Privacy policy

Effective date: April 17, 2026. Last updated: October 22, 2026. Version 1.1.

About this policy

This policy describes how Beyond Aerospace Ltd., trading as Ares Networks ("Ares Networks", "we", "us"), a company incorporated in British Columbia, Canada, collects, uses, discloses and protects personal information in connection with the Ares agent governance platform (the "Platform"), offered through the Microsoft Azure Marketplace, and this website.

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and with United States privacy laws, including state privacy statutes, where they apply to our customers.

1. Scope

This policy applies to:

• personal information collected from or about people who use the Platform, including employees and agents of enterprise customers ("Customer Personnel");
• information collected through the Azure Marketplace listing, this website, the sandbox, the newsletter and our documentation;
• information we process on behalf of enterprise customers as a data processor or service provider.

It does not apply to information processed only inside a customer's own environment where we have no independent access to it.

For enterprise deployments we usually act as a data processor (under PIPEDA) and a service provider (under US state laws such as the CCPA) for Customer Personnel data, and as a data controller for account registration, billing, newsletter and website data.

2. Definitions

• Agentic AI system: an autonomous or semi-autonomous AI system that takes inputs, makes decisions, runs multi-step workflows and uses external tools or APIs with limited human involvement per action.
• Audit log data: the records the Platform writes about agent decisions, tools invoked, data accessed and actions taken, used for governance and compliance.
• Customer: the organisation that subscribed to the Platform through the Azure Marketplace and accepted our terms.
• Customer Personnel: employees, contractors and authorised users of a Customer whose personal information may be processed through the Platform.
• Personal information: information about an identifiable individual as defined by PIPEDA, or "personal data" and equivalent terms under applicable US state laws.

3. Information we collect

Account and subscription

Organisation name, billing address and Azure subscription identifiers; contact details for authorised administrators (name, business email, phone); payment and billing information, processed through Microsoft's Azure billing.

Platform operation

• Audit log data: agent decision records, tool calls, policy outcomes, access events and workflow traces.
• Configuration: governance policies, roles, permission rules and compliance settings set by Customer administrators.
• Identity metadata: user and service identifiers, role memberships and sign-in events. Never passwords or secret tokens.
• Usage telemetry: feature use, API call volumes, error rates and performance data, aggregated or pseudonymised.

Support and communications

Contact details and the content of your messages; diagnostic data and logs you choose to send with a support request; survey responses and feedback.

What we do not collect

The Platform keeps a minimal footprint. We do not collect or store the content of agent prompts, model outputs or documents processed by agents, unless the Customer turns on retention for audit and it is set out in the data processing agreement.

4. Why we use it, and on what basis

• Providing and managing subscriptions (account, billing and identity data): contract; consent.
• Delivering governance and audit functions (audit log data, configuration): contract; legitimate interest.
• Security monitoring and incident response (access logs, telemetry): legitimate interest; legal obligation.
• Improving the product (aggregated, de-identified telemetry): legitimate interest.
• Support and communications (support data): contract; consent.
• Meeting legal and regulatory obligations (as required): legal obligation.
• The newsletter and other marketing (email, only if you opt in): express consent.

Under PIPEDA we rely on knowledge and consent, with implied consent for processing needed to perform our contracts with Customers.

5. The newsletter

We send the newsletter only to people who subscribe and give express consent. We record that consent: the address, the time, the page and the wording you agreed to, as Canada's Anti-Spam Legislation (CASL) requires. Every message names us, gives a way to contact us, and carries a one-click unsubscribe link. We act on an unsubscribe within ten business days, usually at once. We do not sell or share the list.

6. The sandbox and developer tools

The sandbox runs scripted scenarios on an isolated demo network, with mock identities and no path to any customer system. To limit abuse we count anonymous runs with a first-party cookie and a hashed IP address. Run records are deleted after 30 days unless you save a run as a report. If you give us your email to keep using the sandbox or a tool, it is handled as in section 5 and only used for what you agreed to.

Do not paste personal or confidential information into the sandbox or the tools.

