Privacy Policy
An earlier version, kept at its own address.
Effective 9 October 2026 · version privacy-2026-10-09 · replaced by a later version
This is an earlier version, kept so that anybody who agreed to it can still read it. It is not the wording a new customer agrees to today: that is the current Privacy Policy. Every version.
Effective 9 October 2026 (version privacy-2026-10-09). This policy explains what JOLIVE Labs Inc. ("SourceSecure", "we") collects when you use SourceSecure, why, where it goes and how long we keep it. Our privacy officer is Jacob Oliveira, 95 King William Court, Cambridge, Ontario N3C 4J3, support@sourcesecure.ca.
1. The short version
- What you type and attach on AI chat sites is checked on your own computer. We never receive your messages or files unredacted.
- We never store your prompts on our servers. If you turn on the Living Vault (Guard Enterprise), short summaries you approve are kept encrypted on your own computer.
- For the optional AI features, text is sent with names and numbers already replaced by stand-ins, and it is not stored.
- Your firm's admin sees what kind of detail was caught and a masked form of it, never what you typed.
- Our database is in Canada (Montreal). We do not sell information or use it for advertising or to train AI models.
2. Who this policy is for
SourceSecure is sold to businesses ("firms"). The firm decides who gets a seat and which features are on, and is responsible for its clients' information. We handle that information on the firm's behalf under a Data Processing Agreement. This policy also covers visitors to sourcesecure.ca.
3. What we collect, and why
| What | Why | How long |
|---|---|---|
| Your email address, your team and seat type | To sign you in and give you the features your firm bought | While your account is active |
| Sign-in records (through Google Firebase Authentication) | To keep your account secure | As Firebase keeps them |
| For each detail caught: when, which AI site, the kind of detail, what you chose to do, and a masked form made on your computer (e.g. •••• 4242 or R••• C•••) | So your firm can see the tool is working and where client details come up | 90 days |
| When protection was paused or switched off, and for how long | So your firm knows when people were unprotected | 90 days |
| Counts of how often features were used, and a weekly summary of your habits (counts only, no text, times or sites) | To show your firm adoption, and to write your private weekly note | While the account is active |
| A secret that proves your browser belongs to your seat, stored only as a one-way hash | To stop seats being copied | While the browser is connected |
| The firm profile, shared terms and firm playbook your admins write | To apply your firm's settings | While the firm's account is active |
| Billing details (name, email, card, address), held by Stripe on its own page | To take payment | As Stripe and tax law require |
| Server logs: request counts, timings and errors, with no message text | To run and secure the service | 30 days |
4. What happens to your messages and files
4.1 Detection happens on your computer. The extension reads what you type or attach on supported AI chat sites, finds sensitive details with models that are part of the extension, and offers a redacted version. None of this sends your text or files to us.
4.2 Optional AI features (prompt coaching on Guard Pro and above; reply marks on Guard 360 and above; Ask SourceSecure and chat and meeting summaries on Guard Enterprise) send a redacted extract to our server and to OpenAI. Names, numbers and other details found are replaced with stand-ins such as [PERSON_1] first, and the server checks again. We ask OpenAI not to store it, and we do not store it either. You can switch coaching and reply marks off at any time, and then nothing you type leaves your computer for those features.
4.3 Real names in replies. When an AI's reply contains stand-ins we sent, the extension puts the real names back on your screen, using a list kept in your browser for up to 12 hours. The list is never sent to us.
5. What stays on your computer only
5.1 Remember personal details (Guard 360 and above) keeps short facts about your work and firm in your browser, to check AI replies against. Only you can see them, and you can change or delete them.
5.2 The Living Vault (Guard Enterprise) keeps notes, files, captures, people pages, and chat and meeting summaries you approve, encrypted in your browser with a key that does not leave it. We cannot read it. If you remove the extension or clear your browser data, it is gone unless you exported it.
5.3 These may hold any fact you choose to keep, including a health fact you mention. They are never stored on our servers.
6. Who else handles information
We use Google Cloud and Firebase (hosting, database and sign-in, in Montreal), OpenAI (redacted text for AI features, in the United States), Stripe (payments) and Resend (emails, in the United States). The current list is at sourcesecure.ca/subprocessors. We do not sell or share information with anyone else, except where the law requires it.
7. Where information is kept
Our database, storage and server logs are in Montreal, Canada. Redacted text for AI features and email delivery are processed in the United States, where they may be subject to US law.
8. Your rights
You can ask to see the information we hold about you, have it corrected, or have it deleted, and (in Quebec) receive it in a structured format. Because your firm controls your account, we may pass your request to your firm's admin. Write to support@sourcesecure.ca; we reply within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information.
9. Security
We encrypt information in transit and at rest, keep no downloadable server credentials, require two-step verification for our administrative accounts, and keep the database protected against deletion with 7-day recovery. If a breach affects your information, we will tell your firm within 72 hours and help it notify you where required.
10. Cookies
sourcesecure.ca uses no advertising or tracking cookies. Signing in stores a session in your browser so you stay signed in.
11. Children
SourceSecure is for businesses and is not meant for anyone under 18.
12. Changes
If we change this policy in a way that affects what is collected or who receives it, we will email firms' admins before the change takes effect. The date at the top shows the last change.
Getting in touch
Email support@sourcesecure.ca. SourceSecure is operated by JOLIVE Labs Inc.