Privacy policy
Draft. Last updated November 4, 2026.
[LAWYER] Draft in plain language, not final legal advice. Check every section against PIPEDA and CASL. The app’s own /privacy page must say the same thing about the chat, consent records, billing, referrals and the share page.Who we are
Good Company is run by Darius Dimitriadis, doing business as Dare Activation, in Ontario, Canada. Mailing address: Dare Activation, 1108 - 250 Consumers Road #247, North York, ON M2J 4V6, Canada. Contact: support@dareactivation.com.
[LAWYER] Confirm the legal entity name and who is the privacy officer under PIPEDA.This site
This landing page doesn’t ask for your email and doesn’t store what you type. When you type to Cass here or tap a starter, you go to the app at https://app.dareactivation.com, and the words you typed go with you in the link so your first answer is filled in.
The chat with Cass, before you have an account
What you tell Cass is used to design your team. The text is sent to Anthropic’s Claude API, which processes it for us.
You can start the chat without an account or an email address. When you do, we set one cookie in your browser, named gc_guest, that ties your browser to your chat. It is signed so it cannot be forged, hidden from scripts on the page, and lasts 7 days. If a link brought you here with a short source tag (for example where you found us), we keep that tag with your chat. If you typed your first answer on our home page, a second cookie, named gc_q, carries those words to the chat once. It is hidden from scripts on the page and lasts 10 minutes.
If you leave before giving an email, we keep that chat for up to 7 days so you can come back to it. After 7 days we delete the chat and all of its data, automatically. If you give an email and open the sign-in link, the chat becomes your account. If that email already has an account, you choose after signing in: use the new team (we keep a copy of your current team and can bring it back if you ask) or keep your current team (we save the new design in your account, under Settings). Either way the separate chat is then deleted. If you don’t choose, it is deleted after 7 days.
To protect the service from abuse, we use a bot check from Cloudflare (Turnstile) and limits on how many chats and answers one network can use. We store your IP address only as a salted hash, never the address itself: with your chat, in the limit counters and in the short log of blocked attempts. The counters run for a day or less, and blocked attempts are deleted after 7 days.
Your email and consent records
When your blueprint is ready, we ask where to send it. We use that email to send the blueprint and a sign-in link. A separate box, unticked unless you tick it, asks whether we may also send you tips and product news.
If you tick the box, we keep a record of your consent: your email, the exact words you agreed to, which version they were, the time, the page, the sender details shown to you, and a salted hash of your IP address (never the address itself). If you unsubscribe, we keep your email and the time so we never email you again.
[LAWYER] Set a retention period for consent records (keep proof while we rely on the consent, plus a buffer). Confirm with counsel that the blueprint email itself is not a commercial message under CASL.If you buy a plan, we may also send you tips on using your team, like the weekly recap, without the box, because you're a customer. That stops 2 years after your last payment, or straight away if you unsubscribe. Emails about the plan itself, like receipts, renewal notices and payment problems, still go while you have one. Each send record notes why we were allowed to send it.
[LAWYER] Confirm with counsel that a paying customer's implied consent (CASL s.10(10)(a)) covers onboarding tips, recaps, referral and yearly-plan emails without the box, and that 2 years from the last payment is the right clock (see the CASL decisions research of November 5).For every email we send you about your account or your team, we keep a short send record: which email it was, the address, when it was due and sent, which of two subject lines you got, why we were allowed to send it, and, if your mail app reports it, when it was opened or a link in it was clicked. We use this to avoid sending too many emails, to stop a series once you have done the thing it was about, and to make our emails better. If an email bounces or is marked as spam, we keep the address on a do-not-send list.
[LAWYER] Set a retention period for send records (proposed: 2 years) and confirm open and click tracking is acceptable under PIPEDA without a separate opt-in.Your team and connected apps
If you choose a plan, we keep your answers, the team’s chat, drafts, approvals and the rules your team learns from your edits, so you can see what was done and the team gets better. When you connect an app, we store the access it grants (encrypted) and use only what your team needs for the jobs you gave it. The app’s privacy page has the full Google section.
Google accounts. We connect Gmail, Google Calendar, Sheets and Drive through Nango (Nango, Inc., United States), which holds the Google access tokens for us. We never store your Google password or tokens. That’s why the Google sign-in screen shows the name Nango. Google grants broad access, but our helpers only read, write drafts, and send or add things after you approve them. They never delete, archive, label or forward your email.
Microsoft accounts. Outlook, Microsoft Teams and Excel connect through Nango too, which holds the Microsoft access tokens. The Microsoft sign-in screen shows the name Nango. Microsoft grants broad access (Teams includes directory and group permissions), but our software limits helpers to reading your mail, chats and workbooks, and posting a Teams message or adding a row only after you approve it. They never send or delete your email and never change your organisation’s directory, groups or teams. Work and school accounts may need their IT admin’s OK first. The app’s privacy page lists each permission.
If we ever want to use your Google data in a new way, or ask Google for more access, we will update this page and ask you again before using it.
Good Company’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Billing, refunds and pauses
Stripe handles your card. We never see or store the full card number. We keep your plan, billing status, renewal date, pauses used and any money-back request with the note you wrote, so a person can review it.
Referrals
If someone joins with your referral link, we record that link between your account and theirs, so the rewards can be applied. We never email your friends. You share the link yourself.
Your public share page
It’s off unless you turn it on. When it’s on, anyone with the link can see your helpers’ names, roles and what they’re ready to do. It never shows your answers, files, contacts or work, and it asks search engines not to list it. Turning it off removes the link.
Cookies and analytics
We don’t use analytics or advertising cookies unless you say yes in the cookie banner. If you say no, or ignore it, no analytics code is loaded. Your browser stores two small settings for this site in local storage: your light or dark choice (gc-theme) and your cookie answer (gc-analytics-consent).
If you say yes, we use PostHog to count page views and clicks on the main buttons, to test which version of the page works better, and to record sessions so we can see where the page is confusing. What you type is masked in recordings. You can change your answer with the “Cookie choice” link in the footer.
[LAWYER] List PostHog’s exact cookie names and lifetimes once the project key is set, and confirm the PostHog region.Who processes it for us
- Anthropic (Claude API): reads the text needed to design your team and do its work, and drafts the output.
- Nango (United States): holds the access tokens for the Google and Microsoft accounts you connect and passes our requests to Google and Microsoft.
- Stripe: payments, invoices and refunds.
- PostHog: analytics and page tests on this site, only after you say yes.
- Our hosting and database providers.
We don’t sell your information.
How long we keep it
A chat without an email: up to 7 days, then deleted with its data. The gc_guest cookie also lasts 7 days. The gc_q cookie lasts 10 minutes. Your account and your team’s work: while you have an account. If you delete your account in Settings, we delete your data from our database.
[LAWYER] Confirm backup retention, and how long billing records must be kept for tax law after an account is deleted.Your choices
You can unsubscribe at any time from the unsubscribe page or the link in any email. In the app you can download or delete your data. You can also ask to see, correct or delete what we hold by emailing support@dareactivation.com.
[LAWYER] Confirm response times for access and deletion requests (PIPEDA: 30 days).Where we offer this
Good Company is not available in Quebec yet.
Changes
If we change this policy, we update the date at the top and email you before a significant change takes effect.
Contact
Questions about privacy: support@dareactivation.com. Dare Activation, 1108 - 250 Consumers Road #247, North York, ON M2J 4V6, Canada, Ontario, Canada.