Privacy Policy
An earlier version, kept at its own address.
Effective 12 October 2026 · version privacy-2026-10-12 · replaced by a later version
This is an earlier version, kept so that anybody who agreed to it can still read it. It is not the wording a new customer agrees to today: that is the current Privacy Policy. Every version.
Effective 12 October 2026 (version privacy-2026-10-12). This policy explains what JOLIVE Labs Inc. ("SourceSecure", "we") collects when you use SourceSecure, why, where it goes and how long we keep it. Our privacy officer is Jacob Oliveira, 95 King William Court, Cambridge, Ontario N3C 4J3, support@sourcesecure.ca.
1. The short version
- What you type and attach on AI chat sites is checked on your own computer. We never receive your files, and we receive no message text until it has been through redaction there.
- We never store your prompts on our servers. On a Guard Enterprise seat, the Living Vault keeps your notes and short summaries of the chats and meetings you save, encrypted on your own computer.
- For the optional AI features, text is sent to us and to OpenAI with the names and numbers found in it already replaced by stand-ins. We do not store it, and it is sent to OpenAI with OpenAI's storage option switched off. What OpenAI may keep is set out in 4.2.
- Your firm's admin sees what kind of detail was caught and a masked form of it (such as the last four digits of an account number), and when you paused protection; never your messages.
- Our database is in Canada (Montreal). We do not sell information or use it for advertising or to train AI models.
2. Who this policy is for
SourceSecure is sold to businesses ("firms"). The firm decides who gets a seat and which features are on, and is responsible for its clients' information. We handle that information on the firm's behalf under a Data Processing Agreement. This policy also covers visitors to sourcesecure.ca.
3. What we collect, and why
| What | Why | How long |
|---|---|---|
| Your email address, your team and seat type | To sign you in and give you the features your firm bought | While your account is active |
| Sign-in records (through Google Firebase Authentication) | To keep your account secure | As Firebase keeps them |
| For each detail caught: when, which AI site, the kind of detail, what you chose to do, and a masked form made on your computer (e.g. •••• 4242 or R••• C•••). The masked form keeps the last few digits of a number or the first letter of each word of a name | So your firm can see the tool is working and where client details come up | 90 days from when it is received |
| When protection was paused or switched off, and for how long | So your firm knows when people were unprotected | 90 days from when the pause began |
| Daily counts of what was caught and how often each feature was used, for each supported AI site how often SourceSecure started there, and the habit you are working on, from a fixed list (counts only, no text) | To show your firm's admins how SourceSecure is being used, for the firm or for one person | While your firm's account is active |
| A summary of your week, once a week: counts, labels from fixed lists and, on Guard 360 seats and above, a few short facts about your work from your vault (no message text, times or sites) | To write your private weekly note, which is kept on your computer | Not kept by us |
| A secret that proves your browser belongs to your seat, stored only as a one-way hash | To stop seats being copied | While the browser is connected |
| The firm profile, shared terms and firm playbook your admins write | To apply your firm's settings | While the firm's account is active |
| A fact from your vault that you choose to suggest to your firm | So your admin can add it to the firm profile | Until your admin approves or dismisses it |
| Billing details (name, email, card, address), held by Stripe on its own page | To take payment | As Stripe and tax law require |
| Server logs: request counts, timings and errors, with no message text | To run and secure the service | 30 days |
4. What happens to your messages and files
4.1 Detection happens on your computer. The extension reads what you type or attach on supported AI chat sites, finds sensitive details with models that are part of the extension, and offers a redacted version. None of this sends your text or files to us.
4.2 Optional AI features send a redacted extract to our server and on to OpenAI. Names, numbers and other details found are replaced with stand-ins such as [PERSON_1] first, and our server checks again for an email address, a phone number or a long number and refuses the request if it finds one. Redaction replaces what it finds; a name it does not recognise can pass through. We do not store the extract. We send it to OpenAI with OpenAI's storage option switched off, and OpenAI does not use it to train its models. OpenAI may keep its own abuse-monitoring logs of these requests for up to 30 days under its standard API terms; SourceSecure has asked OpenAI for zero data retention. The features are:
- Prompt coaching (Guard Pro and above): parts of the conversation, yours and the AI's, and for Help me and Sharpen my prompt the whole conversation on the page and your unsent draft. Help me starts when a tip appears, and Sharpen my prompt when your pointer rests on its button for a moment, so the redacted conversation can be sent before you click.
