Privacy Policy
How OASIS AI Solutions collects, uses, shares, and retains personal information — including what is sent to third-party AI providers.
Effective July 27, 2026
Notice: This application uses artificial intelligence (AI), automated algorithms, and large language models (LLMs) to process data, generate content, and execute workflows. AI output can be inaccurate and is not professional, legal, financial, or medical advice.
1.Who we are
OASIS AI Solutions (“we”, “us”) operates the OASIS Agent Command Center at oasisai.work. Our principal place of business is Montreal, Quebec, Canada. For privacy questions, or to exercise any right described below, contact privacy@oasisai.work.
The Command Center is a multi-tenant product. Where you submit information through a form published by one of our customers (a “tenant”), that tenant is the controller of your information and we process it on their behalf as a service provider.
2.AI data processing and machine learning
This product is built on artificial intelligence. Automated systems and large language models read, classify, summarise, and act on the data you submit. You should assume that content you enter into an agent chat, and the contents of any document you upload for extraction, are transmitted to a third-party model provider for processing.
What is sent to model providers
- Messages and instructions you type into any agent or chat surface.
- Lead and application records when they are included in the context of an agent task (for example, drafting a reply about a specific deal).
- The full contents of documents you upload for automated field extraction — which for funding applications routinely includes government identifiers such as Social Security Numbers, dates of birth, and employer identification numbers.
Which providers
Depending on the task, content may be routed to Anthropic PBC (Claude), OpenAI, L.L.C. (GPT), or Google LLC (Gemini). All three process data on servers located in the United States. The full subprocessor list, and what each one receives, is in section 5.
Automated decision-making
Agents in this product can classify inbound messages, score and route leads, and draft outbound communications without a human reviewing each step. These are operational decisions about workflow — they do not by themselves determine eligibility for credit, employment, housing, or insurance. Transactional messages such as submission confirmations and welcome emails are sent automatically. A human operator reviews and approves any other communication sent on a tenant’s behalf and any financial action.
If you are in Quebec, you have the right under the Act respecting the protection of personal information in the private sector (Law 25) to be informed when a decision about you is based exclusively on automated processing, and to submit observations to a human. Write to privacy@oasisai.work to exercise that right.
Training
We do not train our own models on your data. We do not sell your data. Model providers operate under their own terms; where a provider’s consumer-tier terms permit training on submitted content, we treat that as a limitation to be closed rather than a permission we rely on, and we disclose the current state honestly in section 5.
3.Privacy data matrix
The table below lists every category of personal information the Command Center collects, why, and who receives it. Rows marked Sensitive are treated as sensitive personal information under Quebec Law 25 and the California Privacy Rights Act.
| Category | Fields | Purpose | Shared with | Retention |
|---|---|---|---|---|
| Contact identifiers | first_name, last_name, email, phone | Account creation, service delivery, and operator communication | Supabase (storage), Anthropic (when included in agent context) | Life of the account, then 24 months |
| Business identifiers | company, address, city, state, zip, revenue | Qualifying and routing an application to the correct workflow | Supabase, and the tenant whose form was submitted | Life of the account, then 24 months |
| Government and financial identifiersSensitive | ssn, dob, ein, tax_id | Completing a funding application on behalf of the submitting business | Supabase (encrypted at rest), and Anthropic when present in an uploaded document submitted for extraction | Retained only as long as the application is active, then deleted on request |
| Uploaded documentsSensitive | Bank statements, signed applications, and other files submitted through the form dropzone | Automated field extraction and application assembly | Supabase Storage, Anthropic (extraction) | Deleted on request; otherwise retained with the application |
| Usage and diagnostic data | IP address, request paths, timestamps, error logs | Security, abuse prevention, and debugging | Vercel, Supabase | 30 days (platform logs) |
A machine-readable version of this matrix is published at docs/compliance/PRIVACY_NUTRITION_LABEL.json in the product repository and is the source used for app-store privacy declarations.
4.Analytics and tracking
The Command Center does not load third-party analytics SDKs, advertising pixels, or cross-site trackers. There is no Google Analytics, Meta Pixel, PostHog, or similar tag in this application.
We use strictly necessary cookies for authentication and session state, and our hosting provider records standard server logs (IP address, request path, timestamp, user agent) for security and debugging. If we add an analytics provider in future, this section and the data matrix above will be updated in the same release.
5.Subprocessors
We share personal information with the following processors. Each entry states whether a data processing agreement is currently in place for that specific data path.
| Processor | Role | Data received | Region | DPA |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, and file storage | All account data, lead/application records, and uploaded documents | United States | In place |
| Vercel, Inc. | Application hosting and edge delivery | Request metadata, IP address, and server logs | United States / global edge | In place |
| Anthropic PBC | Large language model inference (Claude) | Chat messages, agent prompts, and the contents of uploaded application documents submitted for field extraction | United States | Under review |
| OpenAI, L.L.C. | Large language model inference (GPT), used for delegated code and review tasks | Prompt content routed to the secondary model provider | United States | Under review |
| Google LLC | Large language model inference (Gemini), used as a fallback provider | Prompt content routed to the fallback model provider | United States | Under review |
6.International transfers
We are based in Quebec, Canada. Our hosting, database, and model providers are located in the United States, so your information is transferred outside Canada and outside the European Economic Area. Under Quebec Law 25 we are required to assess whether the destination jurisdiction provides adequate protection before transferring personal information outside the province; that assessment is in progress for the model-provider paths marked “Under review” above.
7.Your rights
Subject to your jurisdiction, you may request access to the personal information we hold about you, correction of inaccurate information, deletion, portability, withdrawal of consent, and — in Quebec — the de-indexing of information in certain circumstances. California residents may additionally opt out of any sale or sharing of personal information; we do not sell or share personal information as those terms are defined by the CPRA.
Send requests to privacy@oasisai.work. We respond within 30 days. We will not discriminate against you for exercising a privacy right.
8.Security and breach notification
Data is encrypted in transit and at rest. Access to tenant data is restricted by row-level security, and administrative access is limited to personnel who need it. No system is perfectly secure. If a confidentiality incident presents a risk of serious injury, we will notify affected individuals and the Commission d’accès à l’information du Québec as required by Law 25, and any other regulator required by applicable law.
9.Children
The Command Center is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18.
10.Changes
We will post any change here and update the effective date. Material changes affecting how we share data with model providers will be communicated to account holders by email before taking effect.