1. Who we are
SOP365 is a business platform ("we", "us" or "our"). This policy explains how we handle personal information when you visit sop365.ca, create an account, use a workspace, or contact us. Privacy inquiries can be sent to [email protected], addressed to the Privacy Contact.
2. Information we handle
- Account and organization information: name, business email, organization details, role, invitations and account settings.
- Workspace content: uploaded videos, images, audio, procedures, comments, revisions, review decisions, approvals and related metadata. These may contain personal information you or your organization provide.
- Training and activity records: assignments, acknowledgements, timestamps, usage and audit activity.
- Billing information: billing contact and address, plan, subscription status, invoices, payment references and limited payment-method details such as card brand, last four digits and expiry. Card details are submitted through Stripe payment components; SOP365 does not store full card numbers or card security codes.
- Technical and support information: IP address, browser/device details, security and diagnostic logs, and correspondence.
3. Why we use information
We use information to provide workspaces and SOP tools; process uploaded media and requested AI features; manage reviews, approvals and training; authenticate users; send invitations and service notices; administer subscriptions, taxes and invoices; respond to requests; enforce plan limits; troubleshoot problems; and protect the service against fraud, abuse and unauthorized access. Marketing communications, if offered, include a way to unsubscribe. Essential service and billing messages may continue while your account is active.
4. Your organization and permissions
If you use an employer or organization workspace, that organization determines what content to upload and who can access it. Authorized owners, administrators and other users can view or manage information according to their permissions. Contact your organization first for requests about employment records, SOP content, training records or workspace access. Public or shared links can make the selected content accessible to people who receive or can access those links; check sharing settings before publishing.
5. AI and media processing
When a user requests an AI or media feature, relevant videos, audio, images, text and instructions may be transmitted to service providers to perform that task. Generated drafts and translations can contain errors and require human review. Avoid uploading unnecessary personal information or sensitive workplace material. Contact support before uploading regulated, export-controlled, patient or similarly restricted data to confirm whether the service is suitable and what provider terms and processing arrangements apply.
6. Service providers and disclosures
We use providers for payment processing (Stripe), hosting, storage, media processing, AI, email delivery and technical operations. Information is shared as needed for the relevant service. Provider names and applicable processing arrangements can be requested from support. Information may also be disclosed when required by law, to protect legal rights and safety, or in connection with a business transfer subject to applicable protections. Workspace content is not made public merely because it is uploaded.
7. Processing locations
Depending on the services used, information may be processed in Canada and other countries, including the United States, where different privacy laws and lawful government access rules may apply. Being developed in Canada does not mean all data remains in Canada. Ask us about processing locations and any contractual residency requirements before uploading content that must remain in a particular jurisdiction.
8. Cookies and external resources
The service uses cookies or similar storage for functions such as sign-in, sessions and security. Blocking these may prevent the application from working. The website loads Google Fonts, which may disclose technical request information such as your IP address to Google. Links to external services are governed by their own policies. If optional analytics or advertising technologies are introduced, we will provide the relevant notice and consent choices where required.
9. Retention, deletion and security
We retain information for the purposes described here, including operating accounts, maintaining authorized records, resolving disputes and meeting legal and accounting obligations. Retention varies by record type and the organization’s settings; cancellation of a subscription does not itself delete a workspace. Deletion may be subject to legal holds, billing records, audit requirements and backup retention. Contact support about export, deletion and the applicable retention arrangements before closing an account.
Account permissions and security controls help limit access. No online system can be guaranteed completely secure. Keep credentials confidential, promptly remove access for departing team members, and report suspected unauthorized access to support. We assess security incidents and provide notifications where applicable law requires.
10. Your choices and privacy requests
Subject to applicable law, you may request access to or correction of personal information, ask about our practices, raise a complaint, or withdraw consent for processing that relies on consent. Some processing is necessary to provide the service or meet legal obligations; withdrawing consent may affect service availability. We may verify your identity and authority before responding. Contact [email protected]. If a concern remains unresolved, you may contact the applicable privacy regulator, including the Office of the Privacy Commissioner of Canada.
11. Children and policy updates
SOP365 is intended for business use and is not directed to children. Do not create an account or submit a child’s information without the necessary lawful authority. We may update this policy as the service changes. The updated date appears above; material changes will be communicated where required, and additional consent will be sought when required by law.