Privacy Policy

1. Introduction

Rosewood Software Systems Inc., operating as Rosewood Systems, respects your privacy and is committed to protecting personal information under our control.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• Visit our website
• Contact us
• Purchase or use our products or services
• Participate in a consultation, strategy session, implementation project, or training program
• Use software or an artificial intelligence system operated, hosted, built, or supported by Rosewood Systems
• Otherwise interact with us

In this Privacy Policy:

• “Rosewood Systems,” “Company,” “we,” “us,” and “our” refer to Rosewood Software Systems Inc., operating as Rosewood Systems.
• “You” and “your” refer to individuals who visit, purchase, access, or use our products and services.
• “Client” refers to an individual or organization that purchases products or services from Rosewood Systems.
• “End User” refers to an employee, customer, member, student, client, contractor, or other person who uses a Rosewood Systems product or a client-branded AI experience.
• “Personal information” means information about an identifiable individual.

This Privacy Policy should be read together with our Terms of Service and any applicable proposal, invoice, order form, statement of work, service agreement, data-processing agreement, or other project document.

2. Scope

This Privacy Policy applies to personal information handled by Rosewood Systems through:

• Our website
• Our contact and onboarding processes
• Our software products
• AI Business Partner™ implementations
• Client-branded AI experiences
• Business Brain™ knowledge organization
• AI strategy and implementation services
• AI education and training
• Managed hosting, maintenance, and support
• Related consulting and professional services

This Privacy Policy does not apply to information handled independently by a third-party website, platform, application, or service that we do not control.

3. Our Role

Rosewood Systems may handle personal information in different roles depending on the circumstances.

3.1 Information collected for our business

Rosewood Systems determines how and why personal information is collected when you:

• Visit our website
• Contact us
• Request information
• Book a consultation
• Purchase our services
• Communicate with our team
• Receive invoices or project communications
• Subscribe to marketing communications
• Maintain a direct account with Rosewood Systems

Rosewood Systems is responsible for managing this information in accordance with applicable privacy laws.

3.2 Information processed for a Client

When Rosewood Systems builds, hosts, maintains, or supports a software product or AI experience for a Client, we may process personal information on the Client’s behalf.

In those circumstances:

• The Client determines why the information is collected and how it will be used.
• The Client is responsible for providing appropriate privacy notices.
• The Client is responsible for obtaining any legally required consent.
• Rosewood Systems processes the information to provide the contracted products and services.
• The Client’s privacy policy and terms may also apply.

Questions about information collected through a Client’s branded AI experience may need to be directed to that Client.

4. Personal Information We Collect

The personal information we collect depends on how you interact with us.

4.1 Identity and contact information

We may collect:

• Name
• Business name
• Job title
• Email address
• Telephone number
• Mailing address
• Billing address
• Country, province, state, or region
• Contact preferences
• Professional or social-media information you voluntarily provide

4.2 Business and professional information

We may collect:

• Organization name
• Industry
• Professional role or department
• Business goals and challenges
• Products and services
• Brand guidelines
• Communication preferences
• Business processes and workflows
• Coaching, consulting, educational, or operational methodologies
• Program, membership, customer, or audience information
• Information provided during consultations and onboarding

4.3 Account information

Where account functionality is available, we may collect:

• Username
• Account identifier
• Authentication information
• Account role
• Access permissions
• Login activity
• Account settings
• User preferences

Passwords may be managed by a third-party authentication provider and may not be directly accessible to Rosewood Systems.

4.4 Payment and transaction information

When you purchase a product or service, we may collect:

• Billing name
• Billing address
• Business name
• Invoice details
• Transaction amount
• Currency
• Payment status
• Purchase history
• Tax information
• Limited payment-method information, such as card type and the last digits of a payment card

Payments and invoices may be processed through Stripe.

Rosewood Systems does not ordinarily receive or store complete payment-card numbers, security codes, or banking credentials.

4.5 Client Materials

Clients may provide information and materials required to build, configure, train, test, maintain, or support their systems.

Client Materials may include:

• Documents
• Presentations
• PDFs
• Worksheets
• Playbooks
• Frameworks
• Policies
• Training materials
• Course materials
• Videos
• Audio recordings
• Transcripts
• Coaching-call or meeting records
• Business documentation
• Customer-support materials
• Brand and marketing content
• Standard operating procedures
• Databases
• Structured data
• Other information selected by the Client

Client Materials may contain personal information relating to employees, customers, contractors, clients, students, members, or other individuals.

Clients are responsible for ensuring that they have the legal right and authority to provide this information to Rosewood Systems.

