1. Introduction
Multi-Agent Automation Systems Inc. (“MAAS,” “we,” “us,” or “our”) is committed to protecting the privacy and personal information of users (“Users” or “you”) of the Assay application (the “Application”). The Application allows Users to audit network addresses (websites) and generate reports identifying errors ranging from critical issues to design recommendations.
This Privacy Policy explains what personal information we collect, how we collect it, why we process it, with whom we share it, and what rights you have regarding your personal data. This Policy applies to all Users of the Application and is incorporated by reference into our Terms of Service.
MAAS is incorporated under the Canada Business Corporations Act (CBCA) and is headquartered in Ottawa, Ontario, Canada. We comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), and, to the extent applicable, the General Data Protection Regulation (GDPR) for Users in the European Union and the United Kingdom, and the California Consumer Privacy Act (CCPA) for Residents of California.
2. Information We Collect
We collect the following categories of personal information:
2.1 Personal Data
- Email Address: Required to access the Application. Your email address is used for authentication, account management, and communication regarding your use of the Application.
- Account Status: Whether you are in a Free Trial or an active Subscription, your usage history, and the number of Audits performed.
2.2 Usage Data
- Network Addresses Audited: The network addresses (URLs) you submit for Audits, along with the resulting Audit findings and generated Reports.
- Application Activity: Interactions with the Application, including timestamps of Audits, features used, and configuration inputs.
- Device and Technical Data: IP address, browser type, operating system, device identifiers, and similar technical information collected automatically when you use the Application.
2.3 Billing Information
If you subscribe to a paid plan, we collect billing-related information, which may include:
- Name associated with the payment method;
- Billing address;
- Transaction history and dates of payment.
Payment card numbers and other sensitive financial data are processed by Stripe, our payment processor, and are not stored on MAAS systems. For Users who pay via bank transfer or mailed cash, MAAS retains records of the transaction including the date received and the amount, but does not store additional financial data beyond what is necessary for accounting purposes.
3. How We Collect Information
We collect personal information through the following methods:
- Directly from Users: When you enter your email address to register, submit network addresses for Audits, subscribe to a paid plan, or communicate with us via email.
- Automatically: When you use the Application, certain technical and usage data is collected automatically, including IP addresses, device information, and activity logs. This data is collected through our infrastructure providers, including Supabase and Cloudflare.
- From Third-Party Services: We receive limited information from our Third-Party Service providers, such as authentication confirmation from Supabase, AI processing results from Anthropic, and security and delivery data from Cloudflare.
4. How We Use Your Information
We use the personal information we collect for the following purposes:
- Providing the Service: To authenticate your identity, process Audits, generate Reports, and deliver the core functionality of the Application;
- Account Management: To manage your Free Trial, Subscription, usage limits, and billing;
- Communication: To send you verification links or codes, respond to your inquiries, and provide support;
- Improvement: To analyze usage patterns, identify bugs or issues, and improve the performance, features, and reliability of the Application;
- Security: To monitor for suspicious or unauthorized activity, prevent fraud, and protect the integrity of the Application and its Users;
- Legal Compliance: To comply with applicable legal obligations and to respond to lawful requests from authorities where required.
We do not sell your personal information to third parties.
5. Legal Basis for Processing Personal Data
For Users in jurisdictions governed by the GDPR (European Union and United Kingdom), MAAS processes personal data on the following lawful bases:
- Performance of a Contract (Article 6(1)(b)): Processing your email address, network address submissions, and usage data is necessary to provide the Application service you have requested;
- Legitimate Interests (Article 6(1)(f)): We process device and technical data, and conduct usage analytics, for the legitimate purpose of improving Application security, performance, and reliability, provided such interests are not overridden by your privacy rights;
- Consent (Article 6(1)(a)): Where we process personal data for purposes that are not strictly necessary for the provision of the service (such as optional marketing communications), we will seek your consent, which you may withdraw at any time;
- Legal Obligation (Article 6(1)(c)): We may process personal data where required to comply with applicable laws, regulations, or lawful government requests.
7. Data Sharing and Third Parties
MAAS shares or makes accessible certain personal data with the following categories of Third-Party Services that support the operation of the Application:
- Supabase: Used for user authentication and database infrastructure. Supabase processes your email address, authentication data, and Audit-related data stored in the database. Supabase is operated by Supabase Inc. and is subject to its privacy policy.
- Anthropic: Used for AI-powered analysis during Audits. Network address content and Audit parameters may be transmitted to Anthropic for processing. Anthropic is operated by Anthropic PBC and is subject to its privacy policy.
- Cloudflare: Used for content delivery, security, and infrastructure protection. Cloudflare processes IP addresses and traffic metadata. Cloudflare is operated by Cloudflare, Inc. and is subject to its privacy policy.
