Privacy Policy

1. Introduction and Scope

IPSARY ("IPSARY", "we", "us", or "our") is a digital productivity, planning, personal organization, project management, and AI-assisted service.

This Privacy Policy explains how personal information is collected, processed, stored, disclosed, protected, and retained when individuals use IPSARY.com, its applications, accounts, subscription services, AI features, and related communications.

We seek to comply with privacy laws applicable to our activities, including, where applicable, the European Union General Data Protection Regulation (EU GDPR), UK GDPR, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable Canadian provincial laws, applicable United States federal and state privacy laws, and other mandatory local laws.

2. Responsible Parties and Technology Providers

IPSARY determines the purposes and essential means of processing account, subscription, commercial, and operational personal information and acts as a controller or equivalent responsible organization for those activities.

The IPSARY application is developed and operated using Base44 technology and infrastructure associated with the Wix ecosystem.

Base44 and its relevant service entities provide underlying application infrastructure, data processing, hosting, authentication, storage, and other platform capabilities, subject to their applicable agreements.

Additional authorized infrastructure providers, payment processors, AI service providers, and technical subcontractors may process information where necessary.

Using a third-party infrastructure provider does not eliminate IPSARY's responsibilities under applicable data protection laws.

3. Information We Process

Depending on how the Service is used, personal information may include:

• Account information, such as name, email address, account identifiers, authentication status, and preferences.
• Subscription and transaction information, including plan selection, billing status, transaction references, payment history, and AI credit balances.
• Technical and security information, such as IP addresses, device details, browser identifiers, authentication events, error reports, and security logs.
• Communications submitted to customer support or through contact forms.
• User-generated workspace content, such as projects, tasks, routines, schedules, goals, studies, financial planning records, contacts, personal notes, and optional wellbeing-related entries.
• Information deliberately submitted to AI-powered features, including prompts, instructions, and contextual material necessary to process a request.
• Cookie and analytics information, only where the relevant technologies are actually enabled.

We do not require users to provide unnecessary sensitive information. Users should avoid submitting passwords, government identification numbers, payment card numbers, medical records, or highly sensitive information into free-text or AI fields unless expressly required by an authorized feature with suitable safeguards.

4. Private Workspace Access

IPSARY is designed to provide private, account-based workspaces with access controls.

Under ordinary service operations, IPSARY personnel do not routinely open, inspect, read, sell, or commercially exploit the private content users enter into their workspaces.

Each authenticated user is intended to access only the records permitted to that user or their expressly authorized collaborators.

This description does not constitute an unconditional guarantee that no technical or privileged access could ever occur. Exceptional access or processing may be possible through authorized infrastructure providers, lawful instructions, technical maintenance, incident investigation, user-authorized support, security operations, or other legally permitted and necessary circumstances.

Account information, billing metadata, usage information, and technical logs may be processed separately from private workspace content.

5. Purposes and Legal Bases

We process personal information to operate the Service, authenticate accounts, provide requested features, maintain subscriptions, allocate AI credits, prevent fraud, secure systems, respond to requests, fulfill legal obligations, and improve reliability.

Where the GDPR or UK GDPR applies, the relevant legal bases may include performance of a contract, compliance with legal obligations, legitimate interests subject to balancing and applicable rights, and consent where required.

Optional marketing communications, nonessential cookies, and certain sensitive-data processing will rely on the appropriate legal basis and user choices.

We do not treat acceptance of this Privacy Policy as blanket consent for every data processing activity.

6. Base44, Wix, and Authorized Service Providers

IPSARY relies on Base44's technology and the relevant Wix-associated service ecosystem.

Personal information may be processed through Base44 infrastructure and authorized subprocessors, including hosting, databases, logging, communications, security, and AI-related services.

Infrastructure and processing arrangements may change in accordance with applicable contracts and laws.

IPSARY is not a guarantor of uninterrupted operation or absolute security of infrastructure controlled by independent providers. However, IPSARY remains responsible for obligations that applicable law assigns to it.

The official Base44 information is available at:

• base44.com/privacy-policy
• base44.com/dpa
• base44.com/security

7. Artificial Intelligence

Where users activate AI-powered features, selected inputs and relevant context may be transmitted to authorized AI processing services to generate responses.

AI processing may involve external model providers and their subprocessors.

IPSARY does not authorize unrestricted commercial exploitation of private workspace content. Any model-training restrictions or opt-out settings must reflect the actual contractual and technical configuration of each provider.

