Privacy Policy

1. Introduction

Rosewood Software Systems Inc., operating as Rosewood Systems (“Rosewood Systems,” “we,” “us,” “our”), is committed to protecting personal information under our control.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• Visit our website
• Complete the AI Opportunity Scorecard
• Subscribe to Fewer Fires, our newsletter
• Contact us or book a conversation
• Take part in an AI Audit, including as a team member who is interviewed
• Purchase or use our consulting, implementation, training, or software services

It should be read together with our Terms of Service and any project documents that apply to you.

2. Scope and Our Role

We are responsible for personal information we collect for our own business: through our website, scorecard, newsletter, sales conversations, and the AI Audit.

When we build, host, or support a tool for a Client, we may process personal information on that Client’s behalf. In that case the Client decides why the information is collected and how it is used, and is responsible for giving notices and obtaining consent. Questions about information collected through a Client’s own tool should usually go to that Client.

This policy does not cover third-party websites or services we do not control.

3. Personal Information We Collect

We record or transcribe a call only after giving notice and, where required, getting consent.

4. How We Use Personal Information

We use personal information to:

1. Respond to inquiries and decide whether we are a good fit.
2. Score your scorecard answers and send you your results.
3. Send Fewer Fires to subscribers.
4. Prepare proposals, invoices, and agreements.
5. Conduct the AI Audit and prepare your Roadmap.
6. Deliver consulting, implementation, training, and support.
7. Keep business, financial, and tax records.
8. Protect our systems, prevent fraud, and enforce our agreements.
9. Meet legal and regulatory obligations.

We may use aggregated or de-identified information to improve our services and to inform our writing, as described in Section 7.

5. Consent

We collect, use, and disclose personal information with consent, or as otherwise permitted or required by law. Consent may be express or implied depending on the sensitivity of the information and what you would reasonably expect.

We will ask for new consent before using personal information for a materially different purpose, unless the law permits otherwise. You may withdraw consent at any time, subject to legal or contractual limits; doing so may affect our ability to provide a service.

6. Marketing Email and Text Messages

We send marketing email, including Fewer Fires, only to people who have subscribed or given consent, or where Canada’s Anti-Spam Legislation otherwise allows it.

Completing the scorecard does not subscribe you to Fewer Fires unless you choose to opt in.

Every marketing email includes an unsubscribe link, and you can also unsubscribe by emailing us. You may still receive service messages such as invoices, project updates, and security notices.

When you book a call, you can choose to receive text messages from us about your booking, such as confirmations and reminders. Ticking the box is optional and is not a condition of booking. Message frequency varies, and message and data rates may apply. Reply STOP at any time to opt out, or HELP for help.

We do not sell or share your mobile number or your text messaging consent with third parties or affiliates for their marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party, except the service providers that send the messages for us.

7. AI Audit Interviews and De-identified Lessons

7.1 If you are interviewed during an AI Audit

Your employer or the business owner has asked us to review how work moves through the business. As part of that review, we may interview you about your role, tasks, tools, and handoffs.

• Taking part is voluntary.
• We use what you tell us only to understand how the work is done and to prepare recommendations for the business.
• Unless agreed otherwise in writing, we report findings to the owner as themes, not as quotes attributed to you, and we do not share your individual interview notes.
• Please do not share personal details we do not need, such as health, family, or financial information.
• You can contact us directly with questions about your information using the details in Section 15.

7.2 De-identified lessons in our writing

We write about what we learn from our work, including in Fewer Fires, articles, and social media. When we do, we remove or change any details that could reasonably identify a Client, a team member, or a customer, and we never disclose confidential information.

Clients may ask in writing, before a project starts, that nothing from their engagement be used this way, even in de-identified form, and we will honour that request.

8. How We Share Personal Information

We do not sell personal information.

8.1 Service providers

We use service providers that process personal information on our behalf, only as needed to provide their services. Our current providers include:

When we use AI providers, we use business or commercial services where appropriate and do not authorize Client information to be used to train generally available AI models without the Client’s written agreement.

8.2 Other disclosures

We may also disclose personal information:

• To our professional advisers, such as lawyers, accountants, and insurers
• When required by law, court order, or a lawful request from a regulator or law enforcement
• To protect the rights, safety, or property of Rosewood Systems, our Clients, or others
• As part of a proposed or completed merger, acquisition, financing, or sale of our business, with appropriate confidentiality protections
• With your direction or consent

8.3 Processing outside Canada

Rosewood Systems is based in Ontario, Canada. Some providers store or process information outside Canada, including in the United States. Information processed there may be subject to that country’s laws and accessible to its courts and authorities. We use contractual and other measures appropriate to the processing and remain responsible for information under our control.

9. Cookies and Embedded Tools

Our website uses only cookies that are strictly necessary for it to work and stay secure. We do not use advertising cookies, retargeting pixels, or behavioural advertising.

Some pages may include tools run by third parties, such as a Substack signup form or the scorecard. Those providers may set their own cookies under their own privacy policies.

The scorecard keeps your answers, name and email in your own browser while you complete it, so you can pick up where you left off. Your name and email reach us when you start, so we can send you a link back if you stop partway; your answers reach us only when you finish. The saved copy is deleted when you reach your results, or ignored after 30 days.

We use Umami, a privacy-focused analytics service, to count visits and see how people move through the website and the scorecard: which pages are viewed, where visitors came from, how far they get through the scorecard, which answers are chosen, and the scores that result. Umami sets no cookies, does not track you across other websites, and we do not send it your name, email, company name or website.

10. Retention

We keep personal information only as long as reasonably needed for the purposes in this policy, or as the law requires.

When information is no longer needed, we securely delete or de-identify it. Copies may remain in backups until they are overwritten in the normal cycle. Clients may ask us to delete their materials sooner, and we will do so where reasonably possible.

11. Security

We use reasonable administrative, organizational, and technical safeguards, such as access controls, restricted access, secure hosting, encryption where appropriate, and removing system access once a project ends. No system is completely secure.

12. Security Incidents

If a security incident affects personal information, we will investigate, contain it, and take reasonable steps to reduce harm. Where a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and keep a record of the breach.

13. Your Rights

Subject to legal exceptions, you may ask us to:

• Confirm whether we hold personal information about you and give you access to it
• Tell you how it has been used and to whom it has been disclosed
• Correct inaccurate or incomplete information
• Delete information we no longer need, or stop an optional use
• Stop sending you marketing email

We may need to verify your identity first. We may refuse or limit access where the law allows, for example where it would reveal another person’s information or confidential commercial information, and we will explain why where permitted.

If your information was collected through a tool we run for a Client, we may refer your request to that Client.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction. Depending on where you live, you may have additional rights under local law, and we will respond to verified requests as that law requires.

14. Sensitive Information, Children and Automated Decisions

Sensitive information. Please do not send us government ID numbers, full financial account details, passwords, medical records, or other sensitive information through our website, scorecard, or interviews unless we have agreed in writing that a project requires it.

Children. Our website and services are intended for adults and businesses. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has given us information.

Automated decisions. Our recommendations and any AI tools we build support human decisions. Unless agreed in writing, they are not intended to make final, fully automated decisions with legal or similarly significant effects on a person.

15. Changes and Contact

We may update this policy to reflect changes in our services, providers, or the law. We will post the new version with a revised “Last updated” date and, where required, give additional notice or ask for consent.

Questions, requests, or complaints about privacy can be sent to: