Privacy Policy

Effective April 28, 2026 · Plain English. This is the whole policy.

Short version: Osmo helps you fill the official Ontario MECP Form 2193E. We store the records you create on a Canadian server. Your typed notes and uploaded photos are processed by Google's Gemini API. We don't sell anything. You can delete your records at any time by emailing info@alpacalaunch.com.

Who we are

Osmo is operated by Alpaca Launch Inc., an Ontario corporation. Contact us about anything in this policy at info@alpacalaunch.com.

What we collect

While you use the app:

Well record data you enter — well location, owner name and address, geology log, casing/screen details, water yield, contractor details, dates. This is the same information that appears on MECP Form 2193E.
Field notes you paste and photos you upload (e.g. handwritten paper logs).
The PDF records you generate and save using Osmo.
Account info — your shared driller password (stored as a one-way hash, never in plain text). During the pilot we don't collect individual emails on signup.
Basic technical info — IP address (used for rate-limiting and abuse prevention), session cookie (see Cookies below).

Why we collect it

To pre-fill the official MECP Form 2193E PDF on your behalf.
To save your past records so you can come back to them.
To prevent abuse (rate-limiting failed logins, blocking automated attacks).

We don't use your data for marketing, profiling, training AI models, or any third-party advertising. There is no advertising on Osmo.

Where your data lives

Storage: on a server in Toronto, Ontario, Canada (operated by Vultr Holdings, LLC). Records are stored as files (`.pdf` and `.json`) — no database with combined customer data.
AI processing: the field notes you type and the photos you upload are sent to Google's Gemini API (operated by Google LLC) to extract field values. Google may process this data on servers outside Canada. Per Google's API Terms, Gemini API content is not used to improve Google's products by default. Don't paste anything into Osmo that you wouldn't share with a third-party AI service.
Backups: nightly encrypted backup of records to off-site cloud storage (Backblaze B2). Backups are kept for 30 days.

How long we keep it

Active records: as long as your account is active.
After deletion: removed from active storage immediately; remaining backup copies expire within 30 days.
MECP context: Ontario Reg. 903 requires you to file each well record with the Ministry within 30 days. Once filed, the record becomes part of the MECP's public well record database — that filing is separate from anything Osmo retains.

Your rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

Access your data — ask us what we have about you.
Correct inaccurate information.
Delete your records at any time.
Withdraw consent for processing — note that this means you can no longer use the service.
File a complaint with the Office of the Privacy Commissioner of Canada if you think we've handled your data improperly.

To exercise any of these rights, email info@alpacalaunch.com. We respond within 30 days.

Security

HTTPS-only — all traffic encrypted in transit (TLS 1.3).
Passwords stored as scrypt hashes — we cannot recover your password, only reset it.
Server hardened with firewall, automatic security patches, and process sandboxing.
Cross-site request forgery (CSRF) protection on every state-changing endpoint.
Rate limiting on login and AI endpoints to prevent abuse.
Backups encrypted at rest.

Breach notification

If your data is exposed in a security incident likely to cause real harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA's mandatory breach reporting rules — typically within 72 hours of discovery.

Cookies

Osmo uses exactly one cookie: a session cookie that keeps you logged in. It contains a signed identifier — no personal information. It is marked HttpOnly, Secure (when served over HTTPS), and SameSite=Lax. It expires after 8 hours of inactivity.

We do not use any analytics cookies, advertising cookies, or third-party tracking pixels.

Children

Osmo is a professional tool for licensed Ontario well contractors and their staff. It is not intended for or directed at anyone under 18.

Changes to this policy

If we materially change how we handle your data, we'll update this page and notify pilot participants by email (when applicable). The "Effective" date at the top reflects the latest revision.

Pilot disclosure

Osmo is currently in private pilot for the first 25 Ontario drillers. The service is provided free of charge during the pilot. Behaviour, retention, and security commitments described here apply during the pilot.

Contact

Privacy questions, access requests, or complaints:
Alpaca Launch Inc.
info@alpacalaunch.com