Privacy Policy

Effective date: November 4, 2026

LeafWise Labs is the business name of 16868134 Canada Inc., a corporation incorporated under the Canada Business Corporations Act (“LeafWise Labs”, “we”, “us”). This policy explains what personal information we handle through the website leafwiselabs.com (the “Site”) and through LeafWise Sage, our internal assistant that connects to Google accounts, why we handle it, and what your choices are. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who is responsible

16868134 Canada Inc., 99 Hay Avenue, Unit 1, Toronto, Ontario M8Z 1G3, Canada.

Our Privacy Officer is accountable for this policy and can be reached at ops@leafwiselabs.com.

2. Information we handle through the Site

  1. Contact form. When you write to us through the contact form we receive your name, your email address and your message. We use them only to answer you and to follow up on your inquiry. The message is delivered by email to our business mailbox, which is hosted by Google Workspace.
  2. Chat assistant. The Site includes an automated chat assistant. The messages you type are sent to an automation service (n8n) that runs on our own server and to OpenAI, whose artificial intelligence model generates the reply. The automation service keeps a record of the conversation and notifies us of it through Telegram. Please do not enter sensitive personal information in the chat.
  3. Server logs. Like most websites, our server records the IP address, date and time, page requested, referring page and browser type of each request. We use these logs for security and troubleshooting and keep them for about 14 days.
  4. Cookies and analytics. We do not use analytics, advertising or tracking cookies, and the Site does not set cookies for ordinary visitors. The chat assistant loads its code from a public content delivery network (jsDelivr), which receives your IP address as part of delivering those files.

We do not sell personal information and we do not use it for advertising.

3. LeafWise Sage and Google user data

LeafWise Sage (“Sage”) is an internal assistant operated by LeafWise Labs. It is not offered to the public. It can only be used with Google accounts that LeafWise Labs has authorized, which today are accounts that belong to its director.

3.1 What Sage can access and what it uses

With the account holder’s authorization, given on Google’s consent screen, Sage accesses Google user data through Google’s APIs.

Sage’s regular features use three services:

  1. Gmail: messages, threads, labels and drafts. Sage reads and searches mail, applies labels, prepares drafts and sends a message only when the account holder instructs it to.
  2. Google Calendar: calendars and events. Sage reads events and creates or updates them at the account holder’s request.
  3. Google Drive: files and their metadata, including Google Docs, Sheets and Slides. Sage searches, reads and organizes files and creates or updates them at the account holder’s request.

The authorization currently granted to Sage is broader than those features. It also covers Gmail settings (including forwarding and delegation), contacts and directory information, Google Chat, Google Classroom, Google Meet, Google Forms, Google Tasks, Apps Script, Google Photos (only items created by the app), read access to YouTube, Google Analytics and Drive activity and labels, Search Console, Google Ads, and basic profile information (name and email address). Sage uses these additional permissions only if the account holder asks it to. The complete list of permissions is shown on Google’s consent screen and in the Google Account’s connections page.

3.2 How Sage uses this data

Sage uses Google user data only to provide its features to the account holder: summarizing and searching mail, preparing draft replies, managing the calendar, and finding and working with documents. We do not use this data for any other purpose.

3.3 Where the data is processed and stored

Sage runs on a private server that we rent from Hetzner Online GmbH, located in Helsinki, Finland. The server is reachable only through a private network and with key-based authentication. The authorization tokens that let Sage reach a Google account are stored on that server.

Sage does not mirror the mailbox, calendar or Drive. It retrieves items from Google when a task needs them. What it retrieves and produces stays on the server: the conversation history, which includes the content of the emails, events and documents that Sage read in order to answer; the output of scheduled tasks such as the daily briefing, with senders, subjects and summaries of mail and calendar; the assistant’s memory and a knowledge base with summaries of documents; operational logs; and a log of the drafts it created (date, account, recipients and subject). This content is not deleted automatically.

Backups: Hetzner keeps rotating backups of the server, the server keeps daily copies of its database for 7 days, and the output of scheduled tasks, session files, the assistant’s memory and the knowledge base are also copied to two private repositories hosted by GitHub, to which only LeafWise Labs has access.

