Privacy Policy

Arena Operating System ("Arena OS", "we", "us") is operated by Arena Group Inc., a company incorporated in British Columbia, Canada. This policy explains what information we collect, why we collect it, how we use it, and the choices you have.

This policy covers the Arena OS web application at app.arenaos.ca and the website at arenaos.ca.

Who this policy is for

Arena OS is a business operating system sold to companies. In most cases your employer or the organization you work with is our customer, and you use Arena OS as a member of that organization. Your organization controls its own account, decides who has access, and can see the business data you enter into the system.

This policy describes what we do with information. Your organization may have its own policies about how it uses Arena OS.

Information we collect

Account information. Your name, email address, and the role and seat you hold in your organization. We collect this when your organization sets up your access.

Business data you enter. Metrics, targets, meeting notes, to-dos, issues, wins, and the other operating information you record in Arena OS. This is your organization's data.

Google account data. Only if you choose to connect your Google account. See the next section, which describes this in detail.

Technical information. IP address, browser type, and log data generated when you use the application. We use this to operate and secure the service.

We do not sell personal information. We do not use your data or your organization's data to serve advertising.

Google user data

Connecting a Google account is optional. Arena OS works without it. You can disconnect at any time.

If you choose to connect, Arena OS asks for permission to use two Google services. We request the narrowest scopes that let the features work.

Google Calendar

Scope requested: https://www.googleapis.com/auth/calendar.events

What we do with it. Arena OS runs a fixed meeting cadence for your organization, such as a weekly leadership meeting and a quarterly session. When you connect your calendar, Arena OS creates and updates calendar events for the meetings you are scheduled to attend, so the cadence appears in the calendar you already use. It reads event details for those meetings to keep the two in step when a meeting is rescheduled or cancelled.

What we do not do. We do not read your calendar for any purpose other than keeping your Arena OS meetings and your calendar consistent. We do not scan your calendar to build a profile of you, your contacts, or your working patterns.

Google Tasks

Scope requested: https://www.googleapis.com/auth/tasks

What we do with it. Arena OS tracks the to-dos you commit to in your meetings. When you connect Google Tasks, those to-dos are synchronized with your Google Tasks list so that completing an item in one place marks it complete in the other. The synchronization runs in both directions for the to-dos associated with your Arena OS account.

What we do not do. We do not read task lists unrelated to your Arena OS to-dos for any purpose other than performing this synchronization.

How Google data is stored and protected

We store an access token and a refresh token so the connection can keep working without asking you to sign in repeatedly. These tokens are stored encrypted and are never exposed to other users of Arena OS, including administrators of your own organization.

We store the minimum data needed to keep the two systems in step, such as the identifier of a calendar event or task that corresponds to an Arena OS record.

How to disconnect

You can disconnect your Google account at any time from within Arena OS. You can also revoke access directly at https://myaccount.google.com/permissions. When you disconnect, we delete the stored tokens and stop synchronizing. Calendar events and tasks already created remain in your Google account under your control.

Limited Use disclosure

Arena OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we confirm that data obtained through Google APIs is:

  • used only to provide and improve the features described above

  • never transferred to third parties except as required to provide those features, for security purposes, or to comply with applicable law

  • never used for advertising purposes

  • never sold

  • never read by a human, except with your explicit consent for a support request you have raised, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized

How we use information

We use the information we collect to:

  • provide and operate the Arena OS application

  • authenticate you and keep your organization's data separated from other organizations

  • provide support when you or your organization asks for it

  • maintain security, prevent abuse, and diagnose faults

  • meet our legal obligations

Service providers

We use a small number of providers to run Arena OS. Each has access only to what it needs to perform its function.

Provider: Supabase | Purpose: Application database and authentication

Provider: Vercel | Purpose: Application hosting and delivery

Provider: Google | Purpose: Calendar and Tasks integration, where you have connected it

Provider: Resend | Purpose: Transactional email, such as notifications and account messages

These providers may store or process data outside Canada, including in the United States. Where that is the case, the data remains subject to this policy and to our agreements with those providers.

Data retention

We keep your organization's data for as long as the organization has an active Arena OS account. If your organization ends its subscription, we retain the data for a limited period so it can be exported, then delete it.

Google tokens are deleted as soon as you disconnect your Google account.

Your choices and your rights

You can:

  • ask what personal information we hold about you

  • ask us to correct information that is wrong

  • ask us to delete your personal information, subject to our obligations to your organization and to law

  • disconnect Google access at any time, without losing access to Arena OS

If you are a member of a customer organization, some of these requests are best made through your organization's Arena OS administrator, because your organization controls its own account. We will help either way.

To make a request, email info@arenagroup.ca.

Depending on where you live, you may have rights under Canada's Personal Information Protection and Electronic Documents Act, British Columbia's Personal Information Protection Act, or other applicable privacy law.

Security

We protect data using encryption in transit and at rest, row-level access controls that keep each organization's data separate, and access restrictions on our own staff. No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your information, we will notify you and the relevant authorities as required by law.

Children

Arena OS is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.

Changes to this policy

We may update this policy. If we make a material change, we will notify customer organizations and update the date at the top of this page.

Contact

Arena Group Inc. Abbotsford, British Columbia, Canada info@arenagroup.ca

Arena Operating System Last updated: 6 August 2026