Privacy Policy

Zack Cola Inc. ("OVRNT," "we," "us") operates ovrnt.io, the OVRNT client portal, and OVRNT Academy. Address: 1280 Rue Nobel, Boucherville, QC J4B 5M3.

Zack Colavecchio, President — hello@ovrnt.io — 1280 Rue Nobel, Boucherville, QC J4B 5M3.

This policy covers personal information we collect through our website, forms, bookings, Academy purchases and learning platform, client portal, and communications. It does not cover personal information we process on behalf of our clients inside the automations we build; that processing is governed by our agreement with each client, under which the client remains responsible for that information and we act as its service provider.

• Information you provide: name, email, phone, company, role, industry, company size, province, messages, application details, booking details.
• Purchase information: billing name, province (for tax), transaction records. Card details are processed by our payment processor, Stripe; we do not store full card numbers.
• Account and learning data: login credentials (hashed), course progress, notes, certificates.
• Client portal data: approver identities, approval/rejection decisions and timestamps, support requests.
• Technical information: IP address, device/browser data, and — only with your consent — analytics data from cookies or similar technologies.
• Consent records: the date, time, source, and wording of any marketing consent you give.

To respond to inquiries; schedule and conduct assessments; provide services, the portal, and courses; process payments and taxes; provide support; send transactional messages; send marketing emails if you consented; secure and improve our services; meet legal obligations. We collect only what is necessary for these purposes.

We rely on your consent, which may be express or implied depending on sensitivity and context. Marketing emails are sent only with consent obtained in compliance with CASL. You may withdraw consent at any time, subject to legal or contractual restrictions; we will explain the consequences of withdrawal.

Essential cookies only by default. Any technology that can identify, locate, or profile you (e.g. analytics, advertising pixels) is off by default and activated only if you opt in through our cookie banner. Manage preferences at any time via "Cookie preferences" in the footer.

We use AI tools (currently Claude, GrokBot, ChatGPT, Perplexity and HeyGen) to help draft responses, summarize inquiries, and support internal operations. We do not make decisions about you based exclusively on automated processing that produce legal or similarly significant effects. If that changes, we will inform you at or before the time of the decision, tell you what personal information was used and the main factors and parameters, and give you the right to have the information corrected and the decision reviewed by a person. (Law 25 s. 12.1)

We share personal information with service providers that help us operate (e.g. hosting, database, email, scheduling, payments, analytics, AI providers) under contracts requiring protection and limited use. Current categories/providers: Lovable (website hosting and website database), Supabase (CRM database), Cal.com (scheduling), Stripe (payments), Microsoft 365 (email), Apollo (sales prospecting), and AI providers (Claude, GrokBot, ChatGPT, Perplexity, HeyGen). We do not sell personal information.

Our CRM database (Supabase) is hosted in Canada (Montréal region); other providers, including our website host, may be located elsewhere.

Cal.com, Inc.: appointment scheduling via the embedded booking widget on /book, including the third-party error monitoring (Sentry) it loads.

Some providers may store or process information outside Quebec or Canada (for example, in the United States), where it may be subject to the laws of that jurisdiction, including lawful access by authorities. Before transferring personal information of Quebec residents outside Quebec, we assess whether it will receive adequate protection (privacy impact assessment).

Cal.com, Inc. and the third-party error monitoring (Sentry) loaded by its embedded booking widget on /book may store or process appointment scheduling and technical information outside Quebec or Canada.

We keep personal information only as long as needed for the purposes above or as required by law (e.g. tax records), then securely destroy or anonymize it.

Administrative, technical, and physical safeguards appropriate to sensitivity — access controls, encryption in transit, least-privilege access, staff confidentiality obligations.

Subject to law, you may: access your personal information; request correction; withdraw consent; request data portability in a structured, commonly used technological format (Quebec); request de-indexation or cessation of dissemination in certain circumstances (Quebec); be informed of automated decisions (see §8); and file a complaint. Requests: hello@ovrnt.io. We respond within 30 days and may need to verify your identity.

We maintain a register of confidentiality incidents. Where an incident presents a real risk of significant harm (PIPEDA) or a risk of serious injury (Quebec), we notify affected individuals and the Office of the Privacy Commissioner of Canada and/or the Commission d'accès à l'information du Québec, as required.

Our services are intended for businesses and adults.

Contact our Privacy Officer first. You may also contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

We will post updates here with a new effective date and notify you of material changes where appropriate.