Privacy Policy
Your privacy is important to us. This policy explains how we collect, use, and disclose information through Olambus under Canadian law.
This Privacy Policy does not apply to any third-party websites, services, or applications, even if accessible through our Service.
This policy describes how Olambus (“we,” “us,” or “Olambus”), operating under the laws of Canada, collects, aggregates, stores, safeguards, and uses personal information provided by users through our website at www.olambus.com(the “Site”), our application, APIs, and related services (collectively, the “Service”), as well as information collected through other means, including email, support requests, or offline communications.
This policy explains:
- What information we collect
- How we use the information we collect
- How long we retain information we collect
- How we use AI to process data, and the safeguards we apply
- Choices you can make about how your information is collected and used
- How we protect personal information
- Your rights under Canadian privacy law
By using the Service, you consent to the practices set out in this Privacy Policy. In this policy, “personal information” and “personal data” are used interchangeably.
This Privacy Policy does not apply to information we process as a service provider on behalf of our customers (that is, Content uploaded to the Service for analysis). Our processing of that data is governed by our Terms of Service and by your own instructions and applicable law. If you have concerns about personal information that an Olambus customer has uploaded about you, please contact that customer directly; we act on their instructions with respect to that data.
This Privacy Policy also does not apply to any future Olambus employees, independent contractors, or job candidates, who will be covered by a separate notice if applicable.
Information we collect
Information you provide to us
Olambus collects information you choose to provide through the Site or other channels — for example, when you create an account, join our waitlist, or contact support. This may include your email address, optional full name, and profile information from Google if you choose to sign in with Google. When you subscribe to a paid plan, billing and payment details are collected and processed by Stripe; we store your Stripe customer and subscription identifiers but do not store full payment card numbers on our own servers.
Information we automatically collect
We use cookies and similar technologies to maintain your session and to collect certain information automatically when you visit the Site or use the product. Authentication cookies (for example, access and refresh tokens stored as HttpOnly cookies) keep you signed in. We may also collect technical information such as browser type, operating system, and IP address, as well as usage information such as pages visited, features used, and session duration.
Analytics tools
When enabled in our environment, we use product and website analytics tools — including PostHog, Google Analytics, and Google Tag Manager — to understand how the Service is used and to improve it. These tools may set cookies or use similar identifiers in your browser. Analytics are optional and may be disabled in some deployments. You may adjust your browser settings to limit this tracking or decline cookies, though doing so may limit certain features of the Site. Some browsers send “do-not-track” signals; because there is no accepted standard for how sites should respond, we do not currently take action in response to these signals.
Payment information
Paid subscriptions and credit top-ups are processed through Stripe. Stripe collects and stores payment card and billing details according to its own privacy policy. We receive limited billing metadata (such as customer and subscription IDs) needed to manage your plan and do not store full payment card numbers on our own servers.
How we use information we collect
We use the information you provide in a manner consistent with this Privacy Policy and applicable Canadian law. If you provide personal information for a specific reason — for example, to contact support — we use it to fulfill that purpose. If you provide personal information to create an account, we use it to give you access to the Service and to administer your account.
We may also use your personal information, and other non-identifiable information collected through the Site, to improve the content and functionality of the Service, better understand our users, and communicate with you about features, updates, or offers we believe may interest you, where permitted by applicable anti-spam law (see “Your choices” below). We may create aggregated, de-identified data from personal information and use or share that de-identified data for lawful business purposes; we do not attempt to re-identify such data except to test whether our de-identification processes are effective.
We identify these purposes at or before the time personal information is collected, consistent with PIPEDA's accountability and purpose-identification principles, and we do not use personal information for materially different purposes without your consent, unless permitted or required by law.
How we use AI to process data
Certain features of the Service use artificial intelligence, including third-party large language model (“LLM”) APIs operated by Cerebras, to help you clean, transform, query, explain, and generate reports from data you upload to the product. When you use AI Features, relevant portions of your Content (such as column names, data samples, schema metadata, and your prompts) may be transmitted to Cerebras for processing.
- No training on your Content. We do not use your Content to train machine learning or AI models, and we contractually require our AI providers not to use your Content to train their general-purpose models, where we are able to restrict this.
- Credit-metered AI Features. AI-assisted cleaning, SQL and script generation, assistant chat, data explanation, and report generation consume Credits as described in our Terms of Service.
- Human review. Where the product offers preview-before-commit workflows (for example, AI clean review), proposed changes are shown to you before they are applied to your dataset.
- Marketing site and account data. Separately from AI Features within the product, Olambus does not use personal information collected through the Site (our marketing website and account/billing data) to train large language models or other AI models. For details on how we handle Content within the product, see our Terms of Service, Sections 1.2, 1.3, and 1.10.
Our retention of your personal data
We retain personal data for as long as we have an ongoing legitimate business need to do so. We determine the appropriate retention period based on the purpose for which we process the data, its sensitivity, the risk of harm from unauthorized use or disclosure, whether we can achieve our purposes through other means, and applicable legal requirements (such as tax and accounting retention rules). When we no longer have a legitimate business need to process personal data, we delete or anonymize it, or, where that is not possible (for example, data held in backup archives), we securely isolate it from further processing until deletion is possible. Indicative retention periods:
- Account data: retained while your account is active. If you request account closure, we delete or anonymize account data within a commercially reasonable period, subject to limited backup retention for disaster recovery and legal/accounting needs.
