1. Who is responsible
Edict IQ is operated by World Discovery LLP, 11871 Horseshoe Way – Suite 1103, Richmond, BC V7A 5H5, Canada. World Discovery LLP is responsible for the processing described in this policy. Privacy, access, correction and deletion requests can be submitted through the contact route on this website.
2. Data we process
The data we process depends on how you use Edict IQ. Public browsing requires less information than an authenticated workspace.
- Account and identity data, such as email address, account identifier, sign-in method and basic profile information. For email/password accounts, the password credential is handled by the authentication service and is not stored in the Edict IQ application profile.
- Authentication and security data needed to establish sessions, prevent misuse and protect accounts.
- Workspace data you choose to save, including organisation context, watches, alerts, saved searches, notes, decisions, evidence references and collaboration records.
- Technical data such as IP address, browser/device information, timestamps and security or reliability logs generated when the service is used.
- Support, billing and communication data when you contact us, manage a plan or use related account functions.
3. Account access with Google or email
If you choose Sign in with Google, Google authenticates you and Edict IQ receives the basic identity information required to create or access your account, such as your Google account identifier, email address and profile information made available for sign-in.
If you create an email/password account, your email address is verified once before first sign-in. Confirmation and password-recovery links return to edictiq.com; authentication is provided by Supabase Auth.
Edict IQ does not request access to Gmail, Google Drive, Google Calendar or other Google product content as part of the standard sign-in flow. Google processes the authentication interaction under its own privacy terms.
4. Why we use personal data
Depending on the context, processing is based on performing the service requested by you, our legitimate interests in operating and securing the service, compliance with legal obligations, or consent where consent is required for an optional activity.
- To provide the website, account, workspace and requested product functionality.
- To authenticate users, maintain sessions and protect Edict IQ, its users and data against misuse or unauthorised access.
- To save user-selected workspace context, watches, decisions, evidence and collaboration records.
- To send service-related messages such as account confirmation, password recovery, a one-time welcome message, security notices or notifications that you have requested or enabled.
- To operate, troubleshoot and improve reliability, accessibility, security and product performance.
- To meet legal obligations and establish, exercise or defend legal claims where necessary.
5. Public preferences and cookies
Edict IQ uses technically necessary browser storage and session mechanisms for functions such as language preferences, authentication, workspace scope and secure checkout handoff.
No optional analytics or marketing storage is currently enabled on the public Edict IQ website. If consent-requiring technologies are introduced later, they will only be enabled after the required consent choice.
6. Service providers and subprocessors
Edict IQ uses specialised service providers to operate the platform. Depending on the enabled product path, these can include Supabase for application database and authentication, Vercel for web hosting, Render for worker hosting, AWS SES for email delivery, and Google when you explicitly choose Google account authentication.
Providers receive only the data needed for their function and are subject to contractual, security and access controls appropriate to the service. Additional providers may be introduced as the product evolves and will be reflected in the applicable privacy or subprocessor information.
7. Automated and model-supported processing
Edict IQ can use automated, model-supported processing to structure and interpret regulatory information and, where the product explicitly allows it, workspace context. Generated output is not treated as a user decision and does not remove professional responsibility for review.
Private workspace data is not public content and is not published merely because it has been processed by an automated feature.
8. Connected AI clients and MCP
If you explicitly connect an external AI client or MCP-compatible service, Edict IQ authenticates the connection and sends only the Edict IQ product data required by the tools and permissions you select. This can include approved regulatory-change fields, bounded verified citation excerpts and, when you grant a workspace-bound permission, organisation-specific impact decisions, evidence requests and compliance-gap records.
The external AI provider receives the data returned through the connector under that provider's own terms and privacy policy. Edict IQ does not expose passwords, authentication secrets, raw organisation context snapshots, internal user identifiers, raw evidence payloads, source-acquisition URLs, crawler or fallback logic, provider prompts, APS configuration or unrestricted bulk corpus access through the connector.
External AI access is optional, can be denied during OAuth consent and can be revoked. Tenant-bound API credentials can also be revoked by an authorised organisation administrator.
9. International processing
Edict IQ aims to use European processing locations where configured and practical. Some service providers may process data in other jurisdictions. Where required, appropriate safeguards are used for transfers of personal data outside the EEA or other protected jurisdictions.
10. Retention and deletion
We retain personal data only for as long as it is needed for the purpose for which it was collected, to provide an active account or workspace, to meet contractual or legal requirements, or to protect legitimate security and audit interests.
Retention can vary by data category. Account and workspace deletion requests are handled subject to legal, security, backup and audit requirements that may require limited information to remain for a defined period.
11. Security
Edict IQ applies access controls, tenant separation, authenticated session handling, source and audit boundaries, and technical safeguards intended to protect personal and workspace data. No internet service can guarantee absolute security, so users should also protect their account and device access.
12. Your rights
Where data protection law applies, you may have rights to access, correct, delete or restrict personal data, object to certain processing, receive portable data, withdraw consent where processing is based on consent, and complain to a competent supervisory authority.
Requests can be made through the Edict IQ contact route. We may need to verify your identity before acting on a request.
13. Changes to this policy
We may update this policy as Edict IQ, its providers or legal requirements change. The current version and update date will remain available at this URL.