Privacy Notice: GWiZ™ ERP Hub
This notice explains how G Wiz Software Solutions Inc. (“GWiZ™”, “we”) handles personal information in the GWiZ™ ERP Hub at hub.gwizweb.com, the internal system our team uses to run client accounts, subscriptions, invoicing, support and our Google Workspace tools. It follows the ten fair information principles of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Our public website has its own notice at gwizweb.com/privacy, which also covers the rights of people outside Canada.
1. Who is accountable
GWiZ™’s Privacy Officer is accountable for our compliance with PIPEDA and this notice, including information we transfer to service providers for processing. Reach the Privacy Officer at info@gwizweb.com (subject “Privacy request”), or through the request form at gwizweb.com/privacy.
2. What personal information the Hub handles
- People who use the Hub (GWiZ™ staff): name, work email, role, sign-in times and methods, and a record of significant actions (the audit log). If you sign in with a passkey, the Hub stores only the passkey’s public key; your fingerprint, face or device PIN never leave your device and are never seen by GWiZ™.
- Google accounts staff choose to connect: the account address and access tokens, used only for that person’s own Gmail, Drive and calendar in the Hub.
- Our clients’ business contacts: names, work emails, phone numbers and addresses of the people we deal with at client organisations, with their subscriptions, seats, invoices, payments status, support requests and the sales and SEO work we do for them.
- Enquiries and support requests made through gwizweb.com or by email, which reach the Hub’s lead and support inbox.
The Hub is not designed to hold health information or government identifiers such as Social Insurance Numbers or health card numbers; its systems refuse data fields with those names. Please do not send them to us.
3. Why we use it
To provide and bill for our services, manage client accounts and subscriptions, answer enquiries and support requests, keep our accounts in QuickBooks Online, track subscriptions and revenue recorded in Stripe, run and secure the Hub, and meet our legal, tax and contractual obligations. We do not sell personal information or use it for advertising.
4. Where information is stored and processed: cross-border notice
Most of the Hub’s information is stored and processed outside Canada, in the United States. While it is there it is subject to the laws of that country, and courts, law-enforcement and national-security authorities there may be able to obtain access to it. We choose providers that are bound by contract to protect it and to use it only to provide their service to us.
- The Hub’s application, database, backups and form records run on Google Cloud in the us-central1 region (Iowa, United States).
- The Gemini assistant runs on Google Cloud Vertex AI in the northamerica-northeast1 region (Montréal, Canada). The Hub will not send it anywhere else: a configuration naming another location is refused.
- Application logs are kept in Google Cloud Logging, which is not tied to a single region.
- Email, calendar and file storage use Google Workspace, which Google may store and process in any country where it operates. QuickBooks Online (Intuit) and Stripe store data primarily in the United States.
5. Service providers that process information for us
| Provider | What it does for us | Location |
|---|---|---|
| Google LLC (Google Cloud) | Hosting, database, backups, form records, secrets and logs | United States (us-central1); logs not region-bound |
| Google LLC (Vertex AI) | The Gemini assistant, when a staff member uses it | Canada (Montréal, northamerica-northeast1) |
| Google LLC (Google Workspace) | Gmail, Google Drive, Google Calendar and Meet, and Google sign-in | Google’s global infrastructure |
| Intuit Inc. (QuickBooks Online) | Accounting: customers, invoices and payments we send it | United States |
| Stripe, Inc. | Payments and subscriptions; the Hub reads subscription and revenue records from Stripe. Card details are handled by Stripe and never reach the Hub | United States |
| Microsoft Corporation (Entra ID) | Sign-in for staff who choose “Sign in with Microsoft” | Microsoft’s infrastructure |
We will update this list before adding a provider that receives personal information.
6. The Gemini assistant: no training, no caching
Staff can ask the Hub’s Gemini assistant to draft or summarise text. When they do, the Hub sends Google the question they typed and, if they chose a client, a short technical summary of that client’s account: its account identifier, website domains, hosting platform and region, and subscription plan and status. No contact details, passwords, keys, payment identifiers or tokens are included, and recognisable secrets are removed from the question before it is sent.
- No training. The assistant uses Google Cloud Vertex AI, under Google Cloud’s terms, which do not permit Google to use our prompts or its answers to train or improve its models. The Hub does not use the consumer or free Gemini services, whose terms allow that.
- Processed in Canada. Requests go only to Vertex AI in Montréal (see section 4).
- No caching. Vertex AI’s response cache is switched off for our Google Cloud project, and the Hub does not use Vertex AI features that store content (context caching, grounding or session resumption).
- What Google may still keep. Google may log prompts for a limited period solely to detect abuse of its services, unless our account has been granted an exemption from that monitoring. The Hub does not keep the answer or the full question: its audit log records who used the assistant, when, with which model, the question’s length and fingerprint, and its first 40 characters with secrets removed.
7. How long we keep it
We keep personal information only as long as needed for the purpose it was collected for, or as the law requires. Where a period is enforced automatically, the table says so.
| Information | How long | How it ends |
|---|---|---|
| Client accounts, subscriptions, invoices and payment records | At least six years after the end of the tax year they relate to | Required by the Canada Revenue Agency for books and records; then reviewed for deletion |
| Staff accounts and the audit log | While the person works with us; the account is disabled when they leave | Personal details are deleted on request once no longer needed for a record above |
| Connected Google account tokens | Until the person disconnects, or their account is removed | Deleted at disconnection |
| Enquiries and support requests | As long as they lead to, or may lead to, business with you | Reviewed at least once a year by the Privacy Officer, and deleted on request |
| Gemini assistant use | Answers and full questions are not kept; the audit entry (see section 6) is kept with the audit log | See section 6 for what Google may keep |
| Database backups | 30 daily backups, plus 7 days of point-in-time recovery | Automatic: the oldest is deleted as each new one is taken |
| Application logs | 30 days | Automatic |
| Google Cloud’s own audit logs of administrative actions | 400 days | Automatic; kept by Google Cloud and not configurable |
Deleting information from the live system does not remove it from backups straight away; it leaves them as they expire, within the periods above.
8. Access, correction, export and deletion
You may ask us for access to the personal information we hold about you, how we have used it and who we have disclosed it to; to correct it; for a copy you can take elsewhere (we provide it as CSV or JSON files); to withdraw consent to a use that depends on it; or to delete it where we have no legal duty to keep it.
How to ask: email info@gwizweb.com with the subject “Privacy request”, or use the request form at gwizweb.com/privacy. We will confirm your identity before releasing or changing anything, reply within 30 days as PIPEDA requires, tell you if we need an extension and why, and explain any part of a request we cannot meet. There is no charge.
9. Safeguards
- All connections to the Hub and to our providers are encrypted in transit (HTTPS/TLS), and data is encrypted at rest by Google Cloud.
- Access is by role, and client records are looked up on the server, so one client’s information cannot be reached by altering a request.
- Sensitive actions (QuickBooks connection and sync, financial exports, and changes to passwords, passkeys, roles or connected accounts) need a sign-in or passkey check from the last five minutes.
- Significant actions are recorded in an audit log.
10. Breaches
If a breach of security safeguards involving personal information creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the people affected as soon as feasible, as PIPEDA requires. We keep a record of every such breach for at least 24 months.
11. Changes and complaints
We will post changes to this notice here and update the date at the top. If you have a concern, please contact our Privacy Officer first. If we cannot resolve it, you may complain to the Office of the Privacy Commissioner of Canada (1-800-282-1376).