Privacy policy
Last updated October 15, 2026 (the free audit emails you your results and a few follow-ups; the contact form, the AODA report helper and law-change alerts; company accounts can add admins and managers, with optional two-step sign-in; earlier, on October 14: employees now sign in to their page with their email address, and the free audit asks for your contact details; earlier the same day: company accounts, employees, employee sign-up links, acknowledgments, training, health and safety records, HR profiles and letters, and the in-app assistant)
Prodigy Suite (prodigysuite.co) is run by Gintii AI Inc., an Ontario company. It helps Ontario employers check their workplace policies against the law and draft the ones they are missing. This policy explains what we collect, why, who handles it for us, how long we keep it, and your choices.
The short version
- The free audit asks for your business name, your name, work email and phone before it shows your results. We keep them so our team can follow up about your results, and we don’t share them.
- Your handbook file is read in memory to make the report and is never stored.
- Reports and drafts are deleted automatically after 24 months.
- We don’t sell personal information, and your documents aren’t used to train AI models.
- No cookies, analytics or advertising trackers on this site. Your browser’s storage is used only to keep you signed in.
- Employee details and acknowledgment records belong to the employer who added them; we hold them on the employer’s behalf.
1. What we collect and why
| What | When and why |
|---|---|
| Your contact details | Your business name, your name, work email and phone, which the free audit asks for before it shows your results: so our team can follow up about your results and Prodigy Suite, and to apply daily limits. They are kept with your answers and emailed to our support team. |
| Contact requests | Your business name, name, work email, phone, headcount, good times to call and message, when you use our contact page: to reply and set up a call. Emailed to our support team. |
| AODA report helper | Your answers stay in your browser. If you ask us to email them, we keep your email (and name and business, if given) and a summary of your answers (your size, whether everything was in place): to send the copy and, if you tick the box, reminders before the deadline. |
| Law-change alert sign-ups | Your email and headcount, and your consent: to email you when an Ontario rule that applies at your size changes. |
| Partner applications | Your name, company, work email, and the phone, website and description of who you work with if you give them, when you apply to the partner program: to review your application and contact you about it. They are kept with your contact details and emailed to our support team. |
| Answers about your business (headcount, industry, the yes/no questions) | To work out which rules apply. They are kept with your contact details, and a handbook review or draft set stores them with the result. |
| Your work email | For the audit, handbook reviews and drafting: to apply daily limits, keep track of the reports and drafts you made, and, only if you tick the box, to send you updates. Each report or draft set also stores a one-way hash of it. |
| Your handbook or policy document | To review it. The file is read in memory and sent to our AI provider for the review. It is never saved as a file. The report keeps the short quotes it cites. |
| Details you give for drafting | Business name, who signs, who employees report to, contacts, working hours and the monitoring you use: to write your drafts. Stored with the drafts. |
| Reports and drafts we produce | So you can reopen, print and download them. |
| Your consent to updates | If you tick the box: the wording you agreed to and when, as Canada’s anti-spam law requires. |
| One-way hashes of your email and IP address | To apply daily limits on reviews and drafts. Deleted after two days. |
| Your company account | Your sign-in email, your business’s name and headcount answers, and the policies you save, edit and adopt (with who adopted each version and when): to run your account and your policy library. If the account adds admins or managers: their email, role and when they were invited and joined. If you turn on two-step sign-in: the secret your authenticator app uses and one-way hashes of your recovery codes. Your choices of which emails you get. |
| Employee details | Names, email addresses and mobile numbers, added by the employer (one at a time, pasted, or from an uploaded spreadsheet) or entered by employees through the employer’s sign-up link: so each employee can sign in to their own page (with their email address) and be sent your policies and training, and to show you who has acknowledged what. Uploaded spreadsheets are read for these three details and are not stored. A sign-up also records the IP address and browser details it came from, and is deleted if the employer removes it. |
| Training files | Files an employer attaches to training lessons (PDFs, slides, images, video): to show them to the employees the training is assigned to. Kept with the course while any version of it uses them. |
| Employee profiles and HR letters | What an employer adds about an employee: job title, location, start and end dates, pay, hours, an emergency contact, private notes and uploaded files (certificates, signed contracts); and letters such as offers, warnings or termination letters, with the employee’s typed-name signature, the time and their device. We ask employers not to store social insurance or bank numbers here. |
| Health and safety records | Incident and hazard reports (what happened, where and when, who was hurt, their injuries and treatment, witnesses, photos), workplace inspections, safety data sheets and committee minutes. Injury details are health information: they are kept for the employer’s legal reporting and records, shown only to the employer and to the employee who reported them, and not used for anything else. |
| Training records | For training an employer assigns: which lessons an employee has finished, their quiz answers and scores, when they completed it, their certificate, and for courses taken elsewhere the date and reference number they enter, with the name they type, their IP address and browser details. This is the employer’s record of who was trained, on what and when. |
| Acknowledgment records | When an employee acknowledges a policy: the name they type, the email address they signed in with, the time, their IP address and browser details, and a fingerprint of the exact policy version. This is the employer’s evidence that the employee received and read the policy. |
| Technical logs | IP address, browser, time, requests and errors, on every visit: to run and secure the service. |
2. Information about other people
If you are an employer: employee names, contact details and acknowledgment records are personal information you control. We process them only to provide the service to you. You are responsible for telling your employees that you use Prodigy Suite to share policies and record acknowledgments, and for having the right to give us their details.
