1. Introduction
Campaign Arks ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
Canadian Privacy Law Compliance: This policy complies with Canadian privacy laws, including:
- Personal Information Protection and Electronic Documents Act (PIPEDA) - Federal
- Personal Information Protection Act (PIPA) - Alberta & British Columbia
- Act Respecting the Protection of Personal Information in the Private Sector - Québec
- Other applicable provincial and federal privacy legislation
2. Merchant of Record & Payment Data
Campaign Arks does NOT collect, process, or store payment information.
We use Lemon Squeezy (Lemon Squeezy Limited) as our Merchant of Record. Lemon Squeezy is the seller of all subscriptions and independently collects and processes all payment-related data, including:
- Credit card numbers and payment card information
- Billing addresses and contact information for payment purposes
- Transaction history and invoices
- Tax identification numbers and VAT/GST information
- Payment method details (PayPal accounts, bank transfer information, etc.)
- Payment-related customer support communications
Campaign Arks has no access to your payment card details. Lemon Squeezy's data collection and processing practices are governed by Lemon Squeezy's Privacy Policy, available at lemonsqueezy.com/privacy.
We receive from Lemon Squeezy only: confirmation of active subscriptions, subscription tier and status, and anonymized transaction identifiers for reconciliation purposes. No payment card information or detailed billing information is shared with Campaign Arks.
Data Controller & Processor Roles
For transparency and compliance with Canadian privacy laws:
- Data Controller: Campaign Arks is the data controller for all Service data, campaign content, and user account information
- Data Processors: Lemon Squeezy (payment data), Google AI (AI processing), Vercel (hosting), Neon (database storage), Better Auth (authentication)
As data controller, we are responsible for ensuring that all data processors provide adequate protection for your personal information in accordance with this Privacy Policy and applicable privacy laws.
3. Information Campaign Arks Collects
3.1 Account Information
- Email Address: Used for account creation, authentication, and service communications
- Name: Optional display name for your account
- Authentication Credentials: Password or third-party authentication tokens (Google, etc.)
- Subscription Status: Whether your subscription is active, cancelled, or expired (received from Lemon Squeezy)
3.2 User Content
- Campaign Data: Notes, documents, characters, storylines, maps, and other campaign content you create
- AI Interactions: Prompts you provide to AI features and the generated content
- Preferences: Settings, themes, and feature configurations
3.3 Automatically Collected Information
- Usage Data: Pages visited, features used, time spent on the Service, interaction patterns
- Device Information: Browser type, operating system, device type, IP address
- Cookies & Session Data: Authentication tokens, session identifiers, preference cookies
- Log Data: Server logs, error reports, and diagnostic information for Service improvement
3.4 Communications
- Messages you send to our support team
- Feedback and feature requests you provide
4. How We Use Your Information
Campaign Arks uses collected information for the following purposes:
- Service Delivery: To provide, maintain, and improve the Service, including AI-powered features
- Account Management: To manage your account, authentication, and subscription access
- AI Service Improvements: To improve AI features using anonymized, aggregated usage patterns (your specific campaign content is never used to train public AI models)
- Customer Support: To respond to your inquiries and provide technical assistance
- Analytics: To understand usage patterns, feature adoption, and user experience to improve the Service
- Service Communications: To send service updates, security alerts, feature announcements, and administrative messages
- Legal Compliance: To comply with legal obligations and enforce our Terms & Conditions
5. Data Anonymization & AI Training
We take your privacy seriously regarding AI training:
- Your Content is Private: Your specific campaign content, character notes, plot details, and story elements are never used to train public AI models or shared with other users
- AI Prompts are Private: The specific prompts you submit to AI features are not used to train public models
- Anonymized Usage Patterns Only: We may analyze anonymized, aggregated usage patterns to improve our Service (e.g., "users often create NPCs with specific attribute types" or "users typically organize campaigns in these ways")
- No Personal Data in Training: Any data used for improvements is stripped of all personally identifiable information, user identifiers, and specific content details
- Third-Party AI Providers: When you use AI features, your prompts are processed by Google AI. These prompts are subject to Google's data processing terms for enterprise customers, which do not use your data for training public models. See Google's privacy policy for more details
6. Data Storage & Security
We implement industry-standard security measures to protect your data:
- Database Encryption: Your data is stored in secure Neon PostgreSQL databases with encryption at rest
- Transmission Security: All data transmitted between your device and our servers is encrypted using TLS/SSL
- Access Controls: Strict internal access controls limit who can access your data
- Infrastructure Security: We use Vercel and Neon for hosting, both of which maintain SOC 2 Type II compliance
- Regular Security Reviews: We regularly review and update our security practices
- No Payment Data Storage: We do not store payment card information (Lemon Squeezy handles this as Merchant of Record)
However, no method of transmission over the Internet is 100% secure. While we strive to protect your data using commercially acceptable means, we cannot guarantee absolute security.
7. Third-Party Services
Campaign Arks uses the following third-party services:
7.1 Lemon Squeezy (Merchant of Record)
Lemon Squeezy (Lemon Squeezy Limited) acts as the seller and Merchant of Record for all subscriptions. Lemon Squeezy independently collects and processes all payment data. Campaign Arks receives only subscription status information from Lemon Squeezy. Lemon Squeezy's privacy practices are governed by their Privacy Policy at lemonsqueezy.com/privacy.
7.2 Other Service Providers
- Authentication: Better Auth for user authentication and session management
- Analytics: Vercel Analytics for anonymized usage statistics and performance monitoring
- AI Services: Google AI for content generation features (does not use your data for public model training)
- Hosting & Infrastructure: Vercel (hosting) and Neon (database)
These services have their own privacy policies and may collect data independently. We encourage you to review their privacy practices.
