GANTLETT SYSTEMS INC. · DATA GOVERNANCE & PRIVACY EFFECTIVE NOVEMBER 6, 2026

Privacy Policy & Sovereign Data Governance

Gantlett Systems Inc. (Federal & Ontario Corporation, Ontario, Canada) and our R&D laboratory SophiaLabs engineer deterministic AI governance tooling with zero third-party ad trackers, zero CLI phone-home telemetry, and strict PIPEDA stewardship.

INSTITUTIONAL PRIVACY INVARIANT (GANTLETT.IO & SOPHIALABS.CA)

We never deploy behavioral ad pixels, never collect telemetry from the open-source nomos CLI, and never sell or train models on executive or developer inquiries.

0 Ad Trackers

Zero Google Analytics, Meta Pixel, or third-party ad cookies

0 CLI Phone-Home

Apache 2.0 Nomos CLI executes 100% offline on local SQLite & Git

0 Data Resale

Client & visitor inquiries are never sold, brokered, or used to train models

PIPEDA Aligned

Canadian federal & Ontario corporate stewardship ([email protected])

SEC-01 · INSTITUTIONAL SCOPE & CLIENT CONFIDENTIALITY

Scope of Policy & Enterprise Engagement Confidentiality

This Privacy Policy governs gantlett.io and executive advisory intake operated by Gantlett Systems Inc. ("GSI", "we", "us"), alongside our open-core R&D division SophiaLabs (sophialabs.ca).

✓ Executive Scoping Intake (/api/contact): When you request a 20-minute Principal Architect review or 14-Day Seam Pilot briefing, we collect the business contact details you provide (name, corporate email, organization, team scale, and architectural notes) solely to evaluate scope and respond directly.
✓ Interactive Executive AI Advisor (Sophia): Prompts entered into the optional Sophia advisor drawer on gantlett.io are transmitted over TLS to dedicated Gantlett Systems GPU silicon in Ontario, Canada to answer architectural and engagement questions. Please do not paste confidential production credentials or regulated personal data into public web chat.
✓ Air-Gapped & On-Premise Client Work: During commercial pilots and Forward Deployed Engineering sprints, Nomos executes inside your repository worktrees or private VPC/hardware with zero external code exfiltration.

SEC-02 · FIRST-PARTY TELEMETRY & PERIMETER SECURITY

First-Party Web Telemetry, Browser Storage & WAF Security Logs

We operate cookieless first-party operational telemetry to measure aggregate documentation readership, CLI install health, and perimeter security without cross-site tracking cookies.

✓ Zero Third-Party Tracking Cookies: Neither gantlett.io nor sophialabs.ca loads Google Analytics, advertising pixels, session-replay scripts, or third-party behavioral profiling SDKs.
✓ Cookieless First-Party Beacons (/api/beacon & /go/*): Same-origin navigation and shortlink events record page path, referrer, viewport class (desktop/mobile/tablet), read-time duration, and a non-persistent session hash rather than persistent tracking cookies.
✓ Local Browser Preferences (localStorage): UI preferences such as Light/Dark theme selection on gantlett.io and unread chapter/specification watermarks on sophialabs.ca remain strictly in your local browser storage.
✓ Edge & Origin Security Logs (Nomos Firewall): Cloudflare CDN/WAF and Google Cloud Run process request IP addresses, country codes, TLS metadata, and User-Agent strings to enforce rate limits, block exploit probes, and maintain service availability.

SEC-03 · OPEN-CORE CLI & LOCAL TOOLING BOUNDARY

Zero Phone-Home Guarantee in Nomos Open-Core Tooling

Engineers evaluating our Apache 2.0 Nomos CLI harness (github.com/mgantlett/nomos) retain 100% local custody of source code, AST metrics, and task ledgers.

✓ 100% Local Execution: The nomos binary compiles and evaluates Go and Tree-sitter AST quality gates locally on the developer workstation or CI runner without transmitting source code, file paths, or prompts to Gantlett Systems or SophiaLabs.
✓ Local SQLite & Git Provenance: Task state (nomos_global.db), associative memory (mneme.db), and Two-Phase Commit receipts (refs/notes/nomos/releases) reside strictly on your local filesystem and Git remotes.
✓ Verified Binary Distribution: Downloading install scripts or release tarballs from sophialabs.ca/install or GitHub Releases logs only standard HTTP download counts and never installs background telemetry daemons.

SEC-04 · INFRASTRUCTURE, RETENTION & TRANSFERS

Infrastructure Subprocessors, Data Retention & Cross-Border Processing

Gantlett Systems Inc. minimizes external dependencies and processes portal traffic strictly through hardened North American cloud and sovereign hardware infrastructure.

✓ Infrastructure Providers: Public web portals are served via Cloudflare (global edge TLS, CDN caching, and WAF) and Google Cloud Run (North America stateless containers), while interactive AI inference runs on dedicated Gantlett Systems sovereign GPU hardware in Ontario, Canada.
✓ Operator Dispatch Bridge: Voluntarily submitted consultation or advisory intake forms (/api/contact) notify our Principal Systems Architect via an authenticated internal Discord webhook and internal Gantlett Systems intake queue.
✓ Retention Boundaries: Ephemeral security and funnel logs are retained only as required for abuse prevention, capacity planning, and aggregate reliability diagnostics; client and prospect correspondence is retained for active engagement records and deleted upon verified request.
✓ No Model Training or Brokerage: We never sell, rent, or broker personal information, and we never submit client inquiries or repository artifacts to public foundation-model training pipelines.

SEC-05 · STATUTORY RIGHTS & PRIVACY OFFICER

Your Privacy Rights (PIPEDA, Quebec Law 25, GDPR & CCPA) & Contact

Gantlett Systems Inc. (a Federal and Ontario Corporation headquartered in Ontario, Canada) adheres to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and respects global data-subject rights.

✓ Access, Correction & Deletion: You may request access to, correction of, or deletion of any personal contact information you have voluntarily submitted to us.
✓ Withdrawal of Consent: You may withdraw consent for prospective advisory follow-ups at any time by replying to an email thread or contacting our Privacy Officer.
✓ Enterprise & Regulated Engagements: Institutional engagements (including the 14-Day AI Governance & Seam Charter Pilot and air-gapped Sovereign deployments) are governed by mutually executed Non-Disclosure Agreements (NDAs) and Master Services Agreements (MSAs) where client source code remains inside client-controlled environments.
✓ Privacy Officer Contact: Direct all privacy inquiries, access requests, or security disclosures to Mark Gantlett, Principal Systems Architect & Privacy Officer, Gantlett Systems Inc., Ontario, Canada at [email protected].

DIRECT PRIVACY & SECURITY STEWARDSHIP

Contact the Privacy Officer

For PIPEDA / GDPR / CCPA data-access or deletion requests, enterprise security questionnaires, or questions regarding our SophiaLabs R&D division (sophialabs.ca/privacy), contact us directly:

[email protected] Executive Consultation Intake → ← Return to Gantlett Systems