Privacy Policy
Effective Date: April 22, 2026 | Last Updated: April 22, 2026
2590700 Ontario Inc. (d/b/a Shrubs, "we," "us," or "our") operates Shrubs, the platform available at https://shrubs.me and related subdomains, applications, and services (collectively, the "Services"). This Privacy Policy explains what information we collect, how we use and share it, and the rights you have.
1. Scope and Our Role
This Policy applies to personal information we process when you create a Shrub (a container/data room), add Branches (content modules such as files, links, embedded HTML, or video), share content with viewers, process payments, or otherwise interact with the Services.
Our role. For most personal information we process about account holders and visitors to our marketing site, we act as a controller (or equivalent "business" under the CCPA). When customers upload content and invite viewers to a Shrub, we act as a processor / service provider on behalf of that customer. In that case, the customer is the controller and their privacy notice governs the underlying content.
2. Information We Collect
2.1 Information you provide
- Account information: name, email, password hash, profile photo, business name, billing address.
- Content you upload: files, documents, images, video, audio, HTML, links, text, and metadata placed inside Shrubs and Branches.
- Waivers and signatures: where a Shrub requires a viewer to accept a waiver or NDA, we record the acceptance, the document version, IP address, timestamp, and any typed or drawn signature.
- Communications: messages to support, feedback, survey responses.
- Payment details: card or payout information is collected by our payment processors (Stripe, Razorpay). We do not store full card numbers on our servers.
2.2 Information we collect automatically
- Device and connection data: IP address, approximate location derived from IP, browser type and version, operating system, device type, referring URL, language preferences.
- Product usage and analytics: pages visited, buttons clicked, Shrubs and Branches viewed, time-on-content, scroll depth, downloads, video playback events, share link origin.
- Viewer analytics (a core feature): we record who viewed a given Shrub or Branch, when, for how long, from which IP/location, on what device, and which files were opened or downloaded. The Shrub owner sees this data. If you view a Shrub, assume the owner can see your viewing activity.
- Watermarking: we may embed visible or invisible watermarks in documents and media served to a viewer to identify the session.
- Cookies and similar technologies: see Section 9.
2.3 Information from third parties
- Social sign-in: if you sign in with Apple, Google, Instagram, or TikTok, we receive basic profile fields and email (subject to your settings with that provider).
- Payment processors: Stripe and Razorpay return transaction status, last-four digits, card brand, and risk signals.
- Referrals: if another user invites you, we receive your email and the inviting user's identity.
3. How We Use Personal Information
We use personal information to:
- Provide, operate, and maintain the Services, including hosting your content and serving it to viewers you authorize.
- Authenticate users and secure accounts.
- Process payments, send invoices, and administer subscriptions.
- Deliver analytics and engagement data to Shrub owners about their content.
- Enforce watermarking, waivers, access controls, and link expiry.
- Detect, investigate, and prevent fraud, abuse, and security incidents.
- Send transactional messages (receipts, security alerts, product updates) and, with consent where required, marketing communications.
- Comply with legal obligations and respond to lawful requests.
- Improve the Services, including training internal models on aggregated or de-identified usage data. We do not train AI models on the contents of your Shrubs without your instruction.
4. Legal Bases for Processing (EEA / UK Users)
Where GDPR or UK GDPR applies, we rely on the following legal bases:
- Contract — to provide the Services you signed up for.
- Legitimate interests — to secure the platform, prevent fraud, operate analytics, and improve the product. You can object at any time.
- Consent — for marketing emails, optional cookies, and certain integrations. You can withdraw consent at any time.
- Legal obligation — to comply with tax, accounting, and law enforcement requirements.
5. How We Share Personal Information
- With viewers you authorize. When you share a Shrub or Branch, its content and any associated metadata become visible to the recipients you choose.
- With service providers (processors). We share data with vendors who help us run the Services. They are bound by contract to use the data only for our purposes:
| Processor | Purpose | Location / Safeguards |
|---|---|---|
| Amazon Web Services (AWS) — S3, EC2, CloudFront, Lambda | Cloud hosting, file storage, media delivery, image processing | United States / Canada. Standard Contractual Clauses where applicable. |
| Stripe, Inc. | Payment processing (cards, subscriptions, payouts) | United States. SCCs; PCI-DSS Level 1. |
| Razorpay Software Pvt. Ltd. | Payment processing (select regions) | India. SCCs; PCI-DSS Level 1. |
| Pusher Ltd. / Laravel Reverb | Realtime messaging, notifications, presence channels | United States / EU. SCCs. |
| Apple, Google, Instagram (Meta), TikTok | OAuth sign-in (optional) | Data minimized to public profile and email. SCCs. |
| SendGrid / Postmark (transactional email) | Account emails, notifications, password resets | United States. SCCs. |
| Google Analytics / Plausible (if enabled) | Aggregate product usage analytics | United States / EU. |
| Sentry (if enabled) | Error monitoring and diagnostics | United States. SCCs. |
- For legal and safety reasons. We may disclose information to comply with law, enforce our Terms, protect rights and safety, or respond to lawful process. Where permitted, we will notify affected users.