8. Your Privacy Rights
Under Canadian privacy law (PIPEDA) and other applicable laws, you have the following rights regarding data collected by Campaign Arks:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal data and User Content (subject to legal retention requirements)
- Data Portability: Request a copy of your campaign content in JSON format for export
- Withdraw Consent: You may withdraw consent for data processing where consent is the legal basis. Note that withdrawing consent may limit your ability to use certain Service features. To withdraw consent, contact support@campaignarks.com with "Withdraw Consent" in the subject line
- Opt-Out: Opt out of non-essential communications (marketing, feature announcements)
- Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada
To exercise these rights regarding data held by Campaign Arks, contact us at support@campaignarks.com. We will respond to your request within 30 days.
For payment data rights: Contact Lemon Squeezy directly, as they independently control all payment information. Campaign Arks cannot access or modify payment data on your behalf.
9. Data Retention
We retain your information for as long as necessary to provide the Service:
- Active Accounts: Data is retained while your account is active and your subscription is current
- After Subscription Cancellation: User Content is retained for 30 days after subscription cancellation to allow account reactivation or data export
- After Data Deletion Request: Upon request, we will delete your User Content within 30 days
- Inactive Accounts: Accounts inactive for 2+ years may be deleted after notice
- Legal Requirements: Some data may be retained longer to comply with legal obligations (e.g., tax records, dispute resolution)
- Anonymized Data: Aggregated, anonymized usage analytics may be retained indefinitely as they cannot be linked back to you
Note: Payment data retention is controlled by Lemon Squeezy. We do not control Lemon Squeezy's data retention policies.
10. Cookies & Tracking Technologies
We use cookies and similar technologies for:
- Essential Cookies: Required for authentication, session management, and core Service functionality (cannot be disabled without affecting Service operation)
- Preference Cookies: Remember your settings, theme preferences, and UI configurations
- Analytics Cookies: Understand how you use the Service to improve features and user experience (anonymized data only)
You can control cookies through your browser settings, but disabling essential cookies will affect Service functionality. Note that Lemon Squeezy may also use cookies for payment processing, which are governed by Lemon Squeezy's policies.
11. International Data Transfers
While Campaign Arks is based in Canada, our Service infrastructure may involve data storage or processing in other countries, including the United States.
Data Storage Locations
- User Content & Accounts: Stored on Neon PostgreSQL databases (hosted in US/EU regions)
- AI Processing: Google AI processes prompts (may use US or international data centers)
- Web Hosting: Vercel (global edge network, including US)
- Payment Data: Lemon Squeezy (stored per their infrastructure policies)
Safeguards for International Transfers
When we transfer data internationally, we ensure appropriate safeguards are in place:
- Use of service providers with SOC 2 Type II or equivalent certifications
- Contractual data protection obligations with service providers requiring comparable levels of protection
- Encryption in transit and at rest
- Compliance with PIPEDA's requirements for adequate protection in foreign jurisdictions
Lemon Squeezy, as an independent Merchant of Record, handles payment data transfers according to their own privacy policy and applicable payment card network requirements.
12. Children's Privacy
The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at support@campaignarks.com, and we will delete such information.
13. Data Breach Notification
In the event of a data breach that affects your personal information, we will notify you within 72 hours of becoming aware of the breach, as required by applicable law. Notification will include:
- The nature of the breach and data affected
- Steps we are taking to address the breach
- Recommended actions you should take to protect yourself
Note: Payment data breaches would be handled by Lemon Squeezy, as they control all payment information.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email (to the address associated with your account) or through a prominent notice on the Service at least 30 days before changes take effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. The "Last Updated" date at the top of this policy indicates when it was last revised.
15. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:
- Right to know what personal information is collected, used, shared, or sold
- Right to delete personal information
- Right to opt-out of the sale of personal information
- Right to non-discrimination for exercising your CCPA rights
Campaign Arks does not sell personal information. For payment data rights under CCPA, contact Lemon Squeezy directly.
16. European Privacy Rights (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including:
- Right to access your personal data
- Right to rectification of inaccurate data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with a supervisory authority
Our legal basis for processing is: (1) performance of contract (providing the Service), (2) legitimate interests (improving the Service), and (3) consent where required. For payment data, Lemon Squeezy acts as an independent data controller.
17. Accountability
Campaign Arks is accountable for personal information under our control, including information transferred to third-party service providers for processing. In accordance with PIPEDA Principle 1 (Accountability):
- We maintain written contracts with all service providers requiring them to provide comparable levels of protection as outlined in this Privacy Policy
- We regularly review and audit our data protection practices and those of our service providers
- We have designated internal responsibility for privacy compliance and responding to privacy inquiries
- We maintain records of data processing activities and third-party data sharing
- We provide training to employees on privacy obligations and best practices
You can contact us at any time regarding our accountability practices or to raise privacy concerns.
18. Contact Us & Data Protection Officer
If you have questions or concerns about this Privacy Policy or our data practices regarding data collected by Campaign Arks, please contact us:
Campaign Arks
Email: support@campaignarks.com
CAMPAIGN ARKS
Business Identification Number: 1001398876
[Complete Business Address]
Canada
Note: Complete business address will be added before public launch.
For questions about payment data, billing information, or payment-related privacy concerns:
Contact Lemon Squeezy directly at lemonsqueezy.com/help or view their Privacy Policy at lemonsqueezy.com/privacy.
Privacy Regulator Contact:
You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe we have not complied with applicable privacy laws.