1Introduction
This Privacy Policy explains how Good Venture Labs Inc. ("Actium", "we", "us", "our") collects, uses, shares, and protects personal information when you use our software-as-a-service platform, websites, and related services (the "Service").
For the purposes of the EU/UK GDPR, Actium is the controller of personal data described in this policy, except where we process Customer Data on behalf of our business customers, in which case we act as a processor and the customer is the controller.
Contact:
Good Venture Labs Inc., 1824 Store St, Victoria, BC, Canada V8T 4R4
Privacy contact: privacy@goactium.com
2Personal information we collect
We collect the following categories of personal information:
- Account and identity data — name, email, username, password, job title, organisation.
- Billing data — billing name, address, and payment information (card details are handled by our payment processor; we do not store full card numbers).
- Usage and device data — IP address, browser and device type, log data, pages viewed, feature usage, timestamps.
- Cookies and similar technologies — see Section 9.
- Communications — messages, support tickets, and feedback you send us.
- Customer Data — content you submit to the Service, which may contain personal data about your own users or contacts and which we process on your behalf.
We do not intentionally collect special category / sensitive data unless you choose to provide it.
File uploads
We accept uploaded files (PDFs, Word documents, images, and other media) that you choose to provide for ingestion into the Service. These are stored in our database and may be processed by our AI agents. You remain responsible for the content of these files and the privacy of any personal information they contain.
3How we collect it
We collect information directly from you (when you register, subscribe, or contact us), automatically (through your use of the Service and cookies), and from third parties (such as payment processors, authentication providers, and analytics tools).
3AThird-party integrations
We collect and process data through integrations with third-party services to provide the Service. These include Google (Analytics, Search Console, Drive), Ahrefs (SEO auditing and competitive analysis), Dropbox, Shopify, and Unipile (social media aggregation). When you authorize these integrations via OAuth or API key, we receive and store data returned by those services' APIs. For Ahrefs, we query SEO metrics and site health data using your authorization. Payment processing flows through Stripe; card details are not stored by us.
These providers act as our sub-processors or as independent controllers depending on the integration; they are listed in our Data Processing Agreement. Where an integration involves a transfer of personal data outside the EEA, UK, or Switzerland, the safeguards described in Section 6 apply, including the Standard Contractual Clauses. You may revoke an integration's authorization at any time in your account settings, which stops further collection from that service.
4How and why we use it (purposes and legal bases)
Under the GDPR we rely on the following legal bases:
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing and operating the Service, managing your account | Performance of a contract |
| Processing payments and preventing fraud | Contract / Legal obligation / Legitimate interests |
| Customer support and communications | Contract / Legitimate interests |
| Security, debugging, and improving the Service | Legitimate interests |
| Marketing communications | Consent (or legitimate interests where permitted), with opt-out |
| Complying with legal obligations | Legal obligation |
Communications. We send transactional emails (verification, password reset, billing updates, notifications) via a third-party email service. Opt-out of non-transactional marketing emails in your account settings.
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us about this balancing test at privacy@goactium.com.
5Sharing and disclosure
We share personal information with:
- Service providers / sub-processors — hosting, payment processing, analytics, email, and support tools that process data on our behalf under contract. A current list of our sub-processors is maintained in our Data Processing Agreement.
- Professional advisers — lawyers, auditors, and insurers where necessary.
- Authorities — where required by law or to protect rights, safety, and security.
- Corporate transactions — in connection with a merger, acquisition, or sale of assets, subject to this policy.
We do not sell your personal information for money. See Section 8 for how "sale" and "sharing" are treated under California law.
6International transfers
We may transfer personal data to countries outside your own, including the United States. Where we transfer personal data from the EEA, UK, or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), or transfer to countries with an adequacy decision. You can request a copy of the relevant safeguards at privacy@goactium.com.
7Your rights (EU/UK GDPR and Canada PIPEDA)
Depending on your location, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase data ("right to be forgotten") in certain circumstances
- Restrict or object to processing, including direct marketing
- Data portability — receive your data in a portable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with a supervisory authority.
