How we handle personal information.

Who we are

Verarbo ("we", "us") runs the services sold under the Verarbo brand and operated under the x10sibility brand, and publishes the Semantic Types site. Questions about privacy go to privacy@x10sibility.com.

Two roles

For your organization's data, we act for you. Everything your organization puts into its tenant - parts, suppliers, documents, the people in them - is yours. We store and process it only to provide the service under our agreement with you, and only as you instruct.

For a few things, we decide. Your sign-in identity, how you use the service, support conversations, and visits to our websites. This policy is mainly about these.

What we collect

• Sign-in: your account id, email address, name and profile photo, as Google or Microsoft confirm them for you (see the next section). We never receive or store your password.
• Membership: which organizations you belong to, your roles there, and who invited you.
• Security and service logs: request times, ids, IP addresses and errors. Logs carry ids, not names or the values you enter.
• Support: what you send us by email.
• Websites: verarbo.com, x10sibility.com and semantictypes.com set no cookies and run no analytics or tracking scripts. Hostinger, which hosts the three sites, and Cloudflare, which sits in front of x10sibility.com and the app, process IP addresses and request logs to deliver the pages and protect them from attacks.

Signing in with Google or Microsoft

When you choose Sign in with Google (or Microsoft), the app named SFW asks only for your basic profile: the scopes openid, email and profile. It does not ask for access to Gmail, Drive, Calendar, contacts or any other Google or Microsoft data.

• What we receive: your Google (or Microsoft) account id, your email address and whether it is verified, your name, and the address of your profile photo.
• How we use it: only to sign you in, to match you to the invitation your organization's administrator sent, and to show your name and photo to you and the people in your organization.
• Who we share it with: no one, except the hosting provider that stores it for us (DigitalOcean, Toronto). We don't sell it, don't use it for advertising, don't send it to the AI assistant and don't use it to train AI models.
• How long we keep it: while your account is active, then deleted within 30 days. To have it deleted sooner, write to privacy@x10sibility.com.
• Removing access: you can remove the app's access at any time from your Google Account (myaccount.google.com/permissions) or your Microsoft account; you then can't sign in until you grant it again.

Verarbo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use it

• To run, secure and repair the service, and to sign you in.
• To answer support requests and tell you about changes that affect you.
• To meet legal obligations.

We don't sell personal information, and we don't use it for advertising.

Your organization's people

Personal data inside a tenant belongs to the organization that holds the contract with that person. Our staff see it masked. Seeing it unmasked needs the organization's grant, with a reason, for a limited time, and is logged where the organization can see it. If you are an employee, supplier contact or other person in a customer's tenant, please contact that organization first; we'll help them answer you.

AI assistance

If your organization uses the assistant, the question and the data needed to answer it are sent to Anthropic in the United States. Personal fields are masked unless your organization's contract allows otherwise. Under our agreement with Anthropic, this data is not used to train models.

Where it's stored

The service's data is stored in Canada, in DigitalOcean's Toronto data centre. Cloudflare (global) delivers and protects the app's traffic and x10sibility.com; Hostinger hosts the three public websites, which hold no customer data; Anthropic (United States) only as described above. The current list of subprocessors is on the trust page. Where data is processed outside Canada, it is protected by contract.

How long we keep it

• Sign-in and membership: while your account is active, then deleted within 30 days.
• Security and service logs: 90 days.
• Your organization's data: for the term of the agreement; after it ends, available for export for 30 days, then deleted. Backups expire within 35 days after that.
• Support emails: 2 years.

Your rights

You can ask what we hold about you, ask us to correct it, or withdraw consent where we rely on it. Write to privacy@x10sibility.com; we answer within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

Security

How we protect data, and what is in place today, is on the trust page. If we learn of a breach that affects your information, we'll tell you and the authorities as the law requires.

Changes

We'll post changes here and update the date above. For a material change, we'll tell customers' administrators by email first.