Legal

Privacy Policy

Version 1.1. In effect from October 12, 2026 (adds payments through Stripe; version 1.0 was in effect from October 11, 2026). See also our Terms of Service.

In short. ITvated is an IT operations console. To run it we collect the details of the people who use it and information about the computers they choose to manage. We use that to provide, secure and support the service. We do not sell personal information, we do not show ads, and we do not send your data to outside AI services. Your data is kept in Canada. You can ask us what we hold, correct it, or have it deleted.

1. Who we are

ITvated Inc. is a Canadian corporation based in Grande Prairie, Alberta. We run the ITvated website (itvated.com), the ITvated console (app.itvated.com), the help centre (docs.itvated.com) and the ITvated agent, the Windows software our customers install on the computers they manage. In this policy, "ITvated", "we" and "us" mean ITvated Inc.

You can reach us about anything in this policy at michael@itvated.com. That address is our privacy contact.

2. Two different roles

For our own purposes (visitors to our website, people who ask for a walkthrough, people who create an account), we decide why and how personal information is used, and this policy describes that.

For our customers, we act as a service provider. A customer is an organization such as a company or an IT services provider. Its administrators decide which computers are monitored, which people can use the workspace and what is done with the information. If you work for a customer, or a customer manages your computer, that organization is the one to ask first about what is monitored and why. We process that information only to provide the service to the customer, and we will pass your request to them if it concerns their workspace.

3. What we collect

When you visit itvated.com

Normal hosting records: your IP address, the time, the page requested and your browser type.
Anonymous counts of how many visitors click the main buttons and how far down the page they scroll. These counts are not tied to you, and we do not record them at all if your browser sends a Do Not Track or Global Privacy Control signal.
The website uses no cookies and no third-party tracking scripts.

When you ask for a walkthrough

Your name, company, email address and, if you choose to give it, phone number. We use these to reply and to arrange the conversation. This does not sign you up for marketing.

When you create or use an account

Your name, work email address, company name, and the role and permissions you are given.
Your password, which we keep only as a one-way scrambled value (a hash) that we cannot read back. If you turn on authenticator-app sign-in, the authenticator secret is kept encrypted and recovery codes are kept as hashes.
Sign-in and security records: the time, your IP address and a description of your browser or device, for each sign-in and for important actions in the workspace (an audit log).
What you and your colleagues enter: tickets, notes, settings and similar content.
Email we send you for the service: account activation, password reset, alert emails and, if your organization turns them on, summary reports. You can switch alert emails off in Settings.

When your organization subscribes

Payments are handled by Stripe. You enter card details on Stripe's own secure pages; ITvated never sees or stores your full card number.
Stripe tells us what we need to run the subscription: the billing contact's name and email address, the billing address if one is given, the plan and number of computers, and whether each payment succeeded. We keep invoices and payment records.

From computers your organization manages

When an administrator installs the ITvated agent on a computer, that computer reports information about itself. This is technical information about the machine. It can include:

Its name, manufacturer, model, serial number and Windows version.
Its processor, memory and storage capacity, and how much it is using (health and performance readings).
Its network details, such as IP addresses, gateway addresses and which common server ports are open.
Which services are running, which software is installed, and Windows update and security status.
How much memory is used by different programs, grouped.
Integrity and tamper events about the agent itself.

By design, the agent does not read the contents of your files, emails or messages, your browsing history, your keystrokes or your screen, and it does not collect passwords. It does only the specific, approved actions an administrator asks for, such as refreshing a reading or restarting a service.

In your browser

One cookie that keeps you signed in. It is needed for the service to work, it is not readable by scripts on the page, and it expires after 30 days.
Your display preferences (such as density and reduced motion) are saved in your browser's own storage. They never leave your computer.
If a page in the console fails to display, the console can send us a random incident reference number so we can look into it. It contains no page content, web address or anything you typed.