- Payment Processor – Stripe: If you pay by credit or debit card, your payment information is processed by Stripe. MAAS does not store full payment card details. For bank transfer and mailed cash payments, MAAS handles transaction records internally and does not transmit financial data to any third-party payment processor.
- Legal and Regulatory Authorities: We may disclose personal data where required by law, court order, or government authority, or where we believe disclosure is necessary to protect our rights, safety, or property.
- Resend: Used for transactional email delivery, including verification links and codes sent during account authentication. Resend processes your email address and email delivery metadata. Resend is operated by Resend Inc. and is subject to its privacy policy.
MAAS does not sell, rent, or trade your personal information to any third party for commercial purposes.
8. Data Retention
We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy:
- Account Data: Your email address and account status are retained for the duration of your use of the Application and for a period of thirty (30) days after you cease using the Application, after which they are deleted or anonymized;
- Audit Data: Network addresses submitted for Audits and their corresponding Reports are retained indefinitely for as long as your account remains active. You may manually delete individual Audits at any time through the Application interface. When an Audit is soft-deleted (marked for deletion), it is permanently hard-deleted after thirty (30) days. If you close your account, all Audit Data will be deleted within thirty (30) days of account closure, subject to legal retention obligations.
- Usage and Technical Data: Retained for a period of twelve (12) months, then anonymized or deleted;
- Billing Records: Retained for the period required by applicable tax and accounting laws (typically seven (7) years in Canada).
You may request deletion of your personal data at any time, subject to the rights described in Section 10 and any legal obligations requiring us to retain certain data.
9. Data Security
MAAS implements reasonable and appropriate technical and organizational measures designed to protect your personal information, including:
- Encryption of data in transit using TLS/SSL;
- Secure authentication through email-based verification and tokenized sessions;
- Restricted access to personal data on a need-to-know basis among MAAS personnel;
- Reliance on Third-Party Services (Supabase, Cloudflare) that maintain their own security certifications and practices.
Despite these measures, no system or transmission can be guaranteed to be completely secure. We cannot ensure that your personal information will not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards. In the event of a data breach affecting your personal information, we will notify affected Users and applicable regulators in accordance with applicable legal requirements.
10. Your Privacy Rights
Depending on your jurisdiction, you may have certain rights regarding your personal data:
10.1 All Users
Regardless of location, you may:
- Request access to the personal data we hold about you;
- Request correction of inaccurate or incomplete personal data;
- Request deletion of your personal data, subject to legal retention obligations;
- Object to the processing of your personal data for specific purposes;
- Withdraw any consent you have previously given for optional processing.
10.2 GDPR Users (EU and UK)
In addition to the above, Users in the European Union and the United Kingdom have the right to:
- Data Portability: Receive your personal data in a structured, machine-readable format and transmit it to another controller;
- Restriction of Processing: Request that we restrict the processing of your personal data under certain conditions;
- Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority. For the EU, contact information for supervisory authorities is available at edpb.europa.eu. For the UK, the supervisory authority is the Information Commissioner’s Office (ico.org.uk).
10.3 CCPA Users (California Residents)
If you are a resident of California, you have additional rights under the California Consumer Privacy Act:
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you;
- Right to Delete: Request deletion of your personal information;
- Right to Opt-Out: We do not sell your personal information, so no opt-out is necessary. If this changes, we will provide an opt-out mechanism;
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
10.4 Exercising Your Rights
To exercise any of these rights, please contact us at maas@multiagentautomationsystems.com. We will respond to verified requests within thirty (30) days. We may request additional information to verify your identity before processing your request.
11. International Data Transfers
MAAS is headquartered in Canada. Your personal information may be transferred to, stored in, or processed in countries other than your country of residence, including the United States (where Anthropic and Cloudflare operate) and other jurisdictions where our Third-Party Services maintain infrastructure.
When transferring personal data outside of Canada, we rely on:
- Third-Party Services that implement appropriate safeguards, such as Standard Contractual Clauses (SCCs) for transfers subject to the GDPR;
- The adequacy status of recipient countries as determined by applicable data protection authorities.
We take reasonable steps to ensure that personal data is transferred in accordance with applicable data protection laws and that appropriate protections are in place.
12. Children’s Privacy
The Application is not directed at children under the age of sixteen (16). We do not knowingly collect personal information from individuals under sixteen (16) years of age.
If we become aware that we have inadvertently collected personal information from a person under sixteen (16), we will take steps to delete such information promptly. If you believe we have collected information from a minor, please contact us at maas@multiagentautomationsystems.com.
13. Changes to This Privacy Policy
MAAS may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When material changes are made, MAAS will provide notice of the updated Policy within the Application. The effective date indicated at the top of this document will reflect the most recent revision.
Your continued use of the Application following the posting of the revised Privacy Policy constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically within the Application.
14. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:
- Company Name
- Multi-Agent Automation Systems Inc.
- Phone
- +1 (613) 413-8719
- Incorporation
- Canada Business Corporations Act (CBCA)