Legal

Privacy Policy

Last updated October 19, 2026

Etcera Space exists to help you understand what matters to you, choose what comes next, and remain the author of who you are becoming. We collect and process your information for that purpose alone: never for advertising, never for resale, and never to train AI models.

Etcera is operated by Akimi Labs Ltd. ("Etcera," "we," "us," or "our"). This Privacy Policy explains what personal information we collect, how we use and protect it, and the rights you have over it, in compliance with applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and California's Consumer Privacy Act (CCPA/CPRA).

This policy works together with our Terms of Service, Acceptable Use Policy, and Sub-Processor Registry.

1. Personal information we collect

Categories of personal information

We collect personal information you provide, information generated when you use the service, and information returned by providers acting on our behalf. This includes:

  • Account and contact information: your name, email address, account identifiers, and correspondence with us
  • Content and communications: the writing, files, and other material you share or create in Etcera, including conversations with the assistant. Voice sessions are transcribed; we keep the transcript, but do not store the audio.
  • Technical and service information: IP addresses, browser and device details, authentication information, and logs needed to operate and secure the service
  • Access and update records: requests for access, communication preferences, email confirmations, and activity on guide links we send you, including whether you opened or downloaded the guide
  • Payment and subscription information: billing details processed by our payment provider, and customer identifiers, subscription status, invoices, and transaction records we receive to manage your subscription. Payment processing may also involve technical information used to authenticate payments and prevent fraud.

The Sub-Processor Registry explains what our providers process on our behalf.

Personal information we derive

Etcera processes your content to develop an understanding of what matters to you and support your thinking and work over time. This includes interpretations and suggestions, summaries and connections between material, and technical representations that support search and recall.

These are derived from what you share with Etcera, rather than information gathered about you from elsewhere. They may be incomplete or mistaken. We treat them as your personal information and keep them with your account.

Suggestions about your meaning or direction remain proposals for you to consider. Background processing, such as creating a search index, runs automatically and does not require you to accept each result. The controls available depend on the kind of material; section 6 explains how to correct or contest our understanding and request erasure of your account, including derived information.

Sensitive information

We do not ask you to include health information, financial account details, or government identifiers in your content. Payment method and billing details are collected separately by our payment provider when you subscribe. Your own thinking may include sensitive matters you choose to write about. We treat all of your content with the same care, and we do not single out, classify, or act on sensitive content differently.

Sources

  • Directly from you, when you create an account, use the service, or contact us
  • Automatically, when you connect to or use the service, including technical logs and email-link activity. We also generate account identifiers and session tokens
  • From our service providers, including assistant replies and transcripts, email delivery information, and payment, invoice, and subscription records. The Sub-Processor Registry lists each one.

2. How we use your data

To provide the service

  • Create and secure your account
  • Process payments, manage your subscription, and maintain transaction and invoice records
  • Run the assistant: generate replies, proposals, and transcripts, and derive the connections described above
  • Maintain your account and its history, including information you provide and information derived to support the service
  • Answer your support requests

To keep the service safe

  • Authenticate you and prevent unauthorized access
  • Detect abuse, fraud, and security threats
  • Meet legal obligations and respond to lawful requests

To keep the service working

  • Monitor errors, response times, and capacity, using logs rather than your content

To communicate with you

  • Send service notices, such as a confirmation link, an invitation, a billing or subscription notice, or notice of a change to this policy
  • Send product updates, if you asked for them. You can stop them at any time, using the link in any update email or by asking us.

What we never do

  • Build behavioural profiles, run analytics on your content, or measure your engagement to optimize it
  • Sell, rent, or trade your personal information
  • Show you advertising
  • Use your content to train AI models, or let our providers do so
  • Use what we know about you to manipulate you, to predict or steer your behaviour for anyone's benefit, to keep you engaged, or to make leaving costly

3. Sharing and disclosure

We do not sell personal information

We do not sell, rent, or trade your personal information, and we do not share it for cross-context behavioural advertising. Under the CCPA/CPRA you have the right to opt out of sale or sharing; since we do neither, there is nothing to opt out of. If that ever changes, we will tell you first and give you a clear way to say no.

Service providers

We use a small number of providers to run the service: one runs the AI models behind the assistant, one carries your connection to our servers and relays voice media, and one delivers our email, and another processes subscription payments. Each sees only what its job requires, each is bound by a written data protection agreement, and none uses your content to train models.

The Sub-Processor Registry names them and gives, for each, what it processes, where, for how long, and under what terms. We update the registry whenever a provider is added, removed, or changes what it does, and we notify you directly when a change materially affects how your information is processed.

Legal requirements

We may disclose personal information when required by law or a valid court order, or where necessary to protect someone's safety. If we receive a legal demand for your data, we will tell you, unless the law forbids us to.

4. Where your data is stored and processed

Storage

The data we store on our own infrastructure is held in Canada, on servers we operate. Today those are servers we own. As we grow, we will also use infrastructure we lease in Canada from a hosting provider listed in the Sub-Processor Registry and operate ourselves. Our providers also process data as described below and in the registry.

Processing outside Canada

  • The AI models behind the assistant run in the European Union. Your content is sent there for each request and is not kept there.
  • Your connection is handled at the network location nearest to you.
  • Email is delivered through our email provider's infrastructure.
  • Payment and billing information may be processed in the United States and other countries where our payment provider and its financial partners operate.