4. Why we use it

To provide the service: show you your computers, raise alerts, run the actions you approve, and keep a record of what happened.
To keep it secure: check sign-ins, detect misuse and keep an audit trail.
To support you and to contact you about your account and the service.
To meet legal obligations and to protect our rights.
To understand, in aggregate, how the service is performing so we can maintain and improve it.

We do not sell personal information and we do not use it for advertising. ITvated's built-in assistant, Alex, works from your own workspace's data inside ITvated. It does not send your data to outside AI providers.

Within a customer's workspace, the information is visible to that customer's authorized users, according to the permissions their administrators set. Outside the workspace, we share it only with the service providers that help us run ITvated, and only as needed:

Provider	What they do for us	Where
OVHcloud	Hosts the ITvated service and database. Also stores our encrypted backups.	Canada: Beauharnois, Quebec (service); Toronto, Ontario (backups)
Namecheap (Private Email)	Sends and receives the email we send you and the email sent to our address.	Provider's mail servers; may be outside Canada
Stripe	Processes subscription payments, keeps payment cards on file, and sends invoices and receipts. Receives billing details only, never data from your computers.	Stripe's servers; may be outside Canada, including the United States
Cloudflare	Internet address (DNS) records for our domain. Visitors' traffic to our service does not pass through them.	Global network
Microsoft Azure	Digitally signs our software so Windows can verify it came from us. Receives no customer data.	United States

We may also disclose information if the law requires it, to respond to a valid legal request, or to protect the safety and security of people or the service. If ITvated is involved in a merger, sale or financing, information may be transferred as part of that, and we will tell you if that changes who is responsible for it. If you connect an outside service to your workspace (for example a ticketing system), the information you choose to exchange with it goes to that service, under its own terms.

6. Where it is kept

The ITvated service and its database run on servers in Quebec, Canada, and encrypted backups are kept in Toronto, Canada. Email and payments are handled by the providers listed above, and some of them may process that information outside Canada. Where information is processed outside Canada, it may be accessible to the courts and authorities of that country under its laws.

7. How long we keep it

Computer health readings (performance measurements) are deleted automatically after 14 days.
Account, sign-in, audit and ticket records are kept for as long as the workspace is active, because the audit trail is part of what the service is for.
Invoices and payment records are kept for as long as tax law requires (in Canada, generally six years), even after a workspace closes.
Walkthrough requests are kept only as long as needed to respond and follow up. Ask us and we will delete yours.
Backups are encrypted and removed after 30 days. A deletion in the live service therefore disappears from backups within about 30 days.
When a customer closes a workspace, or asks us to, we delete its data from the live service. We may keep limited records where the law requires it or where we need them to resolve a dispute.

8. How we protect it

We use encrypted connections (TLS) everywhere, keep each customer's workspace separate from every other, store passwords only as hashes, keep sensitive secrets encrypted, offer authenticator-app sign-in, record administrative actions in an audit log, and keep encrypted backups. Access to our servers is limited to the people who need it and uses keys, not passwords. No system is perfectly secure, so we cannot promise absolute security. If a breach creates a real risk of significant harm to someone, we will tell the people affected and the privacy regulator as the law requires.

9. Your choices and rights

You can ask us, at michael@itvated.com, to:

tell you what personal information we hold about you and how it is used;
correct information that is wrong or incomplete (signed-in users can also change their own name in Settings);
delete your information, or close your account; and
stop using your information for a purpose you agreed to, where the law lets you withdraw that agreement.

We may need to confirm who you are first. We aim to answer within 30 days and always within the time the law allows. If your information is in a customer's workspace, we may refer you to that customer.

If you are not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

10. The law that applies

ITvated Inc. is based in Alberta. We handle personal information in line with Alberta's Personal Information Protection Act and, where it applies, Canada's Personal Information Protection and Electronic Documents Act.

11. Children

ITvated is a business service. It is not meant for children, and we do not knowingly collect personal information from anyone under 18.

12. Changes to this policy

If we change this policy we will post the new version here with a new date. If the change is significant, we will also email the administrators of workspaces, in advance where we can.

13. Contact

ITvated Inc., Grande Prairie, Alberta, Canada
michael@itvated.com