4.6 AI interactions

When you use an AI experience operated, built, hosted, or supported by Rosewood Systems, information processed may include:

• Questions and prompts
• Messages
• Information included in a conversation
• Files submitted through the experience
• Relevant portions of approved Client Materials
• AI-generated responses
• Feedback about responses
• Usage dates and times
• Session information
• Technical and diagnostic information
• User or account identifiers, where applicable

Rosewood Systems does not currently maintain a separate persistent conversation history for End User interactions unless a particular service agreement expressly states otherwise.

4.7 Communications

We may collect information contained in:

• Emails
• Contact forms
• Support requests
• Strategy sessions
• Sales conversations
• Project meetings
• Surveys
• Feedback
• Testimonials
• Social-media messages
• Other communications with us

We will record or transcribe a call only where appropriate notice or consent has been provided.

4.8 Website and technical information

When you visit our website, our website provider may automatically process limited technical information such as:

• Internet Protocol address
• Browser type
• Device type
• Operating system
• Date and time of access
• Pages requested
• Security and diagnostic information
• Information required to deliver the website

We do not currently use third-party advertising cookies or third-party analytics cookies.

5. How We Collect Personal Information

We may collect personal information:

• Directly from you
• From a Client that authorizes you to access its system
• From your employer or organization
• Through our website or contact forms
• Through AI interactions
• Through payment and invoicing providers
• Through booking and communication tools
• From service providers acting on our behalf
• During consultations, onboarding, implementation, training, support, or maintenance
• From publicly available professional or business sources where permitted by law

6. How We Use Personal Information

We may use personal information for the following purposes.

6.1 Providing products and services

We may use information to:

• Respond to inquiries
• Assess potential projects
• Prepare proposals and invoices
• Process purchases
• Conduct onboarding
• Build and configure AI systems
• Develop and maintain software
• Organize Client Materials
• Create knowledge systems
• Test and refine AI responses
• Provide training and consulting
• Deliver, host, maintain, and support products
• Authenticate users
• Provide customer service
• Troubleshoot technical issues
• Fulfil contractual obligations

6.2 Operating AI systems

We may use information to:

• Process prompts
• Generate AI responses
• Retrieve information from approved Client Materials
• Apply the Client’s approved instructions and framework
• Evaluate response quality
• Identify inaccurate or unsupported output
• Test and improve a client-specific implementation
• Apply safety and security controls
• Investigate suspected misuse

6.3 Operating and improving our business

We may use information to:

• Administer our website and systems
• Maintain project records
• Manage Client relationships
• Improve our products and services
• Develop new features
• Conduct internal reporting
• Protect our systems
• Protect our intellectual property
• Train our personnel
• Maintain financial and corporate records

Where appropriate, we may use aggregated or de-identified information for analysis, testing, service improvement, and business planning.

6.4 Communicating with you

We may use personal information to:

• Respond to messages
• Provide project updates
• Deliver invoices and receipts
• Send service notices
• Send account or security communications
• Request feedback
• Provide information about relevant products, services, events, or training

6.5 Protecting legal and security interests

We may use information to:

• Verify identity
• Prevent fraud
• Protect accounts
• Detect malicious or unauthorized activity
• Enforce agreements
• Establish or defend legal claims
• Comply with legal, tax, accounting, and regulatory obligations
• Respond to lawful government, court, or regulatory requests

7. Consent

We collect, use, and disclose personal information with consent where required, or as otherwise permitted or required by applicable law.

Consent may be express or implied depending on:

• The sensitivity of the information
• The circumstances in which it is collected
• The reasonable expectations of the individual
• The purpose for which it is being used

We will seek additional consent before using personal information for a materially different purpose unless the new use is otherwise permitted or required by law.

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice.

Withdrawing consent may affect our ability to provide a product, feature, or service that depends on the information.

8. AI Providers

Rosewood Systems may use third-party artificial intelligence providers, including:

• OpenAI
• Anthropic, including Claude

These providers may process prompts, messages, relevant portions of approved Client Materials, and generated responses to deliver AI functionality.

Information submitted through an AI experience may therefore be transmitted to one or more AI providers.

The information processed may include:

• User prompts
• Conversation content
• Relevant Client Materials
• Files
• System instructions
• AI-generated responses
• Technical metadata

Rosewood Systems does not authorize Client Materials to be used to train generally available AI models unless the Client has expressly agreed in writing.

We use business or commercial AI services where appropriate. However, provider practices may vary depending on the product, account type, settings, contractual terms, and service configuration.

Clients requiring specific model-training restrictions, data-location requirements, deletion periods, or security controls must communicate those requirements before implementation.

9. AI Conversation History

Rosewood Systems does not currently maintain a separate persistent history of End User AI conversations unless a particular project agreement expressly provides otherwise.

