Privacy Policy

Azon Labs Limited ("Azon Labs", "we", "us", "our") is a company incorporated under the laws of Ontario, Canada. We design and build agentic systems for mid-market operators. Our registered address is 1300 Cornwall Road, Oakville, Ontario, L6J 7W5, Canada.

For the purposes of applicable data protection law — including the EU General Data Protection Regulation (GDPR), the UK GDPR, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) — Azon Labs Limited is the data controller in respect of the personal data described in this policy. As data controller, we are responsible for deciding how and why personal data is processed.

For any privacy-related questions, requests, or concerns, the fastest route is privacy@azonlabs.com. Postal enquiries may be directed to the address above, marked for the attention of the Privacy Officer.

We collect two categories of personal data: information you provide to us directly, and limited technical data collected automatically when you use our website. We do not purchase or obtain personal data from third-party data brokers.

We do not use third-party advertising trackers, social media pixels, or cross-site fingerprinting technologies. We do not sell, rent, or trade your personal data to any third party for their own purposes.

Our website uses cookies — small text files placed on your device — and similar browser storage technologies. We use two categories only:

We do not use advertising cookies, social-media tracking pixels, retargeting cookies, or any technology designed to build a profile of your behaviour across third-party websites.

You can control or delete cookies at any time through your browser settings. Instructions for the most common browsers are available at aboutcookies.org. Disabling strictly necessary cookies may impair site functionality. Disabling analytics cookies will have no effect on your ability to use any feature of the site.

Where required by applicable law (for example, the EU ePrivacy Directive as implemented in relevant member states), we will ask for your consent before placing non-essential cookies.

We collect and process personal data only for specific, legitimate purposes and only to the extent necessary for those purposes. We do not use personal data for any purpose incompatible with the purpose for which it was originally collected without first obtaining your consent.

If you are a resident of Canada, our processing is governed by PIPEDA, which requires us to obtain your consent for the collection, use, and disclosure of personal information except where otherwise permitted by law. We rely on express consent for newsletter subscriptions and on implied consent or legitimate business purposes for partnership applications, playbook delivery, and website analytics.

We do not sell, rent, or trade your personal data. We share it only in the limited circumstances described below.

Azon Labs is based in Canada. The European Commission has issued an adequacy decision recognising Canada as providing an adequate level of personal data protection for commercial organisations subject to PIPEDA. Accordingly, transfers of personal data from the EU and UK to Azon Labs as data controller do not require additional transfer mechanisms under the GDPR or UK GDPR.

However, some of our third-party service providers operate infrastructure in countries outside Canada, the EU, or the UK — most commonly in the United States. Where we transfer personal data to such providers, we ensure the transfer is lawful and subject to appropriate safeguards. Safeguards we use may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our data processing agreements with relevant providers

• Adequacy decisions issued by the European Commission (for example, transfers to Canada are covered by the existing adequacy decision for commercial organisations subject to PIPEDA)

• The EU–US Data Privacy Framework (DPF) or its successor, where our providers have self-certified under that framework

• Binding Corporate Rules, where applicable to a provider's corporate group

• Supplementary technical measures such as end-to-end encryption, where appropriate to the risk level

We maintain an internal record of all cross-border transfers and the safeguards applied to each. You may request a copy of the relevant transfer safeguard documentation (such as the applicable Standard Contractual Clauses) by contacting us at privacy@azonlabs.com.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. The following retention schedules apply:

• Partnership application data — retained for as long as it is reasonable to follow up on the conversation (typically up to 12 months from the date of the last meaningful contact), and for up to three years in total for business record-keeping. You can request earlier deletion at any time.

• Agentic Ops Playbook request data — retained for as long as it is reasonable to confirm fulfilment or follow up (typically up to six months from delivery), and for up to three years for record-keeping. You can request earlier deletion at any time.

• Brief subscriber data — retained while you remain an active subscriber. On unsubscription we remove your email address from active sending lists within seven business days. We may retain a suppression record (a one-way hash of your email address) indefinitely to ensure we do not inadvertently email you again.

• Website analytics data — event-level (session) data is retained for a maximum of 24 months. After that period it is aggregated or deleted. Aggregate statistical reports derived from analytics data may be retained indefinitely, as they contain no personal data.

• General correspondence data — emails and other direct communications are retained for up to three years from the date of the last exchange, unless a longer period is required by law or the correspondence forms part of a contractual relationship.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where immediate deletion is not technically practicable — for example, because data is held in encrypted backup archives — we isolate the data from active processing and delete it as part of the next scheduled backup purge cycle.

