N35 OS Privacy Policy

Contents

1. Who we are and what this policy covers

Prime Portal Inc ("Prime Portal", "we", "us" or "our") is the Canadian company behind N35 OS. This policy explains how we handle personal information on n35os.com, in communications about N35 OS, and when we provide an N35 OS workspace or connected service to a business.

The public website currently presents a pre-launch product and accepts founding-access requests and contact enquiries. Submitting a form does not create a paid subscription or a CRM workspace. Product demonstrations describe intended features; they do not mean every feature is already available. Workspace and integration provisions below apply when the relevant service is provided or enabled.

A "Customer" is the business or independent contractor operating a workspace. "Customer Content" means the records, documents, photos, communications and other information that a Customer and its authorized users manage through the service. Business records can contain personal information about workers, homeowners, clients and other individuals.

2. Information collected through the public website

Information you provide and routine request data

IP-based country lookup uses a locally hosted database. The pricing lookup does not send your IP address to a third-party geolocation API and does not request precise device location. It can be inaccurate, including when you use a VPN. Routine hosting logs may still contain the IP address used to request the page.

Please provide only information needed for your enquiry. The public forms do not request payment-card numbers, identity documents, passwords, project files or sensitive personal records.

3. How and why we use information

We use website information to respond to requested enquiries, administer founding-access requests, send the launch and product emails you choose to receive, display local pricing, maintain the website and protect it against abuse. We also retain information where needed to establish consent, meet legal obligations or resolve a complaint or dispute.

When we provide a workspace, we use the information needed to authenticate users, provide the functions the Customer chooses, support the account, operate authorized integrations, maintain security and recovery, and administer the service relationship. We do not use Customer Content to obtain renovation or construction work, solicit a Customer’s clients or gain a competitive advantage from a Customer’s contacts, prices, suppliers or projects.

Where a law requires a legal basis, we rely on consent for optional marketing; steps requested before a contract or performance of a contract for the services requested; legitimate interests in responding to business enquiries and protecting the service, where permitted and balanced against individual rights; and legal obligations where applicable. Customer Content is handled on the Customer’s instructions under the applicable service terms. Reading this policy does not itself provide consent to optional marketing or unrelated uses of data.

4. Our role and the Customer’s responsibilities

Prime Portal is responsible for personal information used for its own website, enquiries, service administration, security and communications. For personal information a Customer puts into its workspace for its own business purposes, the Customer normally determines the purpose, permitted users and instructions, and we process that content to provide the service.

A workspace may contain client and lead contacts, project addresses and scope, schedules and assignments, supplier and subcontractor details, estimates, quotes, invoices, job costs, documents, photos and project-linked communications. The Customer is responsible for having authority to provide that information, giving the notices required for its workers and clients, and configuring appropriate access.

Where you use a contractor’s client portal or receive a project document, that contractor’s privacy practices also apply. Contact the contractor about its project records; contact us if you need help identifying the responsible Customer or exercising a right relating to our own processing.

5. Google Drive and other connected features

When a workspace connects Google Drive, the account holder authorizes the connection through Google. The authorization screen identifies the requested permissions. Depending on the authorized feature, N35 OS can display file information and create, read, update or organize documents and photos on the account holder’s behalf. Your company chooses its Google account, storage plan and capacity.

Files stored in your Google Drive remain in that account if you stop using N35 OS. You can revoke the connection through your Google account settings. Revocation stops future authorized access; it does not automatically erase records already lawfully stored in a workspace, email conversation or retained backup.

Where the workspace’s backup and recovery functions are enabled, separate recovery copies may include workspace records and files handled through N35 OS. Copies controlled by Prime Portal are encrypted and used for backup recovery, not for our renovation business. Unrelated files in your Drive are not included merely because a file manager can display them.

If you connect email, the enabled feature may process messages, recipient details and exchanged attachments needed to display, send, reply to or link a conversation to a project. We do not gain access to a mailbox merely because you submit a website form. Other messaging or mobile features require their own enabled connection and any necessary notice or device permission.

We do not sell Google user data, use it for advertising or use Customer Content or connected communications to train general-purpose AI models. Connections are used to provide the features the Customer authorizes. Google also handles information under its own account terms and privacy policy.

6. Workspace sharing and device permissions

Customers choose which authorized users can access their workspace and which project information they share through a client portal, conversation, document or link. Recipients may retain copies of information shared with them. Customers should review recipients and permissions before sharing and should remove access when a working relationship ends.

The public website does not request access to your precise location, camera, microphone or device contacts. If a workspace or mobile feature needs additional device information, its purpose and permissions must be explained when the feature is enabled. This policy does not authorize hidden workforce monitoring or the collection of device data unrelated to an enabled function.

7. Service providers, recipients and processing locations

Information may be processed outside your province, state or country, including in Canada and the Netherlands, and may be accessible to courts, law enforcement or public authorities under the laws applying there. We remain responsible for the handling of information entrusted to our service providers and use safeguards appropriate to the processing and applicable law. Where a specific legal transfer mechanism is required, that requirement must be met; using the website does not waive it.

We may disclose information when required by law, to respond to a valid legal process, protect rights or investigate abuse, and to professional advisers where necessary and subject to appropriate confidentiality. A business transfer may involve information needed for that transaction, subject to applicable restrictions and notice requirements.

We do not sell personal information, rent the founding-access list or share Customer Content with other contractors for their independent marketing. Additional integrations or payment providers will be identified in the relevant service notice before they process information through an enabled feature.

8. Email updates and your choices

Founding-access forms ask you to actively agree to launch and product updates. We record that choice. A contact enquiry is used to respond to the enquiry and does not, by itself, subscribe you to promotional email.

