Privacy Policy
What ProductOS collects, why, who we share it with, how long we keep it, and how to reach us.
Last updated 29 September 2026
Effective date: 29 September 2026
This policy explains what ProductOS collects when you use productos.ca and the ProductOS applications, integrations and APIs (the "Service"), why we collect it, who else processes it, how long we keep it, and how to reach us.
ProductOS is operated by Sarim Khawaja, based in British Columbia, Canada ("ProductOS", "we", "us").
Two kinds of data, two different roles
ProductOS is a workspace that product teams fill with their own material. That makes the distinction below important, because it determines who is responsible for what.
- Data we control. Your account and the record of how you use the Service. We decide why and how this is processed, and this policy governs it.
- Data you control (workspace content). Everything you and your team put into a workspace: feedback, features, themes, initiatives, releases, outcomes, accounts, personas, team members, go-to-market and sales records, comments, documents and uploads. We process this on your instructions, as a service provider, so that we can operate the Service for you.
Workspace content frequently contains personal information about people who are not ProductOS users, for example the name or email of a customer quoted in a piece of feedback. You are responsible for having a lawful basis to put that information into ProductOS and for telling those people how it is handled.
What we collect
Account information
Your name, email address, profile image, the workspaces you belong to and your role in each, your notification preferences, and whether you have enrolled in multi-factor authentication. Authentication is handled by Supabase Auth; passwords are stored as salted hashes and are never visible to us.
Workspace content
Everything you create, import or upload in a workspace, as described above. This includes material brought in from integrations you connect, and feedback submitted to your workspace through the ProductOS feedback widget or the Feedback API, which may include the submitter's email address if your configuration collects one.
Usage and device information
We use Amplitude to understand how the Service is used. This records:
- Product events (pages viewed, features used) and the workspace they occurred in, along with your user ID, email address, name and workspace role.
- Device and browser information, and approximate location derived from IP address.
- Session replay. Amplitude's session replay records the structure of and your interactions with pages you visit in ProductOS, so that we can see how the interface behaves in practice. Password fields and form inputs are masked by default, but a replay of a ProductOS session will generally include the workspace content displayed on screen at the time. Session replay is currently enabled for all sessions.
We have deliberately disabled Amplitude's automatic element-text capture, and page URLs are sanitised before they are recorded.
Technical logs
Our hosting provider records standard request information, including IP address, user agent, timestamps and the resource requested, for security, debugging and abuse prevention.
Cookies and similar technologies
We use a small number of first-party cookies and browser storage entries:
| Purpose | Set by | Notes |
|---|---|---|
| Keeping you signed in | ProductOS / Supabase Auth | Strictly necessary; the Service cannot work without them |
| Interface preferences | ProductOS | Theme and layout choices, stored in your browser |
| Product analytics and session replay | Amplitude | Used to measure and improve the Service |
We do not use advertising cookies, and we do not sell personal information or share it for cross-context behavioural advertising.
How we use it
- To provide, operate and secure the Service, and to authenticate you.
- To power the AI features you invoke — drafting, summarising, semantic search and the ProductOS MCP connector — by sending the relevant content to the AI providers listed below.
- To send transactional email: sign-in and verification messages, invitations, and the notifications you have enabled. We do not send marketing email without your consent.
- To provide support, and to investigate problems you report.
- To understand and improve how the Service is used.
- To detect, prevent and respond to fraud, abuse and security incidents, and to meet legal obligations.
AI processing
AI features send workspace content you select to third-party model providers so that a result can be generated and returned to you.
- Anthropic (Claude) powers the assistant, drafting and analysis features and the ProductOS MCP connector. For most features this uses the Anthropic API key your workspace administrator supplies in Settings → AI, and the request is made under your own agreement with Anthropic. The first-run onboarding assistant is covered by a ProductOS-provided key instead, so that new workspaces are not blocked on supplying one.
- OpenAI generates the vector embeddings behind semantic search and related suggestions.
Content is sent only when you invoke a feature that requires it. Each provider processes it under its own API terms and privacy policy, which we encourage you to read: Anthropic and OpenAI.
Anthropic API keys you supply are encrypted at rest using a workspace-scoped envelope key and are never returned to the browser after they are saved; only masked metadata is displayed.
The ProductOS MCP connector
If you connect ProductOS to Claude or another MCP client, that client signs in with your ProductOS account through OAuth and receives a token scoped to your workspace and capped at your workspace role. The connector can read and write the same workspace content you could reach in the application yourself, and nothing more. Deletions run through a separate tool that asks for confirmation. Revoking the connection, or removing you from the workspace, stops the token working.
The connector reads from ProductOS. It does not read your Claude conversation history, your files in Claude, or anything else in your Claude account.
Who else processes your data
We use the following sub-processors. Each is bound by contract to process data only on our instructions.
| Sub-processor | Purpose | Where |
|---|---|---|
| Supabase | Database, authentication and file storage | Canada (ca-central-1) |
| Vercel | Application hosting, content delivery and request logs | Global edge network |
| Anthropic | AI features and the MCP connector | United States |
| OpenAI | Embeddings for semantic search | United States |
| Amplitude | Product analytics and session replay | United States |
| Resend | Transactional email delivery | United States |
In addition, if you choose to connect an integration — GitHub, Linear, Slack or Intercom — data flows between ProductOS and that service in both directions, on your instruction and under that provider's own privacy policy. You can disconnect an integration at any time in Settings → Integrations.
Your data is stored in Canada. Because several sub-processors operate in the United States, some processing takes place there, and data may be accessible to authorities in those jurisdictions under their laws.
We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of our users — and, if ProductOS is ever involved in a merger, acquisition or sale of assets, as part of that transaction, with notice to you beforehand.
How long we keep it
- Workspace content is kept for as long as the workspace exists. Deleting a record moves it to the workspace trash, where it remains recoverable until it is permanently deleted.
- Notifications are automatically deleted 90 days after they are created.
- Account information is kept while your account is open.
- Analytics and session replay data are retained according to Amplitude's retention settings for our account.
- Technical logs are kept on our hosting provider's standard schedule.
When you delete a workspace through Settings → Danger zone, its content is removed from our production database. Encrypted backups may retain copies for a limited period afterwards before being overwritten on their normal cycle.
To close your account entirely, contact us at the address below.
Security
Traffic is encrypted in transit and the domain is HSTS preloaded. Access to workspace data is enforced at the database level by row-level security policies and by your workspace role, so that members only reach the workspaces they belong to. Sensitive credentials, including the Anthropic API keys you supply and the API tokens you issue, are encrypted at rest. Multi-factor authentication is available and we recommend enabling it.
No service can promise perfect security, but we will notify you and any applicable regulator of a breach affecting your personal information as required by law.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. Canadian users have these rights under PIPEDA; users in the EEA and UK under the GDPR; users in California under the CCPA.
Several of these you can exercise yourself:
- Access and export. Settings → Import / Export produces a full export of your workspace content.
- Correction. Account details are editable in Settings → Account.
- Deletion. Settings → Danger zone deletes a workspace and its content.
For anything else, write to us at the address below. We will respond within the time your local law requires, and within 30 days in any case. If you are unsatisfied with our response, you may complain to your local data protection authority — in Canada, the Office of the Privacy Commissioner.
Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as the Service changes. When we do, we will revise the effective date at the top, and we will give notice in the application before any material change takes effect.
Contact us
Questions about this policy, or requests about your personal information:
- Email: support@productos.ca