Privacy Notice

1. Who we are#

Converge is provided by Pave Technologies, with its registered office at 935 Sheppard Ave W, Unit 1, North York, ON M3H 2T7, Canada ("Pave", "we", "us").

This notice covers the Converge website, the hosted Converge application and its admin and API services, and our sales and support contact with you. It does not cover on-premises installations that a customer runs on its own systems; that customer is responsible for data in its installation.

For privacy questions, write to our Data Protection Officer, Festus Iyera, at [email protected].

2. Controller and processor roles#

Data protection law treats an organisation differently depending on whether it decides why and how data is used (a controller) or handles data on someone else's instructions (a processor).

3. Personal data we collect#

Data you give us#

• Account details: name, work or school email, company name, job title or role, password (we store only a salted hash), and account type (business or student).
• Billing details: billing contact, company address, tax identifiers and invoice history.
• Enquiries and demo requests: name, email, company, role, country and your message.
• Support and feedback: what you write to us and any attachments.
• Project data: files and data you upload, such as lab reports and production data. These are mostly technical, but can contain names of staff, signatures, or contact details. We handle them as a processor (see section 2).

Data from your organisation#

Your organisation's Admins may invite you, which gives us your name and email, and may grant you module seats and roles.

Data collected automatically#

• Session and security records: when a session starts and was last used, IP address and browser user agent. Session tokens are stored only as keyed hashes.
• Audit log: security-relevant actions (such as sign-ins, invitations, seat and role changes, API key changes, exports and admin actions), with the user, time, IP address and user agent.
• Licence and usage records: seat check-outs and releases per module, AI Engineer request counts and sizes, and API and MCP usage, used for licensing, capacity and billing.
• Website data: IP address, the country Cloudflare detects from it, pages requested, browser type and the time of the request, in server and security logs. We do not use analytics or advertising tools.
• Cookies and browser storage: see our Cookie and Storage Notice.

Data we do not want#

We do not ask for special categories of personal data (such as health, religion or biometric data) or for data about criminal offences. Please do not upload them to Converge.

4. Why we use personal data and our lawful bases#

We must have a lawful basis for each use. The Nigeria Data Protection Act 2023 (section 25) and the GDPR (Article 6) allow similar bases. Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details.

If you do not provide the data needed for an account, we cannot open one for you. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. The AI Engineer and your data#

• When a user sends a request to the AI Engineer, we send the prompt, any attached files and the project data the request needs to a third-party AI provider configured for the service. Today that is Google (Gemini). The service also supports Anthropic, OpenAI and Moonshot AI, and may automatically fall back to another configured provider if the first is unavailable.
• We do not train AI models on your data. We use providers only under business API terms that do not allow them to train their models on our customers' requests. Providers may keep requests for a limited period to detect abuse (Google, for example, states 55 days for its paid Gemini API).
• AI Engineer conversations are stored in your Company's database and in your browser, so that you can come back to them.
• Do not include personal data in AI requests unless you need to.

6. Cookies and browser storage#

The website uses a small number of first-party preference cookies (language, unit system and region) and stores your theme choice in your browser. The application uses a session cookie to keep you signed in and browser storage to keep your working copy of a project. We do not use analytics, advertising or social-media cookies. Our Cookie and Storage Notice lists every item, what it does and how long it lasts, and explains how to change your choice.

7. Who we share data with#

We share personal data only with the following, and only as needed.

Service providers (sub-processors)#

The website also loads typefaces from Google Fonts. Your browser requests them directly from Google, which receives your IP address; Google Fonts does not set cookies.

We will update this list before we add or replace a sub-processor. Business customers get advance notice and a right to object under the DPA.

Others#

• Your organisation: Admins of your Company can see your profile, your seat use and the audit log for the Company.
• Professional advisers such as lawyers, auditors and insurers, under duties of confidentiality.
• Authorities such as courts, regulators or law enforcement, when the law requires it. We check that requests are lawful and disclose only what is required.
• A buyer or successor if we sell or reorganise our business, who must honour this notice.