- Business transfers. If we are involved in a merger, acquisition, financing, or asset sale, personal information may be transferred, subject to this Policy.
- With your consent. For anything else not described in this Policy.
- We do not sell personal information. We do not "sell" or "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.
6. International Transfers
Shrubs is operated from Canada and uses infrastructure in Canada, the United States, the European Union, and, for specific processors, India. When we transfer personal information across borders we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and Canada's adequacy status for commercial organizations under PIPEDA. Copies of transfer mechanisms are available on request at [email protected].
7. Data Retention
We retain personal information for as long as your account is active and for the period necessary to provide the Services and meet our legal obligations.
- Account data: for the life of your account and up to 24 months after closure (for dispute, tax, and accounting purposes).
- Uploaded content: until you delete it or close your account. Deleted content is removed from active systems within 30 days and purged from backups within 90 days.
- Viewer and analytics logs: up to 24 months in identifiable form, then aggregated or deleted.
- Billing records: 7 years to comply with Canadian tax law.
- Security logs: up to 12 months.
8. Security
We use industry-standard measures to protect personal information, including encryption in transit (TLS 1.2+), encryption at rest for uploaded content, hashed passwords, scoped API tokens, role-based access controls, and continuous monitoring. No system is perfectly secure; you are responsible for keeping your credentials confidential and using the access controls (expiring links, waivers, watermarks, viewer allowlists) appropriate for sensitive content.
9. Cookies and Tracking
We use cookies and similar technologies for three purposes:
- Strictly necessary — sign-in, session security, CSRF protection, load balancing. Cannot be disabled.
- Functional — remembering preferences, video playback position, UI state.
- Analytics — understanding aggregate usage of the Services.
Where required by law, we present a cookie banner allowing you to accept or reject non-essential cookies. You can also clear cookies in your browser or use a "Global Privacy Control" signal, which we honor for California users.
10. Your Rights
10.1 All users (PIPEDA, Canada)
Under PIPEDA you may request access to the personal information we hold about you, ask us to correct inaccuracies, and withdraw consent (subject to legal or contractual restrictions). You may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
10.2 EEA / UK users (GDPR)
You have the rights to access, rectify, erase, restrict, port, and object to processing of your personal information, and to withdraw consent. Where we rely on legitimate interests, you may object and we will stop unless we have compelling grounds. You may lodge a complaint with your local supervisory authority.
10.3 California users (CCPA / CPRA)
California residents have the right to know, delete, correct, and limit the use of sensitive personal information, and to opt out of sale or sharing. As noted above, we do not sell or share personal information. Categories collected:
| Category (Cal. Civ. Code § 1798.140) | Collected | Sold or Shared |
|---|---|---|
| Identifiers (name, email, IP address, account ID) | Yes | No |
| Customer records (billing details) | Yes | No |
| Commercial information (subscriptions, transactions) | Yes | No |
| Internet or network activity (product usage, analytics, view logs) | Yes | No |
| Geolocation (approximate, from IP) | Yes | No |
| Professional / employment information (if provided in profile) | Sometimes | No |
| Inferences drawn from the above | Limited | No |
| Sensitive personal information | No | No |
You may exercise any of these rights — free of charge and without retaliation — by emailing us at the address in Section 13. We will verify your identity using information associated with your account. Authorized agents may submit requests with written permission and proof of identity.
11. Children
The Services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
12. Changes to This Policy
We may update this Policy from time to time. Material changes will be posted on this page with a new effective date and, where required, notified to you by email or in-product. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.
13. Contact Us
Questions, requests, or complaints can be directed to our Privacy Officer:
- 2590700 Ontario Inc. (operating as Shrubs)
- Email: [email protected]
- Web: https://shrubs.me
Mailing address available on request. We aim to respond to all verifiable requests within 30 days.