- Reply marks (Guard 360 and above): your message, the AI's reply, a few earlier messages, and the facts in your vault and your firm's profile.
- Chat and meeting summaries (Guard Enterprise): a chat you save to your Living Vault, or a meeting transcript you add to it. A transcript is sent as soon as you add the file.
- Ask SourceSecure (Guard Enterprise): your question, an overview of your vault, and the passages of your notes found for the question, sent only when you ask.
- Write background, in Add notes (Guard Enterprise): the notes you tick, the message you are writing and your own last few messages in that chat, sent only when you press the button.
You can switch prompting tips off at any time. With it off, prompt coaching, reply marks, chat and meeting summaries and Write background all stop. Ask SourceSecure is separate: a question is sent only when you ask it, whether prompting tips are on or off, and stops when you or your firm switch the Living Vault off. While SourceSecure is paused, none of these features sends anything, Ask SourceSecure included.
4.3 Real names in replies. When an AI's reply contains stand-ins we sent, the extension puts the real names back on your screen, using a list kept in your browser for up to 12 hours. The list is never sent to us.
5. What is kept on your computer only
5.1 Your vault (Guard 360 and above) keeps short facts about your work and firm in your browser, to check AI replies against. If you switch on Remember personal details, it also keeps lasting facts about your own life; while that switch is off, facts about your own life are not sent. Only you can see them, and you can change or delete them. They are sent, redacted, with each reply check as described in 4.2, and a fact is held by us only if you choose to suggest it to your firm.
5.2 The Living Vault (Guard Enterprise) keeps notes, files, captures, people pages, and summaries of the chats and meetings you save, encrypted in your browser with a key that does not leave it. It is never uploaded to us or synced, and we cannot read it. Passages from it are sent, redacted and not stored by us, only for the features in 4.2. If you remove the extension or clear your browser data, it is gone unless you exported it; an export is not encrypted.
5.3 These may hold any fact you choose to keep, including a health fact you mention. They are never stored on our servers. A fact you keep may be sent, redacted, for the features in 4.2.
6. Who else handles information
We use Google Cloud and Firebase (database and server functions in Montreal; website delivery and sign-in on Google's own network), OpenAI (redacted text for AI features, in the United States), Stripe (payments) and Resend (emails, in the United States). The current list is at sourcesecure.ca/subprocessors. We do not sell or share information with anyone else, except where the law requires it.
7. Where information is kept
Our database and the server functions that handle your information are in Montreal, Canada. Sign-in accounts are held by Google's Firebase Authentication, which is not tied to that region. Redacted text for AI features and email delivery are processed in the United States, where they may be subject to US law.
8. Your rights
You can ask to see the information we hold about you, have it corrected, or have it deleted, and (in Quebec) receive it in a structured format. Because your firm controls your account, we may pass your request to your firm's admin. Write to support@sourcesecure.ca; we reply within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information.
9. Security
We encrypt information in transit and at rest, keep no downloadable server credentials, require two-step verification for our administrative accounts, and keep the database protected against deletion with 7-day recovery. If a breach affects your information, we will tell your firm within 72 hours and help it notify you where required.
10. Cookies
sourcesecure.ca uses no advertising or tracking cookies. Signing in stores a session in your browser so you stay signed in.
11. Children
SourceSecure is for businesses and is not meant for anyone under 18.
12. Changes
If we change this policy in a way that affects what is collected or who receives it, we will email firms' admins before the change takes effect. The date at the top shows the last change.
Getting in touch
Email support@sourcesecure.ca. SourceSecure is operated by JOLIVE Labs Inc.