If you are an employee: your employer added your details, or you entered them through your employer’s sign-up link, and your employer asked us to send you their policies. For questions about how your employer uses this information, contact your employer. You can also contact us, and we will work with your employer to respond.
Handbooks and drafting answers can name your staff. The review doesn’t need personal details about employees, so remove them before uploading where you can. If you share personal information about other people, you are responsible for having the right to share it with us for this purpose.
3. What we don’t do
- Sell or rent personal information.
- Use your documents, answers, reports or drafts to train AI models, or allow our AI provider to.
- Use cookies, analytics or advertising trackers on prodigysuite.co. If that changes, we will update this policy first and ask for consent where the law requires it.
- Show your report or drafts to anyone else. Anyone who has the link to a report or draft set can open it, though, so share those links only with people you trust. Links are long and random and are not listed anywhere. An employee’s own page is different: it opens only after they sign in with the email address their employer has for them.
4. Who processes information for us
- Google (Firebase and Google Cloud) hosts the site, runs the service, sends sign-in emails, and stores reports, drafts, lead records, company accounts and the files you attach to training lessons in its Toronto region. Web pages are delivered through Google’s worldwide network, and technical logs may be stored outside Canada.
- Anthropic (Claude) reads your handbook text, or your drafting answers, to produce the review or drafts; reads an adopted policy when you ask it to draft a training course from it; and answers questions you ask the in-app assistant (“Ask Prodigy”), which also reads your company’s profile and the policy you have open. This processing happens outside Canada, including in the United States. Under its commercial terms, Anthropic does not use this content to train its models and keeps it only for a limited time for safety and abuse monitoring.
- Resend sends emails to employees on an employer’s instructions, when an employer uses email delivery; our emails to you (your results, follow-ups, alerts, invitations); and sends our support team the details from the free audit and the contact page. Resend processes email addresses and message content in the United States.
- Unsplash delivers the photos on our home page. Like any website your browser loads an image from, it receives your IP address and browser details. No account or form information is sent to it.
These providers act on our instructions and are bound by contract to protect the information. Information processed in another country is subject to that country’s laws and may be accessible to its courts and authorities.
5. How long we keep it
- Reports and drafts: 24 months after they are made, then deleted automatically.
- Your contact details, answers and consent record: 24 months after you last used the audit, a review or drafting, then deleted automatically, or sooner if you ask.
- Daily-limit hashes: two days.
- Technical logs: about 30 days.
- Your handbook file: not kept at all.
- Company accounts (policies and every adopted version, employees, acknowledgment records): kept while the account is open, because employers must be able to show which policy was in force and who acknowledged it. Ontario requires some policies to be kept for three years after they stop being in effect. If an employer asks us to close their account, we delete its data within 90 days, after giving them the chance to download their inspector pack.
Deleted records can remain in our providers’ systems for a short time before they are permanently removed.
6. Emails
If you run the free audit, we email you your results, then up to four follow-ups over the next three weeks about them and about Prodigy Suite, and someone from our team may contact you by email or phone. The follow-ups stop if you unsubscribe or open an account.
We only email you law-change updates and deadline reminders if you tick the box. Company accounts get alerts and a monthly summary about their own account; each person can turn these off under Your account.
Every email says who it is from and has an unsubscribe link, and unsubscribing takes effect within 10 business days. You can also tell us at privacy@prodigysuite.co.
7. Security
- Information is encrypted in transit (HTTPS) and at rest.
- The database cannot be read from a web browser. Only our service can reach it, and access is limited to Gintii AI staff who need it.
- Your handbook file is never written to storage.
If a breach of security creates a real risk of significant harm, we will notify you and the Privacy Commissioner of Canada as the law requires.
8. Your rights
You can ask to see the personal information we hold about you, correct it, have it deleted, or withdraw your consent to updates. Email privacy@prodigysuite.co from the address you used and we will reply within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
9. Children
Prodigy Suite is a tool for businesses and is not meant for anyone under 18.
10. Who is responsible
Gintii AI Inc. is responsible for the personal information under its control and has a Privacy Officer, who can be reached at privacy@prodigysuite.co.
11. Changes
We will post any change here with a new date. If a change materially affects how we use information we already hold, we will tell people who agreed to receive emails, and ask for consent where the law requires it.