints and walkthrough videos you upload or create.
- Billing information: plan, subscription status, trial history, invoices and payment status. Card numbers are collected and stored by Stripe, not by us.
- Usage and metering data: counts of AI messages, takeoffs, estimates and storage consumed.
- Technical data: IP address, device and browser type, timestamps, error reports and security logs.
- Support communications you send us.
3. Why we collect it and our legal basis (consent)
We identify our purposes at or before collection and rely on your consent, which is express where you tick a box or submit a form and implied where the purpose is obvious and the information is not sensitive. Our purposes are:
- To create and operate your account and workspace.
- To provide the features you request, including AI estimating and drafting.
- To take payment, manage subscriptions, enforce usage allowances and prevent duplicate free trials.
- To secure the Service, detect fraud and abuse, and keep audit logs.
- To provide customer support and send service notices.
- To improve reliability and performance using aggregated or de-identified data.
- To comply with legal, tax and accounting obligations.
We do not use personal information for advertising, profiling for marketing, or automated decisions producing legal effects. You may withdraw consent for non-essential uses at any time, subject to legal or contractual restrictions; withdrawing consent for essential processing means we can no longer provide the Service.
4. AI processing
When you use an AI feature, the relevant content — your prompt and any photo, blueprint, document text or video frames you submit — is transmitted to our AI model providers to generate a response. Providers process the content to return the output and under our agreements do not use it to train their foundation models. Do not submit information you are not permitted to disclose to a processor, and avoid submitting health information, government identifiers or other sensitive data in AI prompts.
5. Disclosure to service providers
We disclose personal information only as needed to operate the Service, and require comparable protection by contract:
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe | Subscription payments and billing portal | Name, email, billing address, payment status |
| Cloud hosting, database and file storage provider | Running the app and storing your workspace data | All Customer Content and account data |
| AI model providers | Generating estimates, takeoffs, drafts and analysis | Content submitted to an AI feature |
| Email delivery provider | Account, billing and service emails | Name and email address |
| Error and security monitoring | Diagnosing faults and detecting abuse | Technical logs, IP address |
We may also disclose information where required by law, to enforce our Terms, to protect the rights or safety of a person, or in connection with a merger or sale of assets (with notice, and subject to equivalent protection).
We do not sell, rent or trade personal information.
6. Transfers outside Canada
Some providers store or process data outside Canada, including in the United States and the European Union. While outside Canada, information may be accessible to foreign courts, law enforcement and national security authorities under the laws of those jurisdictions. We use contractual safeguards requiring a comparable level of protection to that required under PIPEDA. Contact our Privacy Officer for information about our policies on transborder processing.
7. Retention
- Account and workspace data: kept while your account is active and for 30 days after termination, then deleted or irreversibly anonymised.
- Raw walkthrough videos: automatically deleted 90 days after upload; the estimate and its analysis are retained. Videos you mark 'keep permanently' are retained until you delete them or the account closes.
- Billing and tax records: retained for 7 years as required by Canadian tax law.
- Security and audit logs: retained up to 12 months.
8. Safeguards
We apply safeguards proportionate to sensitivity: encryption in transit (TLS) and at rest, row-level database isolation so a workspace can only reach its own records, hashed credentials, least-privilege administrative access, signed webhook verification, and audit logging. No system is perfectly secure; if a breach creates a real risk of significant harm we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and will keep breach records.
9. Your rights
- Access: request a copy of the personal information we hold about you and an account of its use and disclosure.
- Correction: ask us to correct inaccurate or incomplete information.
- Portability: export your workspace data in a machine-readable format.
- Deletion: ask us to delete your account and content, subject to legal retention.
- Withdraw consent: for optional processing and non-essential communications.
- Complain: to us first, and then to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Send requests to privacy@codexgiga.app. We verify identity before acting and respond within 30 days, or explain any permitted extension. Access is free in ordinary cases; we will tell you in advance if a nominal cost applies. If your request concerns information held in a business's workspace, we will direct it to that business.
10. Children
The Service is not directed to children and is only for users aged 18 and over. We do not knowingly collect information from children; if we learn we have, we delete it.
11. Cookies and similar technologies
See the Cookie Policy for what we store on your device and how to control it.
12. Changes
We will post any change here with a new 'last updated' date and, for material changes, notify you by email or in-app notice before it takes effect. Last updated: August 21, 2026.
Contact us
Questions about this document can be sent to our Privacy Officer at privacy@codexgiga.app. We answer written enquiries within 30 days.
- Operator: Codex Giga Technologies (operating entity — confirm registered name)
- Address: Registered business address, Ontario, Canada (to be confirmed)
- General support: support@codexgiga.app
- Privacy and access requests: privacy@codexgiga.app (attention: Privacy Officer)
- Billing: billing@codexgiga.app