This means that Rosewood Systems does not currently provide persistent memory, saved conversation history, or long-term personalization as a standard feature.

However, information submitted through an AI experience may be temporarily processed or retained by OpenAI, Anthropic, hosting providers, or other technology providers according to:

• The provider’s applicable commercial terms
• The product and account type
• The configured retention settings
• Security and abuse-monitoring requirements
• Legal obligations

End Users should not submit unnecessary sensitive, regulated, confidential, or personal information through an AI experience.

If a future service includes persistent memory, saved conversation history, user profiles, or personalization, the applicable privacy notice and service documentation will explain how that information is collected, used, stored, and deleted.

10. Development Tools

Rosewood Systems uses software-development tools to build, test, and maintain its products and services.

These tools may include Visual Studio Code and other development environments.

Rosewood Systems does not list every locally installed development tool as a separate service provider. Where a development tool, extension, cloud service, or integration transmits Client Materials to an external provider, that processing will be handled in accordance with the applicable project requirements and this Privacy Policy.

11. Payment Processing

We use Stripe for payment processing, invoicing, and transaction management.

Payment information submitted through Stripe is processed according to Stripe’s terms and privacy practices.

Rosewood Systems generally receives only the payment and transaction information required to confirm payment, issue invoices, maintain financial records, and manage the Client relationship.

We do not ordinarily receive or store complete payment-card numbers or card security codes.

12. How We Share Personal Information

We may disclose personal information to the following categories of recipients.

12.1 Service providers

We may use service providers that support:

• Artificial intelligence model processing
• Payment processing
• Invoicing
• Cloud hosting
• Data storage
• Website operation
• Authentication
• Email communication
• Appointment scheduling
• Document management
• Video conferencing
• Software development
• Customer support
• Security and system maintenance
• Professional services

Our current providers may include Stripe, OpenAI, and Anthropic.

Service providers may process information only as reasonably necessary to provide their services, subject to their applicable contractual obligations and legal requirements.

12.2 Clients and authorized users

Where we provide a Client-branded product or AI experience, information may be accessible to:

• The Client that commissioned the system
• The Client’s authorized administrators
• Authorized employees, coaches, facilitators, managers, or support personnel
• Other users permitted under the Client’s policies and system configuration

The extent of access depends on the specific service and Client instructions.

12.3 Professional advisers

We may disclose information to:

• Lawyers
• Accountants
• Auditors
• Insurers
• Tax advisers
• Security advisers
• Other professional consultants

12.4 Legal and regulatory disclosures

We may disclose personal information where reasonably necessary to:

• Comply with applicable law
• Respond to a subpoena, warrant, court order, or lawful request
• Cooperate with a regulator or law-enforcement authority
• Protect the rights, safety, and property of Rosewood Systems, our Clients, users, or others
• Investigate fraud, misuse, or security incidents
• Enforce our Terms of Service or other agreements

12.5 Business transactions

Personal information may be disclosed as part of a proposed or completed:

• Merger
• Acquisition
• Financing
• Corporate reorganization
• Investment
• Sale of assets
• Transfer of a business division
• Insolvency proceeding

Appropriate confidentiality and information-protection measures will be used where required.

12.6 With your direction or consent

We may disclose information where you direct us to do so or provide consent.

Rosewood Systems does not sell personal information in exchange for money.

13. International and Cross-Border Processing

Rosewood Systems is based in Ontario, Canada.

Some service providers, AI providers, payment processors, hosting platforms, or Client systems may process or store information outside Ontario or outside Canada, including in the United States.

When information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction and may be accessible to courts, governments, regulators, or law-enforcement authorities in accordance with local law.

Rosewood Systems uses contractual, administrative, and technical measures appropriate to the nature of the processing and remains responsible for personal information under its control.

14. Cookies and Website Technologies

Our website may use strictly necessary cookies or similar technologies required for:

• Website operation
• Security
• Session management
• Basic functionality
• Remembering essential preferences

We do not currently use:

• Advertising cookies
• Retargeting pixels
• Third-party analytics cookies
• Behavioural advertising technologies

If we introduce analytics, advertising, or other non-essential tracking technologies, we will update this Privacy Policy and obtain consent where required.

Disabling strictly necessary cookies may affect website functionality.

15. Marketing Communications

We may send marketing communications where you have provided consent or where otherwise permitted by law.

Marketing communications may include information about:

• Software products
• AI implementation services
• AI Business Partner™
• Training
• Events
• Educational materials
• Company updates
• Relevant offers

You may unsubscribe using the link included in an email or by contacting us.

