Privacy policy

What we store

• Your account: your name, your email address and your password (stored only as a secure hash by our sign-in provider; nobody can read it).
• Your businesses: the businesses you belong to, your access level in each, the process roles you fill, and invitations you send or receive.
• The work itself: templates, runs, what you enter in steps, notes, checklists, references, files you upload, and comments (including who you tag).
• Activity: a log of what happens in each run (who started, submitted, blocked or sent back what, and when), your notifications, and whether they were read and emailed.
• Your email settings: which emails you want to receive.
• Technical logs: our hosting providers keep short-lived request logs (such as IP addresses and browser type) to run and protect the service.

Why we use it

Only to run ACE for you: to sign you in, show you and your colleagues your work, tell you when something needs you, and keep the service secure and working. We don’t sell your information, we don’t show ads, and we don’t use it to build advertising profiles.

Who can see it

• People in your business can see its templates, runs and comments, and the names and email addresses of its members. Owners and admins manage members and settings.
• Nobody outside a business can see its content. This is enforced in the database itself, not only in the app.
• Syd Med Corp can access stored data when needed to run, support or secure the service, or when the law requires it.

Who handles it for us

These companies process data on our behalf, only to provide their part of the service:

• Supabase: database, sign-in and file storage (servers in Oregon, USA).
• Vercel: hosting the website (servers in Oregon, USA).
• Resend: sending email, such as notifications, invitations and password resets.

Links you add to ACE (for example to Google Drive) stay links: ACE doesn’t connect to those services or read what’s behind them.

Cookies

ACE uses only the cookies needed to keep you signed in. There are no analytics, advertising or tracking cookies.

Email

We email you about your work (a step is ready for you, sent back, blocked, due soon or overdue, a comment or a mention) and about your account (confirming your email, resetting your password, invitations). You can switch each kind of notification email off under Account → Emails; notifications still appear in the app. Marketing email is off unless you turn it on.

How long we keep it

We keep your information while your account or your business uses ACE. Run history is kept so that a business has a complete record of its work. When you ask us to delete your account, or a business owner asks us to delete a business, we delete it within 30 days, except where the law requires us to keep something.

Security

Data is encrypted in transit (HTTPS) and at rest by our providers, each business’s data is kept apart by rules in the database, and uploaded files are private to the business. No system is perfectly secure; if a breach affects your information, we will tell you.

Your choices and rights

• Change your name, password and email settings under Account at any time.
• Ask us for a copy of your information, to correct it, or to delete your account and the information tied to it.
• Content you add to a business belongs to that business; its owner can ask us about exporting or deleting it.

Depending on where you live, you may have further rights under local law; we will honour them.

Children

ACE is a tool for businesses and is not meant for children under 16.

Changes

If we change this policy, we will update this page and its date. For significant changes, we will also tell you by email or in the app.

Contact

An address for privacy questions and requests will be listed here soon.

Syd Med Corp