Your data,and what we do with it.

This Privacy Policy explains how Good Venture Labs Inc. ("Actium", "we", "us", "our") collects, uses, shares, and protects personal information when you use our software-as-a-service platform, websites, and related services (the "Service").

For the purposes of the EU/UK GDPR, Actium is the controller of personal data described in this policy, except where we process Customer Data on behalf of our business customers, in which case we act as a processor and the customer is the controller.

Contact: Good Venture Labs Inc., 1824 Store St, Victoria, BC, Canada V8T 4R4. Privacy contact: [email protected].

We collect the following categories of personal information:

We do not intentionally collect special category / sensitive data unless you choose to provide it.

We accept uploaded files (PDFs, Word documents, images, and other media) that you choose to provide for ingestion into the Service. These are stored in our database and may be processed by our AI agents. You remain responsible for the content of these files and the privacy of any personal information they contain.

We collect information directly from you (when you register, subscribe, or contact us), automatically (through your use of the Service and cookies), and from third parties (such as payment processors, authentication providers, and analytics tools).

We collect and process data through integrations with third-party services to provide the Service. These include Google (Sign in with Google, Google Analytics, and Search Console), Ahrefs (SEO auditing and competitive analysis), Dropbox, Shopify, and Postproxy (social media publishing and analytics). When you authorize these integrations via OAuth or API key, we receive and store data returned by those services’ APIs. For Ahrefs, we query SEO metrics and site health data using your authorization. Payment processing flows through Stripe; card details are not stored by us.

These providers act as our sub-processors or as independent controllers depending on the integration; they are listed in our Data Processing Agreement. Where an integration involves a transfer of personal data outside the EEA, UK, or Switzerland, the safeguards described in Section 9 apply, including the Standard Contractual Clauses. You may revoke an integration’s authorization at any time in your account settings, which stops further collection from that service.

How we access, use, store, share, and delete data we receive from Google is described in Section 6.

This section explains how Actium accesses, uses, stores, shares, and deletes information we receive from Google APIs (“Google user data”). Where it is more specific than the rest of this policy, this section governs Google user data.

Limited Use. Actium’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access. Actium asks Google only for read-only access, and never changes anything in your Google account, Google Analytics, or Search Console. We receive:

How we use it. We use Google user data only to provide and improve features you can see in Actium:

We do not use Google user data, or anything derived from it, for advertising. We do not sell it, and we do not use it to determine creditworthiness or for lending. Neither we nor the AI providers we send it to use it to train AI models. Before we use Google user data in any way not described here, we will tell you and ask for your consent.

How we store it. When you connect Google Analytics or Search Console, Google issues access and refresh tokens, which we store so Actium can keep reading the data you chose without asking you to sign in to Google again. We keep copies of the reports described above in our database so your dashboards load quickly; they are refreshed about every six hours, and URL Inspection results daily. Google user data is encrypted in transit and at rest (see Section 16).

Who can see it. Google user data is available only to:

We do not transfer Google user data to anyone else, except to comply with the law, for security purposes such as investigating abuse, or, with your explicit consent given in advance, as part of a merger, acquisition, or sale of assets.

Human access. Actium staff do not read your Google user data, except when you ask us to (for example, to help with a support request), when it is needed for security purposes such as investigating abuse, to comply with the law, or once it has been aggregated and de-identified for our internal operations.

Disconnecting and deletion. You can disconnect Google Analytics or Search Console at any time in your workspace’s settings, under Connections. When you do, we delete that connection’s tokens and the Google Analytics or Search Console data we copied for that workspace. Articles and suggestions you have already created stay in your workspace and may mention search terms or figures drawn from that data. Deleting a workspace deletes all Google user data connected to it, and deleting your Actium account deletes the information we received from Sign in with Google. Copies in our database backups are removed when those backups expire.

You can also remove Actium’s access from your Google Account at any time, at myaccount.google.com/connections. That removes Actium’s access for every workspace connected with that Google account and stops us collecting more data from it. To delete the data we already hold, disconnect it in Actium as well, or email [email protected].

Under the GDPR we rely on the following legal bases:

Communications. We send transactional emails (verification, password reset, billing updates, notifications) via a third-party email service. Opt-out of non-transactional marketing emails in your account settings.

Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us about this balancing test at [email protected].

We share personal information with:

We do not sell your personal information for money. See Section 11 for how “sale” and “sharing” are treated under California law.

We may transfer personal data to countries outside your own, including the United States. Where we transfer personal data from the EEA, UK, or Switzerland, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), or transfer to countries with an adequacy decision. You can request a copy of the relevant safeguards at [email protected].

Depending on your location, you have the right to:

EU users may complain to their national data protection authority. UK users may complain to the Information Commissioner’s Office (ICO). Canadian users may complain to the Office of the Privacy Commissioner of Canada (OPC). Under PIPEDA you also have the right to access your personal information and challenge its accuracy.

To exercise any right, contact [email protected]. We will respond within the timeframe required by law (generally one month under GDPR; without undue delay under PIPEDA). We may need to verify your identity first.

If you are a California resident, you have the right to:

We do not sell personal information for money. We do not “sell” or “share” personal information for cross-context behavioral advertising, and we honor Global Privacy Control and similar opt-out preference signals.

To exercise these rights, contact [email protected]. You may use an authorised agent. We will not discriminate against you for exercising your rights.

Categories collected (CCPA): identifiers, customer records, commercial information, internet/network activity, and geolocation (approximate, via IP). We retain each category as described in Section 15.

If you are a resident of a US state with a comprehensive privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others — you may have rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, the “sale” of personal information, and certain profiling. Where required, we honor opt-out preference signals such as Global Privacy Control. To exercise these rights, contact [email protected]; you may appeal a decision by contacting [email protected], and you may contact your state Attorney General if you have concerns.

We do not use or disclose sensitive personal information beyond the purposes permitted by these laws.

At or before collection, we collect the categories of personal information described in Section 2 for the purposes in Section 7, retain them as described in Section 15, and do not sell personal information for money. This summary is provided to meet “notice at collection” requirements under California and similar laws.

We use cookies and similar technologies for essential functionality, preferences, and analytics. We use Google Analytics 4 to understand how visitors use our website. You can control cookies through your browser settings, and can opt out of Google Analytics using Google’s browser add-on.

We keep personal information only as long as necessary for the purposes described, to comply with legal obligations, resolve disputes, and enforce agreements. As a general rule we retain account data for the life of your account plus 90 days; billing and transaction records for 7 years to meet tax and accounting obligations; and server logs for 12 months. Customer Data is retained per your Subscription and deleted or returned after termination as described in our Terms. Google user data is deleted when you disconnect the Google service it came from, as described in Section 6.

We implement appropriate technical and organisational measures to protect personal information, including encryption in transit (TLS) and at rest, role-based access controls, network monitoring, and regular security reviews. No system is perfectly secure; we cannot guarantee absolute security. We will notify you and any regulator of a personal data breach where required by law.

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe we have done so, contact [email protected] and we will delete it.

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice (e.g. by email or in-product).

Good Venture Labs Inc. 1824 Store St, Victoria, BC, Canada V8T 4R4 Privacy: [email protected]