If you request deletion of your personal data before the end of the applicable retention period, we will action that request within 30 days unless we are required or permitted by law to retain it for longer, in which case we will explain the specific legal basis for continued retention.

We implement a combination of technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. Our measures include:

• Encryption in transit — all data exchanged between your browser and our website is encrypted using TLS 1.2 or higher (HTTPS). We enforce HTTPS site-wide and use HSTS headers to prevent protocol downgrade attacks.

• Encryption at rest — personal data stored by our service providers is encrypted at rest using industry-standard algorithms (AES-256 or equivalent).

• Access controls — access to systems and data is restricted on a need-to-know basis. Administrative accounts require strong, unique credentials and multi-factor authentication.

• Data processing agreements — we execute written data processing agreements with all third-party providers that process personal data on our behalf, contractually obligating them to protect that data and to process it only as instructed.

• Principle of least privilege — service accounts and integrations are granted only the minimum permissions required to perform their function. Permissions are reviewed periodically.

• Vendor due diligence — we evaluate the security posture of prospective service providers before engaging them and monitor for significant changes during the relationship.

• Incident response — we maintain a documented process for identifying, containing, and notifying affected parties in the event of a personal data breach, consistent with our obligations under GDPR Article 33, UK GDPR, and PIPEDA.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security. We encourage you to use a strong, unique password for any accounts you hold and to keep your own devices and browsers up to date.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and, where required, will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with our obligations under GDPR Article 33 and Article 34.

Depending on where you live and the applicable data protection law, you have specific rights regarding your personal data. We are committed to honouring these rights regardless of your jurisdiction. To exercise any right, please email privacy@azonlabs.com. We will acknowledge your request within five business days and provide a substantive response within 30 days. We will not charge a fee unless a request is manifestly unfounded or excessive, in which case we will explain the basis for any fee before proceeding.

To protect your privacy and security, we may need to verify your identity before actioning a request. We will only ask for information that is reasonably necessary to confirm you are the person to whom the data relates.

Residents of other jurisdictions may have additional or different rights under their applicable local law. We will endeavour to accommodate reasonable requests regardless of jurisdiction, in line with our commitment to responsible data stewardship.

Our website and services are directed exclusively at businesses and business professionals. They are not intended for use by, and we do not knowingly solicit or collect personal data from, anyone under the age of 16.

If you have reason to believe that a child under 16 has submitted personal data to us without appropriate parental or guardian consent, please contact us immediately at privacy@azonlabs.com. We will investigate and, where confirmed, delete the data promptly and take steps to prevent recurrence.

Our website may contain links to third-party websites, applications, or services that are not operated by us. These links are provided for your convenience and reference only. When you click on a third-party link, you will be directed to that third party's site and will be subject to their privacy policy and terms.

We have no control over, and assume no responsibility for, the content, privacy practices, or data-handling of any third-party site or service. The inclusion of a link on our website does not imply our endorsement of, or any association with, the linked site or service.

We encourage you to review the privacy policy of every website you visit before submitting any personal information.

We may update this policy from time to time to reflect changes in our data practices, the services we offer, the technology we use, applicable legal or regulatory requirements, or other factors. The "Last updated" date at the top of this page will always reflect the date of the most recent revision.

For non-material changes — such as minor clarifications of existing language or administrative updates — we will update this page without additional notice beyond the revised date.

For material changes — those that significantly affect your rights, the categories of data we collect, the purposes for which we use it, or the parties with whom we share it — we will provide at least 14 days' advance notice via a prominent notice on this page and, where you are a Brief subscriber, by email to the address you have provided. The effective date of material changes will be stated clearly.

Your continued use of our website or services after the effective date of any change constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you should stop using our services and, where applicable, contact us to request deletion of your personal data.

If you have any questions, concerns, or requests relating to this policy or to how we handle your personal data, please contact us:

Email: privacy@azonlabs.com
Postal address: Privacy Officer, Azon Labs Limited, 1300 Cornwall Road, Oakville, Ontario, L6J 7W5, Canada

We aim to respond to all privacy enquiries within five business days. Complex requests — such as subject access requests — will receive a substantive response within 30 calendar days. If we need more time, we will notify you of the extension and the reason for it within the initial 30-day period.

If you are in the EU or UK and are not satisfied with our response, you have the right to escalate your complaint to your local data protection supervisory authority. In the UK this is the ICO at ico.org.uk. In Canada, you may contact the Office of the Privacy Commissioner at priv.gc.ca.