Gulo AI Canada ("Gulo," "we," "us," or "our") is committed to protecting the privacy of our customers and users. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with the Horizon IAM Risk Analyzer service ("Service"). It applies to all users who access the Service through AWS Marketplace or gulo.ai.
1. Who We Are
Gulo AI Canada is a business operating in British Columbia, Canada. We are the controller of personal information processed under this Privacy Policy. As a BC-based organization, we are subject primarily to British Columbia's Personal Information Protection Act (PIPA), with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applying to interprovincial and international transfers of personal information.
2. Information We Collect
2.1 Account and Contact Information
When you subscribe to the Service via AWS Marketplace, we receive information from AWS including your name, email address, company name, billing address, and AWS account identifier. We collect this data as it is necessary to perform our contract with you and to manage your account, communicate with you, and provide the Service.
2.2 AWS IAM Metadata (Customer Data)
The core function of the Service requires read-only access to IAM configuration metadata in the AWS accounts you connect. This includes:
- IAM user, group, role, and policy names and ARNs
- Policy documents (permission statements)
- IAM configuration attributes (e.g., password policy, MFA status, access key ages)
- Trust relationship configurations
We do not collect, access, or process the contents of your S3 buckets, databases, application data, or other non-IAM resources. We do not collect AWS credentials (access keys or secrets) — access is provided through a read-only cross-account IAM role created in your account. We collect this data pursuant to the contract between Gulo and Customer, as it is necessary to provide the Service.
2.3 Usage Data
We collect technical information about how you interact with the Service, including:
- Dashboard interactions and feature usage
- API request logs (timestamps, endpoints, response codes — not payload contents)
- Browser type, operating system, and IP address
- Error and performance telemetry
2.4 AI Copilot Interactions
When you use the AI Copilot (IR Copilot) feature, your queries and the relevant IAM context are processed to generate responses. These interactions may be retained to improve the quality and accuracy of the Service. We do not use them to train general-purpose AI models accessible to third parties.
2.5 Session Tokens
The Service uses session tokens stored in browser memory to maintain your authenticated session. These are not tracking cookies and are not shared with third parties. We also use essential cookies required for authentication and session management. We do not use third-party advertising or tracking cookies.
2.6 Communications
If you contact us for support, feedback, or other purposes, we retain those communications and use them to respond to your inquiry.
3. How We Use Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Analyze IAM configurations and generate risk findings and recommendations
- Send transactional emails (account setup, findings alerts, subscription notifications)
- Respond to support requests and inquiries
- Monitor Service performance, reliability, and security
- Comply with legal obligations
- Improve and develop the Service (using aggregated, de-identified data)
We do not sell your personal information or Customer Data to third parties.
4. Legal Basis for Processing (PIPA / PIPEDA)
Under Canadian privacy law, we process personal information with your consent (obtained at subscription) and as necessary for the performance of our contract with you. In limited cases, we may process information where we have a reasonable purpose as contemplated under PIPEDA (such as security monitoring and fraud prevention) or where required by law.
5. Data Sharing and Disclosure
5.1 Service Providers
We engage trusted third-party service providers who process data on our behalf, including:
- Amazon Web Services (cloud infrastructure — your data stays in your selected AWS region)
- Transactional email providers (for notifications)
- Analytics and monitoring tools (using aggregated, de-identified data)
All service providers are bound by contractual data processing obligations consistent with this Policy.
5.2 AWS Marketplace
Your subscription and billing are managed through AWS Marketplace. AWS may share limited account information with us as part of the subscription fulfilment process. AWS's own privacy policy governs its data practices.
5.3 Legal Requirements
We may disclose information if required by law, court order, or government authority, or where necessary to protect the rights, property, or safety of Gulo, our customers, or others.
5.4 Business Transfers
If Gulo is involved in a merger, acquisition, or sale of assets, Customer Data and personal information may be transferred as part of that transaction, subject to equivalent privacy protections.
6. Data Retention
We retain Customer Data for the duration of your Subscription and for up to sixty (60) days after termination, after which it is deleted or anonymized. Account records and billing information are retained as required by applicable law, including tax and financial record-keeping requirements under BC and federal legislation. Usage logs and telemetry are retained for up to twelve (12) months. You may request earlier deletion by contacting privacy@gulo.ai.
7. Data Security
We implement technical and organizational security measures appropriate to the sensitivity of the information, including:
- Encryption of data at rest (AWS KMS) and in transit (TLS 1.2+)
- Private S3 buckets with block-public-access enabled
- Least-privilege IAM roles for all Service components
- Dead-letter queues and error monitoring for reliability
- CloudWatch log retention and access controls
- Regular security reviews and dependency updates
No security system is impenetrable. In the event of a breach of security safeguards involving personal information that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required under PIPEDA's breach notification rules. We will also notify the BC Office of the Information and Privacy Commissioner where required under PIPA.
8. International Data Transfers
The Service is deployed within AWS regions you select. If your selected region is outside Canada, your Customer Data will be processed in that region. When personal information is transferred outside Canada, it remains subject to the laws of the jurisdiction where it is processed. We take steps to ensure equivalent protection through contractual safeguards. For customers in the European Economic Area or United Kingdom, data transfers will be subject to appropriate safeguards. Please contact privacy@gulo.ai for details.
9. Your Rights
Under BC's Personal Information Protection Act (PIPA) and PIPEDA, you have the following rights with respect to your personal information:
- Access: Request a copy of the personal information we hold about you.
- Correction: Request correction of inaccurate or incomplete information.
- Deletion: Request deletion of your personal information, subject to legal retention obligations.
- Withdrawal of consent: Withdraw consent for processing where consent is the legal basis.
- Portability: Receive your data in a structured, machine-readable format.
- Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the BC Office of the Information and Privacy Commissioner (OIPC).
To exercise any of these rights, contact us at privacy@gulo.ai. We will respond within thirty (30) days.
10. Children's Privacy
The Service is intended for business use by adults. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, contact us at privacy@gulo.ai and we will delete it promptly.
11. Third-Party Services
The Service integrates with AWS services. Your use of AWS is governed by Amazon's terms of service and privacy policy. We are not responsible for the privacy practices of AWS or other third parties.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice in the Service at least fourteen (14) days before the change takes effect. Your continued use of the Service after that date constitutes acceptance of the updated Policy.
13. Governing Law
This Privacy Policy is governed by the laws of British Columbia and the federal laws of Canada. By using the Service, you consent to the collection, use, and disclosure of information as described in this Policy.
14. Contact Us
For privacy questions, requests, or concerns, contact our Privacy Officer:
You also have the right to file a complaint with:
- Office of the Privacy Commissioner of Canada: priv.gc.ca
- BC Office of the Information and Privacy Commissioner: oipc.bc.ca