Dashboard

Privacy Policy

Last updated October 24, 2026

Draft for review. TAGGED INC. has not approved this text yet, and it is not legal advice. It describes how the Dashboard actually works today.

This policy explains what personal information the EBYSU Dashboard (the “Dashboard”, at https://ebysu.dev) collects about the people who use it, why, who processes it and where, how long it is kept, how it is protected and how to exercise your rights. The Dashboard is operated by TAGGED INC. (“we”, “us”), the company behind the EBYSU brand, and is used only by our employees and the contractors we invite. Shoppers of ebysu.com are not covered by this policy.

1. What we collect

  • Your account: your name and work email address, the role, permissions and product (SKU) access an administrator gives you, and a profile photo if you upload one.
  • Sign-in and security: your password as a one-way hash (Argon2id) — never the password itself; your authenticator app’s secret, encrypted; your recovery codes as hashes; for passkeys, the public key, a device name you choose and when it was last used. For each signed-in session: the IP address, your browser’s user agent and the times it started and was last used. Failed sign-in attempts and temporary lockouts.
  • Activity: an audit trail of sign-ins, invitations, permission changes, uploads, approvals and changes to settings, with the time, the IP address and the browser’s user agent.
  • Files you upload: label artwork, product licence documents, consultant reviews and similar business files. They are about our products, but can contain a person’s name or signature.
  • Emails we send you: invitations, sign-in resets and service notices go to your work email address.

The Dashboard uses no advertising or analytics trackers. It sets one sign-in cookie (needed to keep you signed in) and a cookie that remembers whether the side menu is folded, and stores your light/dark theme choice in your browser.

2. Why we use it

  • To give you access, keep the Dashboard and your account secure, and investigate misuse.
  • To do the label work you are part of: storing, reviewing and approving artwork, and keeping the record of who did what for each label.
  • To send you invitations, sign-in resets and notices about the Dashboard.

You give your consent by accepting the invitation and using the Dashboard. We use your information only for these purposes, and ask you before using it for anything else, unless the law allows or requires otherwise.

3. Who processes it, and where

We use these service providers to run the Dashboard. Each processes information only to provide its service to us:

  • Railway (Railway Corporation) — hosts the Dashboard, its database and its background jobs, in the United States.
  • Cloudflare R2 (Cloudflare, Inc.) — stores uploaded files in a private storage bucket.
  • Resend (Resend, Inc.) — delivers the Dashboard’s emails, from the United States.
  • Anthropic (Anthropic, PBC) — its Claude models review label artwork. Label images and label text are sent for each review; your account details are not.

Your information is therefore stored and processed outside Quebec and Canada, mainly in the United States, where the authorities there may access it under their laws. Before information is communicated outside Quebec, TAGGED INC. assesses whether it will be adequately protected and relies on written agreements with each provider. The Dashboard also downloads public product licence data from Health Canada; nothing about you is sent there.

4. How long we keep it

  • Your account stays while you have access. When an administrator deletes it, your profile, sign-in methods, photo and sessions are deleted with it.
  • A session ends when you sign out, after 12 hours without activity or 14 days after sign-in at the latest; expired sessions are deleted within the hour.
  • Invitation and sign-in reset links expire after 7 days.
  • The audit trail and uploaded files are kept as long as they are needed for the record of our labels and for security, and are then deleted. Backups of the database follow the hosting provider’s schedule.

5. How we protect it

The Dashboard is served over HTTPS only. Passwords are hashed with Argon2id; authenticator secrets and service keys are encrypted with AES-256-GCM; session tokens, invitation links and recovery codes are stored only as hashes. Two-step sign-in (an authenticator app or a passkey) is available to everyone. Each person sees only what their role and product access allow, and uploaded files are kept in private storage, reachable only through the Dashboard. Access to the hosting accounts is limited to the people who run the Dashboard.

6. Your rights

You may ask to see the personal information we hold about you, to have it corrected if it is wrong or incomplete, to receive it in a structured, commonly used format, and to withdraw your consent (in which case you can no longer use the Dashboard). Write to privacy@ebysu.com; we answer within 30 days. If you are not satisfied, you may complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

7. Person in charge of personal information

Martin Syrovatka, Chief Executive Officer of TAGGED INC., is responsible for the protection of personal information at TAGGED INC.. Contact: privacy@ebysu.com.

8. Incidents

If a confidentiality incident involves your personal information and presents a risk of serious injury, we will tell you and the Commission d’accès à l’information without delay, and we keep a register of incidents.

9. Automated processing

The Dashboard’s automated and AI reviews look at label artwork, not at people. No decision about you is made by automated processing alone.

10. Changes

We will post any change here and update the date above, and tell active users about significant changes.