Legal

Privacy Policy

Effective date: 22 January 2026 · Applies to play.aurora418.com and the BizQuest™ platform

This policy applies to the BizQuest™ platform at play.aurora418.com, operated by Aurora418 Inc.

1. Who we are

Aurora418 Inc. (“Aurora418,” “we,” “us,” or “our”) is a federally incorporated Canadian company (Business Number 102229444), registered in Saskatoon, Saskatchewan. We built BizQuest™, an AI-powered adaptive business simulation platform available at play.aurora418.com (the “Platform”).

This Privacy Policy explains what personal information we collect through the Platform, why we collect it, how we use and protect it, and the choices and rights you have. It is written to comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which governs our handling of personal information in the course of commercial activity in Canada.

2. Information we collect

We collect information in three broad categories:

a) Information you give us directly

b) Information generated through your use of the Platform

c) Information collected automatically

3. Why we collect and use your information, and our legal basis

Under PIPEDA, we may only collect, use, or disclose personal information for purposes a reasonable person would consider appropriate in the circumstances, and we generally rely on your consent (which may be express, e.g. at account creation, or implied through your use of the Platform for its intended purpose). We use your information to:

We do not use your information for automated decision-making that produces legal or similarly significant effects about you without human involvement.

4. Who we share your information with

We do not sell, rent, or trade your personal information. We may share it with:

Each third-party service provider is permitted to use your information only to provide services to us, not for their own independent purposes.

5. Cross-border storage and transfer

Your information may be stored or processed on servers located outside of Canada, including in the United States, because some of our service providers (such as Supabase) host infrastructure there. Personal information stored outside Canada is subject to the laws of the country in which it is held, including potential access by that country’s authorities.

Where we transfer personal information outside Canada, we take reasonable contractual and technical steps to require a comparable standard of protection from our service providers.

6. How we protect your information

We use technical and organizational measures designed to protect your personal information against unauthorized access, loss, or misuse, including encrypted storage of credentials, access controls limiting who on our team can view personal data, and secure handling of API keys and credentials.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify you and the Office of the Privacy Commissioner of Canada as required by law.

7. How long we keep your information

We retain personal information only as long as necessary to fulfil the purposes described in this Policy, or as required by law (for example, tax and corporate records). Account data is retained while the account is active, plus 3 years after closure; gameplay/quest data is retained for 5 years for product improvement purposes. When information is no longer needed, we securely delete or anonymize it.

8. Your rights

Under PIPEDA, you have the right to:

To exercise any of these rights, contact us using the details in Section 11. If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

European Union / United Kingdom users

If you are located in the European Union or United Kingdom, additional rights may apply to you under the General Data Protection Regulation (GDPR) or UK GDPR, including the right to erasure, the right to restrict or object to processing, and the right to data portability. Contact us using the details in Section 11 if you wish to exercise these rights or have questions about how they apply to you.

9. Cookies

The Platform uses cookies and similar technologies to operate and improve your experience. Details are set out in our separate Cookie Notice.

10. Children’s privacy

The Platform is intended for business professionals, students in post-secondary or executive education contexts, and adults. We do not knowingly collect personal information from children under 16.

11. Contact us

If you have questions, requests, or complaints about this Privacy Policy or our handling of your personal information, contact:

12. Changes to this Policy

We may update this Privacy Policy from time to time as our Platform, practices, or legal obligations evolve. We will post the updated version with a new effective date and, for material changes, will provide reasonable notice through the Platform.