AI responses may be inaccurate, incomplete, or unsuitable for consequential decisions.

Users should not enter unnecessary confidential or sensitive third-party information into AI requests.

8. Cookies and Analytics

IPSARY may use necessary cookies or equivalent technologies for authentication, sessions, security, language preferences, and application functionality.

Optional analytics, advertising, or other nonessential tracking technologies, if enabled, will be described and managed according to applicable law.

Where prior consent is required, nonessential technologies must remain disabled until valid consent is obtained.

Users must be given access to applicable cookie preference controls and legally required withdrawal or opt-out mechanisms. Inside the application, consent preferences can be reviewed at any time in the privacy area of the account.

9. International Data Transfers

Base44 states that its default application data storage region is the United States, although configuration, service providers, and processing locations may vary.

Accordingly, personal information may be stored or processed outside the user's country, including through service providers in the United States and other jurisdictions.

Where required, cross-border transfers will rely on recognized adequacy decisions, applicable contractual safeguards, standard contractual clauses, the UK international data transfer mechanisms, or another legally valid transfer mechanism.

International processing does not remove applicable privacy rights.

10. Retention and Deletion

We retain personal information only for the period reasonably necessary for legitimate and disclosed processing purposes, contractual performance, security, legal compliance, dispute resolution, and required recordkeeping.

Private workspace information generally remains associated with the account until deleted through supported features or lawful account deletion procedures, subject to technical and legal limitations.

Deletion may not immediately remove information from scheduled backups, security logs, legally required financial records, or information subject to lawful retention obligations.

Backup retention and physical deletion periods depend on documented infrastructure policies and must be verified before specific timelines are promised.

11. Security and Incident Response

IPSARY uses the security controls available through its application architecture and authorized service providers, including access restrictions, authentication, and security-related monitoring where configured.

Base44 publicly describes encryption, access controls, security scanning, and other infrastructure protections.

No internet-connected system can guarantee absolute security.

IPSARY will assess known incidents, take appropriate protective action, cooperate with relevant providers, and provide legally required notifications to affected individuals and authorities.

12. Privacy Rights

Depending on applicable law, individuals may have rights to obtain information about processing, access personal information, request correction or deletion, restrict or object to certain processing, request portability, withdraw consent, and challenge qualifying automated decisions.

Requests may be submitted to the privacy contact identified in this document. Registered users can also exercise export, consent management, and account deletion requests directly inside the application.

We may verify identity to prevent unauthorized disclosure. Requests will be handled within applicable statutory periods, subject to lawful exceptions.

European Union and European Economic Area: Individuals have GDPR rights and may lodge complaints with a competent supervisory authority. No representative in the European Union has been appointed; requests may be directed to the privacy contact above.

United Kingdom: Individuals have rights under the UK GDPR and may complain to the Information Commissioner's Office (ICO). No representative in the United Kingdom has been appointed; requests may be directed to the privacy contact above.

United States: Residents of states with applicable consumer privacy laws may have additional rights. Where the California CCPA/CPRA applies to IPSARY, qualifying consumers may request access, deletion, correction, and applicable sale/sharing or sensitive-data restrictions without unlawful discrimination. Applicable opt-out and Global Privacy Control signals will be honored where legally required. IPSARY will not claim that data is never sold or shared until its advertising and analytics configuration has been verified.

Canada: Individuals may exercise applicable access, correction, consent, and complaint rights under PIPEDA or applicable provincial legislation, including Quebec requirements where relevant.

13. Children

IPSARY is intended for adults and is not designed as a service directed to children.

Account eligibility, age verification, parental-consent requirements, and any restrictions concerning minors must be enforced through the actual application and applicable law.

If information relating to a child is processed without an appropriate legal basis, an authorized person may contact us to request review and appropriate action.

14. Third-Party Information

Users may enter information relating to employees, clients, contacts, collaborators, or other individuals.

Users are responsible for ensuring that their collection and submission of such information is lawful and that they possess any required authorization or lawful basis.

Where IPSARY processes third-party information on a business customer's documented instructions, the parties' respective controller and processor responsibilities will be determined under applicable law and relevant agreements.

15. Changes and Contact

We may update this Policy to reflect changes in technology, law, providers, features, or business operations.

Material changes will be communicated where required by law.

The effective date will be updated when a revised Policy becomes operative.

Privacy inquiries and rights requests are handled through the legal operator and the privacy contact identified at the top of this page.