3.4 Who receives the data

  1. AI model providers. To generate summaries and replies, Sage sends the content needed for the task, for example the text of an email, to artificial intelligence model providers that act as our service providers: OpenAI and, as a fallback, Anthropic. We send them this content for the sole purpose of obtaining the result of the task.
  2. Telegram. The account holder talks to Sage through a private Telegram chat, so Sage’s answers, which may include excerpts or summaries of the content, pass through Telegram’s service.
  3. Web search and media tools. When a task requires searching the web or generating images, audio or video, Sage sends the search queries or prompts it writes to Firecrawl (web search and extraction) and Magnific (media generation). Those queries and prompts may reflect the content Sage is working with.
  4. Hosting and backup providers. Hetzner and GitHub store the data described in section 3.3.
  5. No one else. We do not sell Google user data, we do not share it with advertisers or data brokers, and we do not transfer it to anyone else, except where the law requires it or where it is necessary for security purposes, such as investigating abuse.

The account holder consents to these transfers when connecting a Google account to Sage.

3.5 Google API Services User Data Policy and Limited Use

LeafWise Sage’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. In particular:

  1. We limit our use of Google user data to providing or improving the user-facing features of Sage described above.
  2. We do not transfer Google user data to others, except as necessary to provide or improve those features with the user’s consent, for security purposes, to comply with applicable laws, or as part of a merger, acquisition or sale of assets with the user’s explicit prior consent.
  3. We do not use or transfer Google user data for serving advertisements, including retargeting, personalized or interest-based advertising.
  4. We do not use Google user data to create, train or improve generalized artificial intelligence or machine learning models, and we do not transfer it to anyone for that purpose.
  5. We do not allow humans to read Google user data, other than the account holder, unless we have the user’s affirmative agreement for specific content, it is necessary for security purposes, or it is necessary to comply with applicable law.

3.6 Retention and deletion

Sage keeps its authorization tokens and the stored content described in section 3.3 for as long as the Google account remains connected; nothing is deleted automatically. When an account is disconnected, or when the account holder asks us to, we delete the tokens and the stored content that came from that account, including the copies in the backup repositories, within 30 days. Server backups kept by Hetzner are overwritten as they rotate.

3.7 How to revoke Sage’s access

You can revoke Sage’s access to a Google account at any time from the Google Account settings, at myaccount.google.com/connections: select “LeafWise Sage” and remove its access. You can also write to ops@leafwiselabs.com to ask us to disconnect the account and delete the stored data.

4. Service providers and processing outside Canada

We use the following service providers, which process information on our behalf:

  1. Google Cloud (hosting of the Site and of its chat automation service, in the United States) and Google Workspace (business email).
  2. BlogVault (backups of the Site), and OpenAI and Telegram for the Site’s chat assistant.
  3. Amazon Web Services (domain name service).
  4. Hetzner Online GmbH (the server that runs Sage, in Finland).
  5. OpenAI and Anthropic (artificial intelligence models), Telegram (messaging), Firecrawl (web search), Magnific (media generation) and GitHub (private backup repositories), for Sage.

As a result, personal information may be processed and stored outside Canada, including in the United States and Finland, where it is subject to the laws of those countries and may be accessible to their courts and authorities.

5. Safeguards

We protect personal information with safeguards appropriate to its sensitivity: encrypted connections (HTTPS), access restricted to the people who need it, key-based authentication and a private network for the server that runs Sage, and regular backups. No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as the law requires.

6. How long we keep information from the Site

We keep messages sent through the contact form for as long as we need them to deal with your inquiry and to maintain our business records. Server logs are kept for about 14 days. Backups of the Site are kept by our backup provider according to its retention schedule.

7. Your rights

You can ask us to tell you what personal information we hold about you, to give you access to it, to correct it, or to delete it, and you can withdraw your consent to our use of it, subject to legal and contractual restrictions. Write to ops@leafwiselabs.com. We will answer within 30 days.

If you are not satisfied with our answer, you can file a complaint with the Office of the Privacy Commissioner of Canada.

8. Children

The Site and Sage are not directed to children, and we do not knowingly collect personal information from them.

9. Work we do for clients

When we build or operate systems for our clients, we handle personal information on their behalf and under their instructions. That information is governed by the client’s own privacy policy and by our agreement with the client, not by this policy. Client projects hosted on subdomains of leafwiselabs.com may display their own privacy notices.

10. Changes to this policy

We may update this policy. We will post the new version on this page and change the effective date above. If a change affects how Sage uses Google user data, we will ask the account holder for consent again before the change applies.

11. Contact

Privacy Officer, 16868134 Canada Inc. (LeafWise Labs)
99 Hay Avenue, Unit 1, Toronto, Ontario M8Z 1G3, Canada
ops@leafwiselabs.com

A Spanish version of this policy is available at leafwiselabs.com/privacidad. If the two versions differ, the English version prevails.