Privacy Policy

Last updated: October 19, 2026

1. Introduction

ActionItem ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our board governance platform ("the Service"). This policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA).

2. Information We Collect

Information you provide:

  • Account information: Name, email address, and organization name when you register
  • Organization data: Meeting agendas, minutes, decisions, votes, action items, documents, and other governance content you create
  • Payment information: Billing details processed securely by Stripe (we do not store credit card numbers)
  • Messages to us: what you send through the contact page (your name, email address, organization and message), kept as our records

Information collected automatically:

  • Usage data: Pages visited, features used, and timestamps
  • Session data: IP address, browser type, and device information for security purposes

3. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Service
  • Send transactional emails (login links, meeting notifications, action reminders)
  • Process payments and manage subscriptions
  • Detect and prevent fraud, abuse, and security incidents
  • Comply with legal obligations

We do not sell your personal information. We do not use your data for advertising. We do not train AI models on your data.

4. Data Security

We take security seriously:

  • Encryption at rest: Sensitive fields (names, emails, meeting content, votes, declarations) are encrypted in the database using Rails ActiveRecord::Encryption
  • Encryption in transit: All connections use TLS/SSL (HTTPS enforced)
  • Access controls: Role-based permissions at the organization and board level
  • Rate limiting: Automated protections against brute force and abuse
  • Session security: Automatic timeout after inactivity, secure cookie handling

5. Data Residency

Your data is stored on servers located in Canada. We use Canadian-hosted infrastructure to ensure your data remains subject to Canadian privacy law. Meeting audio is transcribed on our own server in Canada and never leaves it. One optional AI feature, where an organization turns it on, sends text to an AI service that processes it outside Canada (for example in the United States, Europe, Asia or Australia): transcript clean-up and drafting sends a meeting transcript's text. Administrators turn it on or off in the organization's settings. Third-party service providers (email delivery, payment processing) may process limited data in other jurisdictions as necessary to provide the Service.

6. Data Retention and Deletion

We retain your data for as long as your account is active or as needed to provide the Service. Database backups are kept for up to 35 days and then destroyed. Messages sent to us through the contact page are kept as our records.

Deleting an organization. The organization's owner can schedule its deletion from Organization Settings (or ask us). The organization closes at once and is permanently deleted 30 days later, during which the owner can cancel. Every board, meeting, minute, decision, vote, document and member record is deleted. We keep one record of the organization's name, its billing reference and who requested the deletion, for up to seven years, as accounting records require.

Meeting recordings. Audio recorded or uploaded for a meeting is used only to make its transcript, and is deleted three days after the transcript is ready. The transcript stays with the meeting. Download a copy of the audio within those three days if you need one.

Trash. What you delete goes to Trash, where an administrator can restore it for 30 days. After 30 days it is deleted for good, and an administrator can delete it for good sooner.

Deleting your account. You can delete your own account from your Account page (or ask us). We remove your personal information: your email address (also from the log of emails we sent you), phone number, photo, password and sign-in links, and your private notes. We keep our logs of how the service was used, and the messages you sent us through the contact page. We keep a one-way code made from your email address; it cannot be turned back into the address, and lets you be recognized if you come back with the same address. Your name stays in the records of the organizations you belonged to, because those records are theirs: the seats you held, your votes and attendance, the motions you moved and the documents you uploaded. Your memberships and seats end that day. Anything an organization itself wrote about you in its own records (a transcript, a conflict-of-interest declaration) belongs to that organization and is not changed by deleting your account; ask the organization for that. If you own an organization, delete it or hand it to someone else first.

7. Your Rights

Under PIPEDA, you have the right to:

  • Access your personal information held by us
  • Correct inaccurate or incomplete information
  • Withdraw consent for non-essential processing
  • Request deletion of your personal information
  • Export your data in a portable format

To exercise these rights, contact us at hello@actionitem.ca. We will respond within 30 days.

8. Third-Party Services

We use the following third-party services:

  • Stripe: payment processing (Stripe Privacy Policy)
  • MailerSend: transactional email delivery (MailerSend Privacy Policy)
  • An AI processing service (outside Canada): transcript clean-up and drafting, only where an organization turns it on
  • AI apps you connect yourself: where an organization's administrator allows it, a member may connect an AI app of their own choosing. It reads what that member can read, as them, and where an administrator allows it, an administrator's app can change a board's settings. The app is run by another company: what it reads goes to that company, which handles it under its own terms, possibly outside Canada. We log each request it makes (which tool and when, not what it read). The member can disconnect it at any time from their account page.

9. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

ActionItem
Email: hello@actionitem.ca