- Content uploaded to the product: retained while the associated project is active. Deleted projects are moved to a bin and permanently removed from our database after 30 days; associated files in object storage may be deleted on a separate schedule aligned with our backup and disaster-recovery practices.
- Billing records: retained as required under Canadian tax and accounting law (generally 6–7 years).
- Usage/analytics data: may be retained longer in aggregated or de-identified form for product improvement.
Links to other websites
The Site may link to third-party websites with privacy practices that differ from ours. We are not responsible for those sites' practices, and a link does not imply endorsement. We encourage you to review the privacy policies of any third-party site you visit.
Children and minors
Olambus does not knowingly collect personal data from individuals under 18. If you are under 18, please do not submit personal data through the Site. We encourage parents and guardians to monitor their children's internet use. If you believe a minor has provided personal data to us, please contact us at support@olambus.com and we will take reasonable steps to delete it.
Data security
We use administrative, technical, and physical safeguards designed to protect the information we collect, including encryption in transit and, where supported by our infrastructure, at rest; access controls limiting internal access on a need-to-know basis; and authentication cookies scoped to protect your session. While we make reasonable efforts to secure our systems, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please take care when deciding what information to send us over the internet, including by email, and avoid uploading sensitive or regulated data types unless you have assessed the associated risk (see our Terms of Service, Section 9.3).
Access to your personal information
To keep your personal data accurate, current, and complete, please contact us at support@olambus.com. We will take reasonable steps to update or correct personal information in our possession that you have previously submitted.
Your privacy rights under Canadian law
Olambus is subject to the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”), which governs how private-sector organizations handle personal information across Canada. Under PIPEDA, you have the right to:
- Access the personal information we hold about you and understand how it has been used and disclosed;
- Correct inaccurate or incomplete personal information;
- Withdraw consent to our collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and the consequence that withdrawing consent to essential processing may mean we can no longer provide part of the Service to you;
- Ask questions or file a complaint about how we handle your personal information.
Automated decision-making. We do not use your personal information to engage in automated processing or profiling to evaluate, analyze, or predict aspects of your economic situation, health, preferences, reliability, behaviour, or location in a way that produces legal or similarly significant effects on you.
Sensitive information. Certain personal information we collect (for example, account credentials or billing information) may be considered more sensitive; we apply heightened care to its handling but it is not used for advertising purposes.
To exercise any of these rights, contact us at support@olambus.com. We may need to verify your identity before processing your request, and we will respond within the timelines required by PIPEDA (generally within 30 days). You may also designate an authorized representative to submit a request on your behalf.
How to escalate a complaint
If you are not satisfied with our response, you have the right to file a complaint with the:
Office of the Privacy Commissioner of Canada (OPC)
30 Victoria Street, Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376 · Website: https://www.priv.gc.ca
Information for users outside Canada
The Service is operated under Canadian law, and this Privacy Policy is designed primarily to comply with that law. If you access the Service from outside Canada, you understand that your information will be transferred to and processed in Canada, and potentially in other jurisdictions where our service providers operate (including the United States, where Cerebras, Stripe, PostHog, and Google analytics services may process data), as described above. Data transferred outside Canada becomes subject to the laws of the jurisdiction in which it is held.
If applicable law where you live (for example, the EU/UK GDPR) grants you additional rights — such as rights to erasure, restriction of processing, or data portability — please contact us at support@olambus.com and we will make reasonable efforts to honour applicable requirements. Olambus does not currently maintain a designated EU or UK representative under Article 27 of the GDPR; if our user base in those regions grows to a level requiring one, we will appoint a representative and update this Policy accordingly.
Your choices
Marketing communications. You can unsubscribe from promotional emails at any time using the link in each email, or by contacting support@olambus.com, consistent with Canada's Anti-Spam Legislation (CASL). You will continue to receive transactional and account-related messages necessary to operate the Service, even after unsubscribing from marketing emails.
Cookies. You can manage or disable cookies through your browser settings, though this may affect Site functionality.
Sharing with third parties. If you do not want us to share your personal information with service providers who are not acting as our agents, you may contact us at support@olambus.com to discuss opting out; this will not affect our ability to provide the core Service where such sharing is necessary to operate it (for example, hosting and payment processing).
Withholding information. If you choose not to provide certain personal information, some features of the Service may not work as intended.
The above choices may be limited under applicable law. Before fulfilling a request, we may ask you to verify your identity.
If you have questions
If you have questions about this Privacy Policy or our data practices, contact us at:
Olambus — Privacy Contact
Email: support@olambus.com
Website: www.olambus.com
Breach notification
In accordance with PIPEDA's mandatory breach reporting requirements, if we become aware of a breach of security safeguards involving personal information that creates a real risk of significant harm to an individual, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible, and will maintain records of all such breaches as required by law.
Changes to this policy
We may revise this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or the Service itself. When we do, we will post the updated policy on the Site and update the “Last updated” date above; for material changes, we will provide additional notice (such as by email) at least 14 days before the changes take effect, except where a shorter period is required for legal compliance. Your continued use of the Service after a change takes effect constitutes your agreement to the revised Policy.
Relationship to our Terms of Service
This Policy should be read together with our Terms of Service, which govern your overall use of the Service. If there is a direct conflict between the two documents specifically regarding the handling of personal information, this Privacy Policy governs.