You can stop launch and marketing updates at any time by replying to an email or emailing support@n35os.com with an unsubscribe request. No paid account or login is required. We will action the request without delay and, where Canada’s anti-spam rules apply, within 10 business days. We may keep the minimum record needed to respect the choice and demonstrate consent or withdrawal.

Service messages necessary to answer an enquiry, acknowledge a request or communicate about security or an existing service relationship are distinct from optional marketing. Automatic website mail is sent from no-reply@n35os.com, with replies directed to support@n35os.com.

9. Cookies, analytics and external links

This public website uses Google Analytics to measure page views, engagement time and successful form submissions without analytics or advertising cookies. An identifier held in browser memory links events until the page is closed or reloaded. The server sends these events without the contents of either form or URL query parameters. Advertising personalisation is disabled. Operational hosting logs are separate from analytics.

To turn off measurement, you can use your browser’s Global Privacy Control or Do Not Track setting, where available. This does not affect browsing or submitting either form. Local pricing is obtained from our own server. Storage used to remember your language and region, or to keep a workspace session active, is separate from analytics.

Links to Instagram, LinkedIn, Google or other external sites open services operated by those providers. Clicking a link may disclose ordinary request information to the destination, and the destination’s privacy policy applies. We do not control how those services handle information you provide to them.

10. Payments

The public website does not collect card details or take payment for founding access. Confirmed members choose a plan and set up billing when invited to activate a workspace. The billing flow will identify the payment provider and explain the data needed for the transaction. We may receive the billing and transaction information needed to administer a subscription, without storing a full payment-card number on this marketing website.

11. Security and protected list copies

The website uses HTTPS. Founding-access email addresses and visitor metadata are encrypted in the website database; a separate keyed lookup value supports duplicate detection. Encryption keys are kept outside the public website files. Registration dates, consent dates and delivery status remain in the database so requests can be administered.

An authorized administrative notification includes an updated list as an AES-256 encrypted ZIP attachment. Its password is supplied separately, not in the same email. The database remains the main record. The attachment is an additional administrative copy; it is not made available through a public download link.

Enquiry records and ordinary email messages are not covered by a promise that every field or email body is end-to-end encrypted. Authorized staff and the service providers needed to operate the service can access information for their tasks. We limit access and use technical and organizational safeguards appropriate to the information. No transmission or storage system can be guaranteed absolutely secure.

If an incident affects personal information, we assess and address it and notify affected individuals or authorities where applicable law requires. We do not ask you to waive notification rights through this policy.

12. Retention, recovery and deletion

We retain founding-access information while administering the request and the updates you asked to receive, unless you withdraw or ask us to delete it, subject to any information we must retain for a lawful reason. We retain contact enquiries and related correspondence for as long as reasonably needed to handle the matter and maintain necessary business records.

Consent and withdrawal records, fraud-prevention information, transaction records or dispute evidence may need to be retained after an active relationship ends. We limit any retained information to the purpose that justifies keeping it and delete or anonymize information when that purpose no longer applies.

Workspace retention and deletion depend on the Customer’s instructions, applicable service terms and legal record-keeping obligations. Cancelling a subscription is not the same as deleting a workspace. Copies in your own Google Drive or already received by another person are not automatically deleted by closing an N35 OS account.

Residual backup and administrative copies may remain until they are overwritten or securely removed under the relevant retention process. They are kept for recovery or another lawful retention purpose, rather than reused for unrelated activities. Contact us about a deletion request so it can be considered across the records we control.

13. Access, correction and other privacy requests

Email support@n35os.com to ask about personal information we hold about you, request access or correction, request deletion, withdraw optional consent or raise a privacy concern. Explain the record or interaction involved and what you are asking us to do. We do not require a paid account to make a request.

We verify identity and authority proportionately before disclosing or changing personal records. Do not send an identity document unless we explain why it is necessary and provide an appropriate way to supply it. A person acting for someone else may need to show their authority.

Where a Customer controls the information, we may refer the request to that Customer and assist it with the request. We remain responsible for our own processing. We respond within the period required by applicable law and explain a permitted refusal, limitation or extension.

14. Rights in your location

Where PIPEDA or an applicable provincial privacy law governs, you can request access and correction, withdraw consent subject to lawful limits and challenge our handling of personal information. Under PIPEDA, access requests generally require a response within 30 days, subject to permitted extensions. You may complain to the Office of the Privacy Commissioner of Canada or the appropriate provincial authority.

Where the GDPR, UK GDPR or another applicable privacy law grants them, your rights may also include erasure, restriction, portability, objection to certain processing and withdrawal of consent without affecting earlier lawful processing. Residents of jurisdictions with additional privacy rights may contact us to exercise the rights applicable to their situation or appeal a decision where that right exists.

We do not penalize a person for exercising a protected privacy right. You may contact the competent data-protection or consumer authority in your location. The availability of a right depends on the law’s scope and applicable exceptions; the map of planned launch countries is not a certification of compliance with every local requirement.

15. Children and young workers

N35 OS is intended for professional business use and the public website is not directed to children. If you believe a child has provided personal information inappropriately, contact us so we can investigate and take appropriate action. Customers are responsible for the lawful handling of information about any young workers or other individuals whose information they add to a workspace.

16. Changes to this policy

We update this policy when our information-handling practices change and show the effective date above. Where required, we will give additional notice of a material change or seek consent for a new purpose before using information in that way. Updated wording does not retrospectively authorize an unrelated use of Customer Content.

17. Contact and complaints

Privacy contact: Prime Portal Inc, Canada. Email support@n35os.com and identify your message as a privacy request or concern. You may also use the Contacts page on n35os.com. We will consider the concern and explain the available response or next step. You can raise a complaint with a competent authority without first holding an active subscription.