8. International transfers#

We are based in Canada and host the service in the European Union. Some providers process data in other countries, including the United States and Singapore. When personal data moves between countries, we protect it as follows:

• From the EU, EEA or UK: we rely on an adequacy decision where one exists (for example, for providers certified under the EU-US Data Privacy Framework and its UK extension), or on the European Commission's Standard Contractual Clauses (2021) with the UK Addendum, together with an assessment of the destination's laws and extra safeguards such as encryption in transit.
• From Nigeria: under sections 41 to 43 of the Nigeria Data Protection Act, we transfer data only where the destination has adequate protection, or with appropriate safeguards such as contractual clauses, and we keep records of the basis for each transfer.
• Other countries: we use contractual protections of the same standard.

You can ask us for a copy of the safeguards that apply by writing to [email protected]. Business customers who need data to stay in a particular region should contact us before signing up.

9. How long we keep data#

We keep personal data only as long as needed for the purposes above, then delete it or make it anonymous.

10. How we protect data#

• Each customer Company has its own database, separate from every other customer's.
• Data is hosted on Google Cloud, encrypted in transit with TLS and encrypted at rest by Google Cloud.
• Passwords are hashed with PBKDF2-SHA256 (100,000 iterations, per-user salt). Email verification and reset links, session tokens and API keys are stored only as hashes.
• Sessions use secure, HttpOnly cookies, expire after 14 days without use, and can be revoked. Suspending a Company ends all its sessions.
• Sign-up, sign-in and password reset are rate-limited per address and per IP.
• Seats and permissions are checked on the server.
• Staff use a separate admin portal with role-based access; support roles are read-only; staff actions are written to the audit log.
• Databases are backed up with point-in-time recovery.
• We review sub-processors' security before we use them.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the relevant regulator within 72 hours of becoming aware of it where the law requires, and tell affected customers and people without undue delay.

11. Your rights#

Under the Nigeria Data Protection Act and the GDPR, and subject to some legal exceptions, you have the right to:

• be informed about how we use your data (this notice);
• access your data and receive a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it;
• object to uses based on legitimate interests, and to direct marketing at any time;
• data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another organisation;
• withdraw consent at any time, without affecting earlier use;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we do not make such decisions); and
• complain to a data protection authority (section 12).

How to use your rights#

• Email [email protected] and say what you want.
• We may ask you to confirm your identity, usually by replying from the email on your account.
• We respond within one month. If a request is complex, we may extend this by up to two further months and will tell you why.
• We do not charge, unless a request is clearly unfounded or excessive.
• For project data in a Company's workspace, we act for that organisation. We will pass your request to it and help it respond.
• You can update much of your profile yourself in the application, and your organisation's Admins can remove your access.

12. Complaints#

Please contact us first so that we can try to put things right. You can also complain to a data protection authority:

• Nigeria: the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng. You may use the NDPC's standard notice to address grievances, though you do not have to.
• European Union and EEA: the supervisory authority in the country where you live or work, or where the issue arose. The European Data Protection Board lists them at edpb.europa.eu.
• United Kingdom: the Information Commissioner's Office, ico.org.uk.
• Elsewhere: your local data protection authority.

13. Children and students#

Converge is not intended for children. Every user must be at least 18 years old, including users with student accounts. We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will close the account and delete their personal data. If you believe a child has given us data, contact us at [email protected].

14. Notice for California and other US states#

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about people. If a US state privacy law applies to you, you can ask to know, access, correct or delete your personal information using the steps in section 11, and we will not treat you differently for doing so. You may use an authorised agent; we may ask the agent for proof of authority.

15. Changes to this notice#

We will update this notice when our processing changes. Each version has a number and an effective date at the top. For material changes, we will tell account holders by email or in the product before the change takes effect.

16. Contact and Data Protection Officer#

Controller

Pave Technologies, 935 Sheppard Ave W, Unit 1, North York, ON M3H 2T7, Canada.

Privacy contact

[email protected]

Data Protection Officer

Festus Iyera, [email protected]