Privacy Policy

1. Who we are and what this policy covers

Westshore Labs, based in British Columbia, Canada, operates d2o. This Privacy Policy describes how we handle personal information when you visit our website, use the d2o platform, or communicate with us. Questions and requests can be sent to legal@d2o.io.

Our customers also use d2o to host their own applications and data. They determine what information their applications collect and how it is used. When we host that information, we process it to provide the customer’s services and follow their authorized instructions, subject to applicable law. For questions about a customer’s application, contact that application’s operator first.

2. Information we handle

• Account and team information: your name, email address, sign-in identity, invitations, organization and project membership, and permissions. An organization administrator may provide your email address to invite you.
• Authentication information: session records, authentication tokens, SSH public keys, and the information needed to verify access. Keep passwords, private SSH keys, and API tokens confidential.
• Customer content: source code, application configuration, secrets, database contents, files, and other data that you or your authorized users submit to the platform.
• Operational information: IP addresses, request and security logs, resource usage, deployment records, audit events, and diagnostic information. Application logs may contain personal information that your application records.
• Communications and commercial records: information you provide when requesting support, reporting a problem, or agreeing to paid services. Any payment arrangements and providers will be disclosed when paid services are offered.
• Optional assistant interactions: questions, conversation context, and relevant account information used to answer your requests when the assistant is enabled. We may retain operational events about assistant usage. Avoid including information unnecessary to your question.

3. How we use information

We use personal information to provide and administer d2o, authenticate users, provision and operate resources, manage invitations and access, respond to requests, deliver service communications, diagnose faults, monitor capacity, prevent abuse, and meet legal obligations. Where paid services have been agreed, we also use the information needed to administer that agreement.

We limit collection and use to purposes that are appropriate in the circumstances. Where consent is required, we seek it in a form appropriate to the information and its use. Optional uses are not a condition of receiving unrelated services. We do not sell personal information or use customer content for targeted advertising.

4. Cookies and browser storage

The public marketing pages do not use advertising trackers or analytics cookies. The marketing pages can check your existing dashboard session to show a Dashboard link when you are signed in. This check returns only your sign-in status. The dashboard and sign-in services use essential cookies to maintain sessions and complete authentication. The dashboard may store interface preferences in your browser, such as your most recently selected organization or view.

You can manage cookies and local storage through your browser. Blocking essential cookies can prevent sign-in or other platform functions from working. Visiting a link to another service is subject to that service’s own practices.

5. When information is disclosed

We disclose information only as reasonably needed for the purposes described here, with your authorization, or as permitted or required by law. Recipients may include:

• Authorized people in your organization, according to their permissions and the platform’s collaboration features.
• Service providers working on our behalf, including providers that deliver transactional email. We use Proton Mail for production invitation and service email.
• Professional advisers and authorities where necessary to meet legal obligations, resolve a dispute, or protect the platform and others from unlawful activity.
• A prospective successor in a business transaction, subject to applicable privacy requirements and appropriate protection of the information.

We take reasonable steps to limit provider access to what is needed and require appropriate protection for information handled on our behalf. Making an application or storage bucket public makes its published content accessible to others; customers control those publication choices.

6. Where information is processed

d2o’s servers and backups are physically located in Canada. Customer workloads, databases, and stored files are hosted on that infrastructure.

External services, including transactional email delivery, may process account or communication information outside Canada. Such information may be subject to the laws and lawful access requirements of the countries where it is processed. Contact us for information about the service providers relevant to your use of d2o. The Canadian hosting statement does not extend to services you independently connect to your applications.

7. Retention and deletion

We retain personal information for as long as reasonably needed to provide the service, maintain security and operational records, resolve disputes, and satisfy applicable legal requirements. Retention depends on the kind of information, the purpose for which it was collected, and whether continued retention is required by law.

Closing an account or deleting a resource does not necessarily remove every related log, audit record, or backup immediately. Backup copies are removed through their retention lifecycle, subject to legal preservation requirements. We destroy or de-identify personal information when its purposes are no longer served and retention is no longer needed for legal or business purposes.

To request account closure or deletion of your personal information, contact legal@d2o.io. We may need to verify your identity and resolve organization ownership or shared-resource responsibilities. We will explain any applicable limits to your request.

8. Protecting information

We use reasonable administrative, technical, and organizational safeguards appropriate to the information we handle. These include access controls, authenticated sessions, and measures to protect service communications. No service can eliminate every security risk. Customers remain responsible for their application code, access decisions, credentials, and the information they choose to publish.

If a security incident affects personal information, we will investigate and take appropriate steps, including notifications required by applicable law.

9. Your choices, requests, and complaints

You may request access to your personal information, ask for corrections, and raise questions or complaints about our practices. You may also withdraw consent on reasonable notice, subject to legal or contractual restrictions. We will explain the likely consequences; withdrawing consent for information necessary to operate your account may mean we cannot continue providing that service.

Send requests to legal@d2o.io. We may verify your identity and authority before disclosing or changing information, and will respond within the periods required by applicable law. Access and other rights are subject to legal exceptions.

If you are dissatisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia, or another privacy regulator with jurisdiction, including the Office of the Privacy Commissioner of Canada.

10. Eligibility

d2o accounts are intended for people with legal capacity to enter the service agreement and, when acting for an organization, authority to do so. Our platform is not directed at children. If you believe a child has provided account information without appropriate authority, contact us so we can investigate. Customers are responsible for the information their own applications collect.

11. Changes to this policy

We may update this policy as our services and practices change. We will identify the effective date and provide appropriate notice of material changes, such as a website notice or account email. Where a new use requires consent, we will seek that consent before proceeding.