The registry says where each provider processes data.

Safeguards

Each provider is bound by a written data protection agreement that restricts how it uses your information, requires confidentiality, and requires it to notify us of security incidents. The Sub-Processor Registry identifies the safeguards applicable to each provider, including Standard Contractual Clauses where its agreement uses them for international transfers. The safeguards depend on the provider and the transfer involved.

Data processed outside Canada is subject to the laws of the country where it is processed, and may be accessible to that country's authorities under those laws.

5. How long we keep your data

Retention schedule

  • Data held with your account, including derived data: for as long as your account exists
  • Backups taken for disaster recovery: we are putting a schedule in place that keeps them for no longer than 30 days
  • Server logs: we are putting a schedule in place that keeps them for no longer than 12 months
  • Waitlist and updates sign-ups: until you ask us to remove you, or until we close the list
  • Support correspondence: 24 months
  • Billing records: as long as financial regulations require, typically 7 years
  • Security incident records: 24 months

When you delete your account

  • We erase the data held with your account, including data you provided, data generated through your use of the service, and data derived from it. We also cancel pending processing associated with your account, subject to the exceptions below.
  • We verify the erasure. Except for the backups and legally required records described below, we do not retain a copy or continue using data associated with your account, including derived data.
  • Backups taken before your deletion may still hold your data until they are removed. Once the 30-day backup schedule above is in place, that will be no longer than 30 days.
  • Records we must keep by law, listed above, are kept for the stated period and nothing else.

6. Your rights

The rights below are yours under PIPEDA and the CCPA/CPRA. Several go further, because Etcera is built to keep you the author of your own record.

Access and correction

  • Ask us for a copy of the personal information we hold about you.
  • Correct anything inaccurate. Most of your content can be edited directly in Etcera Space; for anything else, ask us.

Deletion

  • Ask us to delete your account and its associated data, including derived data, as described in section 5.

Portability

  • Ask us for a copy of your personal information in a machine-readable form. We are building a self-serve export that will preserve the origins and history of your material; until it ships, we fulfil requests by hand.

Correct and contest how Etcera understands you

  • Interpretations and suggestions the assistant presents about your meaning or direction are shown as proposals. You can accept, edit, or reject it, and a rejection stays rejected.
  • If you think Etcera has misunderstood something about you, tell us. Disagreement with the system's understanding is information about the system, not about you.

Non-discrimination

  • We will not treat you differently for exercising any of these rights.

7. How to exercise your rights

  • Primary method: within Etcera Space. Use the controls available in your account to manage your information.
  • Secondary method: by email. For requests you cannot complete within Etcera Space, or if you prefer to contact us, write to our Privacy Officer, Anissa Agahchen, at [email protected] from the email address on your account and describe your request.

Timelines

  • We acknowledge requests within 10 business days.
  • We respond within 30 days under PIPEDA, and within 45 days under the CCPA/CPRA, with one extension of the same length if we need it and tell you why.
  • We may need to verify that a request comes from you before acting on it.

8. Security

In transit

  • Every connection between you and Etcera is encrypted (TLS).

Access

  • Access to your data is limited to the systems and people that need it to serve you, on a least-privilege basis.
  • The service that holds your record cannot edit or delete stored meaning in place: a change is recorded as a new version, and the only destructive operation is the verified erasure of an account.

At rest

  • We are building encryption at rest with a key specific to each person, so that the AI models we use will be able to reach only the data of the person they are serving. Until that ships, data at rest is protected by the access controls above and by the physical security of the servers we operate.

Limits

  • No method of transmission or storage is completely secure. We work to protect your information and we will tell you if we fail (section 9).

9. Security incidents

If we experience a data breach, we will investigate promptly, contain it, and work to prevent further harm.

  • If a breach creates a real risk of significant harm to you, we will notify you directly and report it to the appropriate privacy authorities, as the law requires.
  • We keep a record of every breach for at least 24 months, whether or not it posed a significant risk.

If you are affected, we will tell you what happened and what data was involved, what we are doing about it, what you can do to protect yourself, and how to reach us with questions.

10. Cookies and tracking

  • Etcera Space keeps a session token in your browser so you stay signed in. It is essential to the service and is used for nothing else.
  • The Etcera website sets no analytics or advertising cookies.
  • Email links: if we email you our guide, we record whether the link was opened or downloaded. We do not track you across other sites.

11. Children

Etcera is not directed to people under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.

12. Changes to this policy

  • The "Last Updated" date is posted at the top.
  • We will communicate material changes by email or in-app notice.
  • We review this policy at least once a year.

13. Contact

Mailing address:
Anissa Agahchen, Privacy Officer
Etcera by Akimi Labs Ltd.
#400 - 1581H Hillside Ave
Victoria, BC V8T 2C1
Canada

14. Regulators

Canada

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada: www.priv.gc.ca, 1-800-282-1376.

California

California residents have additional rights under the CCPA/CPRA, including the right to know what personal information we collected, used, and disclosed in the past 12 months. This policy serves as that disclosure.

This policy is written to comply with applicable privacy laws, including PIPEDA (Canada) and the CCPA/CPRA (California). By using Etcera, you acknowledge that you have read and understood it.