Updated October 1, 2026. This notice covers the hosted workspaceAlberta procurement connector operated by Warre & Vavasour.
Public procurement searches can be used without signing in. Requests include the search terms, filters, business descriptions or documents you choose to provide. Your AI client sends tool inputs to this service and receives the results.
When you sign in with Google, we receive your Google account identifier and verified email to create your account and check paid access. We request only OpenID identity and email scopes, not Gmail messages, contacts or Drive files. We do not keep Google's access or ID tokens after verifying sign-in.
We store account details, saved business profiles and watchlists, OAuth client registrations and grant records, and subscription status and Stripe customer references. Payment details are handled by Stripe's checkout. Our connector does not receive your full card number.
The application runs on Google Cloud Run in Montréal; the account database is Supabase in Toronto. Cloudflare fronts the public endpoint. Google processes sign-in and Stripe processes payments under their own policies. These Canadian hosting locations do not mean every provider processes all data only in Canada.
Cohere and E2B are subprocessors used to deliver the optional planning and document-analysis features. Data sent to them can leave Canada:
us-west1, United States. E2B may change placement. This service does not configure Canadian sandbox residency. The sandbox sends the evidence and page images described above to Cohere and returns the result to us. We attempt to destroy the sandbox after the call and also set a short automatic expiry; this does not erase provider operational logs. See E2B regions, security and privacy policy.Configured alternative model routes may use Hugging Face, whose processing location depends on the selected provider. These are not a promise of Canadian-only processing. Only submit documents and business information you are permitted to share with the named providers. Public lookup tools without model planning do not send documents to E2B.
When enabled, PostHog receives operational events such as tool names, timing, success, plan and a pseudonymous subscriber identifier. These events exclude tool request bodies, profile contents and email addresses. Hosting and network providers may also retain request and security logs.
We use this data to provide procurement results, save your settings, authenticate connections, manage subscriptions and operate the service. Google sign-in is separate from marketing or outreach; this flow does not enroll you in a SendGrid campaign.
Saved account information persists until removed. Authorization sessions and tokens expire, but expiry does not automatically erase their database records or provider logs. You can remove watched opportunities with the connector, disconnect it in your AI client, and contact us to request account-data access, correction, deletion or revocation of outstanding connections. Some billing and operational records may need separate handling.
Your AI client's handling of conversations and tool results is governed by that client's policies. Revoking Google access does not itself cancel a workspaceAlberta subscription or immediately revoke previously issued MCP tokens; contact us if you need those revoked.
Contact: christian@warreandvavasour.com.