Privacy Policy

Park River OS (“the Platform”) is provided to authorized Park River Management Inc. personnel and to investors who have been individually invited to the investor portal. Access is by invitation only; there is no public sign-up. This policy applies to information handled through the Platform.

• Identity and account information from your single sign-on provider (Microsoft Entra ID or Google Workspace) - typically your name, work email address, and organizational identifiers - and, for invited investors, the email address to which the invitation was sent.
• Authentication data needed to keep you signed in and to connect optional Microsoft 365 features you enable (such as your own Outlook calendar or Teams notifications).
• Content you enter into the Platform - for example projects, tasks, notes, contacts, documents, and financial figures.
• Activity and audit records - sign-in events and significant actions, kept for security and accountability.
• Basic technical data such as IP address and browser or device type, used to operate and secure the service.

We use the information above to:

• Operate, maintain, and secure the Platform and authenticate your access.
• Deliver notifications you or your administrator have configured (in-app, email, and - where enabled - Microsoft Teams).
• Maintain an audit trail and enforce role- and scope-based access controls.
• Diagnose problems and improve the reliability of the service.

We do not sell personal information, and we do not use it for advertising or for any purpose unrelated to operating the Platform for Park River Management Inc..

The Platform relies on a small number of vendors that process data on our behalf, under their own terms and security commitments:

• Microsoft (Azure / Entra ID and, where you enable them, Microsoft 365 Graph features such as Outlook calendar and Teams notifications) - sign-in and optional integrations.
• Google (Google Workspace) - single sign-on, where used.
• Supabase - database hosting.
• Vercel - application hosting.
• Resend - transactional email delivery.

These providers act as our processors and are not permitted to use your information for their own purposes.

Information is visible only to authorized users according to their role and assigned scope. Investors can see only the entities and information associated with their own invitation. We share information outside the Platform only with the service providers listed above, or where required to comply with applicable law or to protect our rights.

We protect the Platform with single sign-on, role-based access control, encryption of data in transit, and audit logging. No system can be guaranteed to be completely secure, but we take reasonable measures appropriate to the sensitivity of the information involved.

We retain information for as long as your account is active and as needed to operate the Platform, meet legal or business requirements, and maintain security and audit records. When information is no longer needed, it is deleted or de-identified.

You may request access to, correction of, or deletion of your personal information, subject to our legal and business obligations. Most account and access questions are handled by your Park River administrator. To make a request, use the contact below.

Information may be processed and stored in Canada and the United States by the service providers listed above. By using the Platform you understand that your information may be handled in those locations.

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be communicated through the Platform where appropriate.

Questions about this policy or about how your information is handled can be directed to Park River Management Inc. at privacy@parkriver.ca.