Even after unsubscribing from marketing, you may continue to receive transactional or service-related communications, including:

• Invoices
• Receipts
• Project communications
• Account notices
• Security communications
• Information affecting an active service

16. Data Retention

Rosewood Systems retains personal information only for as long as reasonably necessary to:

• Provide our products and services
• Complete the applicable engagement
• Fulfil the purposes described in this Privacy Policy
• Meet contractual obligations
• Provide reasonable post-project support
• Maintain appropriate business records
• Resolve disputes
• Enforce agreements
• Protect security
• Comply with legal, tax, accounting, and regulatory requirements

Our general retention practices are as follows.

16.1 Client Materials

Client Materials are retained during the active engagement.

Unless otherwise agreed, Client Materials are ordinarily retained for up to 12 months after the engagement ends for purposes such as:

• Providing post-project support
• Correcting implementation issues
• Responding to Client questions
• Facilitating requested updates
• Allowing a returning Client to resume work without immediately resubmitting all materials

At the end of the 12-month period, Client Materials will ordinarily be securely deleted, anonymized, or removed from active systems unless continued retention is authorized or required.

16.2 Ongoing services

Where a Client purchases ongoing hosting, maintenance, managed services, support, or updates, Client Materials may be retained for the duration of that active service relationship.

16.3 Extended retention

Information may be retained for longer than 12 months where:

• The Client requests or authorizes continued retention
• The information remains necessary for an active service
• A contract requires continued retention
• The information is required to resolve a dispute
• The information is required to establish or defend a legal claim
• Applicable law requires or permits continued retention

16.4 AI conversations

Rosewood Systems does not currently maintain a separate persistent End User conversation history unless expressly included in a particular service.

Third-party AI and technology providers may temporarily process or retain prompts, messages, and responses according to their applicable commercial terms, settings, and legal obligations.

16.5 Invoices and business records

Invoices, transaction records, contracts, payment records, and tax or accounting records are retained for the period required under applicable tax, corporate, accounting, and recordkeeping laws.

16.6 Communications and project records

Emails, approvals, project decisions, support records, and other business communications may be retained for as long as reasonably necessary to:

• Manage the Client relationship
• Document the agreed scope
• Provide support
• Resolve disputes
• Maintain appropriate business records

16.7 Deletion

When information is no longer reasonably required, it will be securely deleted, anonymized, or removed from active use.

Residual copies may remain temporarily in backups or disaster-recovery systems until they are overwritten through ordinary backup cycles.

Clients may request earlier deletion of their Client Materials. We will honour such requests where reasonably possible, subject to legal, contractual, technical, security, and recordkeeping requirements.

17. Security Safeguards

Rosewood Systems uses reasonable administrative, organizational, physical, and technical measures designed to protect personal information against:

• Loss
• Theft
• Unauthorized access
• Unauthorized disclosure
• Copying
• Modification
• Misuse
• Destruction

Safeguards may include:

• Access controls
• Authentication
• Restricted administrative access
• Secure hosting
• Encryption where appropriate
• Confidentiality obligations
• Data-minimization practices
• Software and system updates
• Backup procedures
• Security monitoring
• Vendor assessment
• Incident-response procedures

The safeguards used depend on the sensitivity, amount, format, location, and intended use of the information.

No internet transmission, cloud platform, storage service, AI system, or security measure can guarantee absolute security.

You are responsible for protecting passwords, devices, access links, accounts, and authentication credentials under your control.

18. Security Incidents

If we become aware of a security incident involving personal information, we will investigate and take reasonable steps to contain, assess, and address the incident.

Where required by applicable law, we will notify:

• Affected individuals
• The appropriate privacy regulator
• Other organizations that may be able to reduce the risk of harm

PIPEDA requires organizations to report and notify certain breaches that create a real risk of significant harm, and to maintain records of security safeguard breaches. Further information is available from the Office of the Privacy Commissioner of Canada.

Clients must promptly notify Rosewood Systems if they suspect unauthorized access to:

• An account
• An access link
• A Client-controlled system
• An integration
• Client Materials
• A Rosewood Systems product

19. Accuracy

We make reasonable efforts to ensure that personal information used for ongoing purposes is accurate, complete, and current.

You are responsible for informing us when your personal information changes.

You may request correction of inaccurate or incomplete information by contacting us.

20. Accessing and Correcting Personal Information

Subject to applicable exceptions, you may request:

• Confirmation of whether we hold personal information about you
• Access to personal information under our control
• Information about how it has been used
• Information about organizations to which it has been disclosed
• Correction of inaccurate or incomplete information

We may need to verify your identity before responding.