7. Disclosure

Service providers

Providers who process personal information on our behalf, including Microsoft Azure (infrastructure, hosting, identity), analytics and monitoring providers, and email delivery. Each is bound by contract to process it only as we direct, to protect it, and to follow applicable privacy law.

Customers

Audit log data and governance reports go to the Customer that controls the deployment. We never disclose one Customer's data to another.

Legal requests

We may disclose personal information without consent where the law requires or permits it: a court order, subpoena or other lawful process from a Canadian or US court or regulator; a request from a law enforcement or national security agency with lawful authority; or to prevent fraud, protect someone's safety, or protect our legal rights. Where the law allows, we tell the affected Customer first.

Business transfers

If the company is merged, acquired, financed or sells assets, personal information may pass to the successor under equivalent protections.

No sale

We do not sell personal information and do not share it with third parties for their own advertising. This applies to US residents under the CCPA and to everyone else.

8. Cross-border transfers

We are a Canadian company serving customers in the United States and elsewhere, so personal information moves between Canada and the US. Transfers to US providers are covered by contracts that require them to protect it. Where needed we sign data processing agreements with standard contractual clauses or equivalent mechanisms. Information held in the US may be accessible to US law enforcement and national security authorities. Customers can ask for our standard data processing agreement (see section 13).

9. Retention

• Account and billing data: for the subscription, then seven years for tax and accounting.
• Audit log data: as the Customer configures it; ninety days by default.
• Usage telemetry: aggregated and de-identified, kept for product analytics.
• Support messages: three years from the last exchange.
• Newsletter: until you unsubscribe, then only the record of consent and withdrawal.
• Sandbox runs: 30 days, unless saved as a report.

When a subscription ends we delete or anonymise Customer personal data within sixty days, unless the law or a written agreement requires longer.

10. Security

We use physical, administrative and technical safeguards that match the sensitivity of the information: encryption in transit (TLS 1.2 or higher) and at rest; role-based access and least privilege; monitoring and logging of access to personal information; penetration testing and vulnerability management; privacy and security training; and an incident response procedure with set notification times.

If a breach creates a real risk of significant harm, we notify the people affected and, where required, the Office of the Privacy Commissioner of Canada and the relevant US state regulators.

11. Your rights

In Canada (PIPEDA)

For information we control, you can ask to see it, challenge its accuracy and have it corrected, withdraw consent (subject to legal and contractual limits), and complain to the Office of the Privacy Commissioner of Canada.

In the United States

Depending on your state, you can ask what we collected, used and disclosed; ask us to delete or correct it; opt out of sale or sharing (we do neither); exercise these rights without discrimination; and appeal a refusal.

If your employer is our Customer

Your employer is your first contact for information the Platform processes on its behalf. We help Customers answer verified requests.

Making a request

Write to privacy@ares-networks.com. We acknowledge within ten business days and answer within thirty days, or as the law requires. We may ask you to verify your identity.

12. Cookies

This website uses first-party cookies only for what it needs to work: session state, your theme, and the sandbox run counter. Analytics, where used, are cookieless and aggregated. The Platform, deployed in a Customer's environment, does not set cookies on its own account; cookies in interfaces the Customer controls are covered by the Customer's own notice. You can manage cookies in your browser, though some features may stop working.

13. Children

The Platform is enterprise software, not directed at anyone under eighteen. We do not knowingly collect information from minors and delete it promptly if we find any.

14. Changes

We may update this policy as our practices, the Platform or the law change. For material changes we update the Marketplace listing and this page, and notify the primary administrator on file at least thirty days before the change takes effect. The "last updated" date above always shows the current version.

15. Contact

Privacy Officer, Beyond Aerospace Ltd., trading as Ares Networks, privacy@ares-networks.com, Canada.

Regulator in Canada: Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, QC K1A 1H3, priv.gc.ca, 1-800-282-1376. US residents may also contact their state privacy regulator.

16. Governing law

This policy is governed by the laws of Canada, including PIPEDA, and of British Columbia. Where US state privacy laws (including the CCPA as amended by the CPRA, and similar laws in Virginia, Colorado, Connecticut, Texas and other states) apply to us for US residents, we meet those obligations. Nothing here limits rights you have under mandatory law.