EU users may complain to their national data protection authority. UK users may complain to the Information Commissioner's Office (ICO). Canadian users may complain to the Office of the Privacy Commissioner of Canada (OPC). Under PIPEDA you also have the right to access your personal information and challenge its accuracy.
To exercise any right, contact privacy@goactium.com. We will respond within the timeframe required by law (generally one month under GDPR; without undue delay under PIPEDA). We may need to verify your identity first.
8California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know / access the categories and specific pieces of personal information we collect, use, and disclose
- Delete personal information we hold about you, subject to exceptions
- Correct inaccurate personal information
- Opt out of "sale" or "sharing" of personal information and of targeted advertising
- Limit use of sensitive personal information (if applicable); and
- Non-discrimination for exercising your rights.
We do not sell personal information for money. We do not "sell" or "share" personal information for cross-context behavioral advertising, and we honor Global Privacy Control and similar opt-out preference signals.
To exercise these rights, contact privacy@goactium.com. You may use an authorised agent. We will not discriminate against you for exercising your rights.
Categories collected (CCPA): identifiers, customer records, commercial information, internet/network activity, and geolocation (approximate, via IP). We retain each category as described in Section 10.
8AOther US state privacy rights
If you are a resident of a US state with a comprehensive privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others — you may have rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, the "sale" of personal information, and certain profiling. Where required, we honor opt-out preference signals such as Global Privacy Control. To exercise these rights, contact privacy@goactium.com; you may appeal a decision by contacting privacy@goactium.com, and you may contact your state Attorney General if you have concerns. We do not use or disclose sensitive personal information beyond the purposes permitted by these laws.
8BNotice at collection (summary)
At or before collection, we collect the categories of personal information described in Section 2 for the purposes in Section 4, retain them as described in Section 10, and do not sell personal information for money. This summary is provided to meet "notice at collection" requirements under California and similar laws.
9Cookies and tracking
We use cookies and similar technologies for essential functionality, preferences, analytics, and (where applicable) marketing. You can manage non-essential cookies through our cookie preference center and your browser settings. In the EU/UK, non-essential cookies are set only with your consent.
10Data retention
We keep personal information only as long as necessary for the purposes described, to comply with legal obligations, resolve disputes, and enforce agreements. As a general rule we retain account data for the life of your account plus 90 days; billing and transaction records for 7 years to meet tax and accounting obligations; and server logs for 12 months. Customer Data is retained per your Subscription and deleted or returned after termination as described in our Terms.
11Security
We implement appropriate technical and organisational measures to protect personal information, including encryption in transit (TLS) and at rest, role-based access controls, network monitoring, and regular security reviews. No system is perfectly secure; we cannot guarantee absolute security. We will notify you and any regulator of a personal data breach where required by law.
12Children's privacy
The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe we have done so, contact privacy@goactium.com and we will delete it.
13Automated decision-making and AI
13.1Profiling / solely automated decisions. Some Service features can take automated actions on your behalf. However, we do not make decisions producing legal or similarly significant effects about you based solely on automated processing without human review. Where such processing is used, you can request human review, express your point of view, and contest the decision by contacting privacy@goactium.com.
13.2AI features. The Service uses AI agents to audit website SEO, generate content recommendations, research keywords and competitors, and suggest social media strategies. These agents process your submitted data (website URLs, content, brand guidelines) to produce reports and drafts. For Agency workspace users, the Service processes your clients' website data and customer data on your behalf under a Data Processing Agreement. We do not use Customer Data or your inputs to train generally available foundation models. We may use aggregated and de-identified data, which cannot reasonably be used to identify you, to maintain and improve the Service on the basis of our legitimate interests; you can opt out by contacting privacy@goactium.com. Where we use third-party AI providers as sub-processors, they are listed in our Data Processing Agreement and act under contractual data-protection obligations.
13.3Accuracy. AI outputs may be inaccurate or incomplete and should not be relied on without review. See the AI terms in our Terms & Conditions.
14Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice (e.g. by email or in-product).
15Contact us
Good Venture Labs Inc.
1824 Store St, Victoria, BC, Canada V8T 4R4
Privacy: privacy@goactium.com