Privacy Policy

CanyonOps serves advisory firms. Most personal information in CanyonOps, such as details about a firm’s clients and their households, is entered or connected by the firm. For that information (“Customer Data”) the firm decides what is collected and why, and CanyonOps processes it on the firm’s behalf as its service provider, under our Terms of Service and Data Processing Agreement. If you are a firm’s client, the firm’s own privacy notice governs how it uses your information, and you should contact the firm with requests about it.

CanyonOps decides how to handle a smaller set of information directly, such as account details of the people who sign up, billing contacts, visitors to our public pages, and support correspondence. This policy describes both.

• Account information: name, email address, firm name, role, title, phone number, photo and preferences of firm team members and portal users, and a record of when you agreed to our Terms.
• Customer Data: what a firm stores in the Service, which can include client and household members’ names, contact details, birth dates, financial account names, types, custodians and balances, tasks, notes, messages, meeting records and transcripts, documents, and contacts at other professional firms.
• Connected services: when a user connects a calendar, CRM, meeting recorder or Google or Microsoft account, the data that service shares with us, such as calendar events or CRM contacts.
• Voice and AI inputs: text and audio you submit to AI features. Dictation audio is streamed for transcription and is not stored by CanyonOps; the resulting text is stored only if you save it.
• Billing information: plan, billing contact and payment history. Card details are collected and stored by Stripe, not by CanyonOps.
• Usage and device information: IP address, browser and device type, pages viewed, actions taken in the Service (kept in the firm’s activity log), and error reports.
• Communications: messages you send to our support team and your email preferences.

We use personal information to:

• provide, maintain and support the Service, including the features a firm turns on;
• authenticate users, secure accounts and prevent fraud, abuse and spam;
• process payments and manage subscriptions;
• send service emails, such as invitations, sign-in links, task notifications and billing notices;
• send product updates and our changelog, which you can turn off at any time in your profile settings;
• understand how the Service is used, fix problems and improve it; and
• comply with law and enforce our Terms.

We use Customer Data only to provide the Service to the firm and as the firm instructs. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use Customer Data to train generalized AI models.

When you use an AI feature, the information needed for that request is sent to our AI providers to generate a response. Our agreements with those providers restrict them to processing it to deliver the response, and do not permit them to use it to train their models. AI output is saved in your workspace only where the feature does so, for example a meeting summary you approve.

We share personal information only:

• Within your firm’s workspace, with other users according to the roles and portal permissions the firm sets;
• With service providers who process it on our behalf under contracts requiring them to protect it and use it only to serve us (listed below);
• With third-party services you connect, at your direction;
• For legal reasons, when we believe in good faith that disclosure is required by law, subpoena or court order, or is needed to protect the rights, property or safety of CanyonOps, our users or others. Where lawful, we will notify the affected firm before disclosing Customer Data; and
• In a business transfer, such as a merger or acquisition, subject to this policy.

Our current service providers are:

• Neon — Database hosting
• Vercel — Application hosting, file storage and privacy-friendly usage analytics
• Resend — Transactional email delivery
• Cloudflare — Bot protection on sign-in and sign-up forms (Turnstile)
• Stripe — Payment processing and billing
• Anthropic — AI processing for AI features
• Deepgram — Speech-to-text for dictation and voice features
• Recall.ai — Meeting recording and transcription, when a firm turns it on
• Sentry — Error monitoring
• Google and Microsoft — Sign-in and calendar sync, when a user connects them

Our service providers process data in the United States. The current list, with locations, is in the security pack on our Trust & Security page.

We use cookies that are necessary to sign you in and keep your session secure, and local storage to remember preferences such as your theme. We measure page performance and visits with Vercel Analytics, which does not use cookies to track you across sites. We do not use advertising cookies. Service model builder and password reset pages are excluded from analytics.

We keep account information while your account is active. We keep Customer Data for as long as the firm keeps its subscription, subject to the retention settings and holds the firm configures, and delete it after the subscription ends as described in our Terms, unless the law requires us to keep it longer. Our data retention policy is included in the security pack on our Trust & Security page.

We protect information with tenant isolation, encryption in transit and at rest, role-based access controls, audit logging, rate limiting and bot protection. No system is perfectly secure; if we learn of a breach affecting your information we will notify the affected firm, and you where required, as the law requires. Learn more on our Trust & Security page.

You can update your profile and email preferences in the Service at any time. Depending on where you live, you may have the right to request access to, correction of, deletion of, or a copy of your personal information, and to appeal if we decline a request. We will not discriminate against you for exercising these rights.

If your information is Customer Data, such as information about you as a firm’s client, please send your request to that firm; we will help the firm respond. For information CanyonOps controls, email support@canyonops.ai. We will verify your identity before acting on a request.

CanyonOps is a business service and is not directed to children under 13. Firms may record information about a client’s minor family members as part of their services; that information is Customer Data, handled on the firm’s behalf.

We may update this policy. If a change is material, we will notify firm administrators by email or in the Service before it takes effect. The date at the top of this page shows when it last changed. Questions? Contact CanyonOps, LLC at support@canyonops.ai.