Who is the controller

Good Ventures Lab Inc. (Canada) is the data controller for the Actium managed platform. Subprocessors (cloud infrastructure, authentication, observability, support tooling) act as processors under data-processing agreements.

What we collect

Account data. Name, email address, billing address, and payment reference (tokenized). We use this to operate your account and invoice you.

Assistant run metadata. For each scheduled run: workspace ID, assistant ID, trigger time, skills invoked, credential names used (not values), status, and the signed receipt hash. We do not store the content of API responses or the data processed by your assistants.

CRM and Tasks data. If you use Actium CRM or Actium Tasks, contacts and task records you create are stored in our database and associated with your workspace. This data belongs to you; it is exportable and deletable on request.

Integration credentials. The names (not values) of credentials stored in your vault. Credential values are encrypted and not readable by Actium staff.

Support interactions. When you contact us, we retain the conversation for the duration of the support relationship plus three years.

Marketing site. Standard server-side request logs (IP, user agent, URL) retained 30 days. No third-party advertising trackers on actium.app.

What we do not collect

We do not store the content of data fetched by your assistants from third-party integrations. We do not run advertising trackers. We do not sell or rent user data.

Retention

Run metadata. Retained for seven years by default (configurable in the order form). CRM and Tasks data. Retained until you delete it or close your account, then 90 days for recovery, then permanently deleted. Account data. Duration of account plus seven years for tax and audit. Server logs. 30 days. Support tickets. 3 years from resolution.

Sharing

We share with cloud infrastructure providers (Google Cloud Platform), the authentication provider (Clerk), and government bodies where required by lawful process. When an assistant invokes a third-party integration, the request payload passes through to that API. Actium does not retain a copy of that payload.

Cross-border transfer. Data is processed in Canada and the United States by default. We offer data-residency addenda for enterprise customers on request.

Your rights

You may access, correct, export, or delete your personal data by writing to [email protected]. We respond within 30 days. EU residents have rights under GDPR; California residents under CCPA/CPRA; Canadian residents under PIPEDA. We honor all of them.

Updates

Material changes are announced on the changelog and emailed to billing contacts at least 30 days in advance. Questions: [email protected].

Last updated 2026-04-26.