Privacy Policy

SummitOS by NEXORA Technologies Inc. | Status: Draft Prepared for Owner / Legal Review | Date: August 27, 2026

1. Introduction & Scope

NEXORA Technologies Inc. ("NEXORA", "we", "us", or "our") provides this Draft Privacy Policy to describe how personal and business information is collected, used, and protected when utilizing SummitOS (the "Service"). This draft has been prepared for owner and legal counsel review with Canadian privacy considerations under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the Alberta Personal Information Protection Act (PIPA).

2. Information We Collect

We collect information strictly necessary to operate, maintain, and deliver SummitOS to your organization:

Account & Registration Details: Company name, administrator name, business email address, and billing interval.
Operational Business Data: Client contact records, project estimates, work orders, material SKU catalogs, purchase orders, and invoices created within your workspace.
Authentication Data: User email addresses, salted password hashes (managed via Supabase Auth), session tokens, and access logs.
Billing & Payment Metadata: Stripe customer IDs, subscription status, billing period dates, and transaction receipts. SummitOS does not store or process raw credit card numbers or CVVs.
Technical & Telemetry Data: IP addresses, browser user-agent headers, and application error logs.

3. How We Use Your Information

We use collected data solely for the following purposes:

To provision, authenticate, and maintain your organization's isolated tenant workspace.
To calculate accurate material pricing, estimate margins, and generate procurement documents.
To process recurring subscription charges via Stripe Billing.
To dispatch essential transactional emails (invitations, password resets, and critical billing notices).
To protect our infrastructure against DDoS attacks, brute force attempts, and unauthorized data extraction.

4. Third-Party Subprocessors

We engage trusted, enterprise-grade cloud service providers to support our operations under strict confidentiality and security agreements:

Stripe, Inc.: Payment processing, customer portal, and recurring billing (PCI-DSS Level 1 certified).
Supabase, Inc. (AWS): Cloud PostgreSQL database hosting, Row-Level Security (RLS) enforcement, and user authentication.
Resend / Transactional Mailer: Delivery of account invitations and password recovery links.

5. Multi-Tenant Data Isolation & Security

SummitOS enforces strict cryptographic and database-level multi-tenant isolation. Every customer workspace is partitioned by a unique tenant_id enforced by PostgreSQL Row-Level Security (RLS). No customer workspace can query, access, or view another organization's estimates, clients, or supplier pricing feeds.

6. Data Retention and Deletion

We retain your workspace operational data for as long as your subscription remains active. Following subscription cancellation, your data is retained in a secure, read-only state to permit reactivations or historical accounting audits. You may request permanent deletion of your organization's data at any time by contacting our Privacy Officer.

7. Your Privacy Rights

Under Canadian privacy legislation (PIPEDA / PIPA), you have the right to: (a) request access to the personal information we hold about you; (b) request correction of inaccurate or incomplete records; and (c) withdraw consent to data processing (subject to legal or contractual restrictions). To exercise these rights, please contact our Privacy Officer.

8. Contact Our Privacy Officer

If you have questions or concerns regarding our privacy practices, please contact:
Privacy Officer
NEXORA Technologies Inc.
Calgary, Alberta, Canada
Email: privacy@nexorayyc.io