We may refuse or limit access where permitted or required by law, including where disclosure would reveal:

• Personal information about another person
• Confidential commercial information
• Information protected by legal privilege
• Information relating to an investigation
• Information that cannot reasonably be separated from protected information

Where access is refused, we will explain the reason where legally permitted.

21. Withdrawal of Consent and Deletion Requests

You may request that we:

• Stop certain optional uses of your information
• Withdraw consent
• Correct information
• Delete certain information
• Close an account
• Stop marketing communications

Requests may be subject to:

• Legal and regulatory retention requirements
• Existing contractual obligations
• Security needs
• Recordkeeping requirements
• Technical limitations
• The rights of other individuals
• Information required to establish or defend legal claims

Withdrawing consent may prevent us from providing a product, feature, or service that depends on the information.

22. Client-Controlled Information Requests

If your information was collected through software or an AI experience provided on behalf of one of our Clients, you should ordinarily direct your request to that Client.

Rosewood Systems may assist the Client in responding where required by the applicable agreement.

Rosewood Systems may not be authorized to independently disclose, change, or delete information controlled by a Client.

23. Sensitive Information

Our general website, contact forms, and AI experiences are not intended for unnecessary sensitive or regulated information.

Unless expressly approved for a particular project, do not submit:

• Government identification numbers
• Complete financial account information
• Payment-card security codes
• Passwords
• Authentication credentials
• Detailed medical records
• Biometric information
• Highly sensitive employment records
• Information subject to professional secrecy
• Information you are legally prohibited from sharing
• Personal information unrelated to the service

If sensitive information is required for a particular project, additional contractual, security, privacy, and technical measures may be necessary.

24. Children and Young People

Our website and business services are primarily intended for organizations and adults.

We do not knowingly collect personal information directly from children under 13 without appropriate authorization or consent.

Clients that provide a Rosewood Systems product to children or young people are responsible for:

• Determining that the use is appropriate
• Providing age-appropriate privacy information
• Obtaining required parental or guardian consent
• Implementing appropriate safeguards
• Complying with applicable privacy, education, and child-protection laws

Contact us if you believe a child has provided personal information without appropriate authorization.

25. Automated Decisions

Rosewood Systems AI products may generate:

• Recommendations
• Explanations
• Drafts
• Educational information
• Coaching guidance
• Operational support
• Other AI-generated output

Unless expressly agreed in writing, our products are not intended to make final, fully automated decisions that produce legal or similarly significant effects concerning an individual.

Clients remain responsible for:

• Reviewing AI-generated output
• Applying appropriate human oversight
• Explaining how the system is used
• Ensuring that decisions comply with applicable law
• Preventing discriminatory, unfair, or inappropriate use

26. Third-Party Links and Services

Our website, software, or AI products may contain links to third-party websites, platforms, or services.

Rosewood Systems does not control the privacy practices of third parties.

Information you provide directly to a third party will be governed by that party’s privacy policy and terms.

You should review those policies before providing personal information.

27. Your Responsibilities

You are responsible for:

• Providing accurate information
• Protecting your account credentials
• Using secure devices and networks
• Limiting access to authorized users
• Avoiding unnecessary personal information in AI prompts
• Ensuring that you have authority to provide information about another individual
• Providing required notices to End Users
• Obtaining legally required consent
• Complying with applicable privacy, employment, professional, contractual, and industry requirements
• Informing us of suspected unauthorized access or misuse

28. Privacy Questions and Complaints

You may contact us with:

• Privacy questions
• Access requests
• Correction requests
• Deletion requests
• Consent-withdrawal requests
• Privacy complaints

We will:

1. Review the request.
2. Verify identity where necessary.
3. Investigate the circumstances.
4. Respond within a reasonable period.
5. Explain our decision where legally permitted.
6. Take corrective action where appropriate.

If you are not satisfied with our response, you may have the right to contact the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction over the matter.

29. Additional Rights Based on Location

Depending on where you live, you may have additional rights under applicable privacy law.

These may include rights relating to:

• Access
• Correction
• Deletion
• Withdrawal of consent
• Data portability
• Objection to certain processing
• Restriction of processing
• Automated decision-making
• Complaints to a privacy regulator

Rosewood Systems will respond to verified requests as required by applicable law.

Nothing in this Privacy Policy limits rights that cannot legally be waived.

30. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes to our products or services
• New technology
• Changes to our service providers
• Changes to our information-handling practices
• Operational changes
• Legal or regulatory developments

The updated version will be posted with a revised “Last Updated” date.

Where required, we will provide additional notice or obtain consent for material changes.

31. Privacy Officer and Contact Information

Questions, requests, or complaints concerning privacy may be sent to: