Privacy policy

01Who is responsible

Incomplete Systems, Alberta, Canada, operates Ribbon Studio and is responsible for the personal information under its control. Our Privacy Contact can be reached using the public business contact details below.

This policy covers Ribbon Studio’s website, editor, assistant, agent interfaces, and billing operations. Independent services you choose to use—such as an external agent, a registry, a website hosting your media, or your own exported application—also have their own privacy practices.

Applicable privacy law can include Alberta’s Personal Information Protection Act and Canadian federal law, including where information crosses provincial or national borders. This policy does not limit any right you have under applicable law.

02Information we handle

We do not ask you to put payment-card numbers or passwords in projects, prompts, or support requests. The app does not store full card numbers or card security codes in its project or billing database.

03Why we use information

We use information to provide the features you request; save, synchronize, share, and reopen projects; enforce project membership and editing roles; display participant and agent presence; authenticate access; connect authorized agents; generate AI responses; deliver exports; administer subscriptions and usage billing; prevent duplicate requests or charges; investigate errors, security incidents, or billing disputes; answer requests; and meet legal, tax, and recordkeeping obligations.

We seek consent where it is required. Choosing a connected feature can involve sending information needed for that feature to its service providers. We may also handle information without consent where applicable law permits or requires it, such as to comply with a lawful request or investigate suspected fraud.

Our application does not currently include advertising trackers or use your project content to target advertising. We do not sell personal information as part of providing Ribbon Studio. These statements do not replace the separate policies of a third-party service you independently authorize.

04AI requests and generated results

The in-app assistant and generated enhancements use OpenAI’s API for model-backed requests. A request can include your prompt, relevant messages, a snapshot of the current project or selected asset, editable source, labels, settings, and available editor controls. The context builder omits embedded image, audio, and video data bytes when preparing ordinary assistant context, but text, source code, metadata, and remote resource addresses may still be included. Do not assume a project is private from the model provider once you ask AI to work with it.

We request responses with provider response storage disabled. This setting is not a promise of zero provider retention and does not disable every provider security or abuse-monitoring process. OpenAI’s current API data controls documentation explains its retention and data-use practices.

Separately, Ribbon’s server keeps a hash of the request and stores validated response data so that a repeated request can retrieve its result without running and billing the same operation again. A generated response can contain project-related text, code, or proposed changes. Our usage records also include provider response and model identifiers, token counts, status, and timestamps. The raw request prompt is not stored as a separate prompt field in this billing record; that does not mean generated results or all copies held by providers contain no personal information.

Metronome receives usage events and billing customer references needed to prepare and deliver invoices for recorded usage charges. Those usage events contain model, request, time, token, accepted rate-version, and charge information rather than the prompt or the full project. Stripe processes the resulting payment and invoice information.

05External-agent connections

When you connect a remote MCP session, commands and results pass through the Ribbon server to and from your open browser tab. The temporary routing records may contain project content if an operation reads or edits it. A session’s access expires separately from the retention of its stored operation records.

WebMCP exposes tools through a supporting browser. A browser or agent host you authorize can invoke them and receive results under that host’s own controls and privacy practices. Registration of browser tools does not itself create a cloud project backup.

Disconnect remote access in Agent access and revoke or stop browser-agent access in the browser or host when you no longer want it. Hiding the in-app assistant or switching external-agent display mode does not revoke those permissions. Consider what an external provider will receive before giving it access to confidential or personal information.

06Service providers and international processing

We use providers for hosting and database operations, sign-in, AI processing, payment processing, and usage billing. These include Cloudflare for hosting, storage and sign-in email delivery, OpenAI for AI processing, Stripe, and Metronome. Providers receive information relevant to their role, subject to their applicable agreements and legal obligations.

Information may be processed outside Canada, including in the United States. Cloudflare describes processing primarily in the United States and European Economic Area, with global access, and other providers identify additional processing countries in their published information. We have not established a Canada-only processing restriction for Ribbon Studio. Information processed abroad may be accessible to courts, law enforcement, or other authorities under the laws of those jurisdictions.

The following provider information identifies processing purposes, international practices, and, where published, provider and subprocessor countries. Contact our Privacy Contact for information about the policies and practices that apply to our use of providers outside Canada.

• OpenAI: Privacy policy, subprocessors and countries, and API data controls.
• Cloudflare: Privacy policy and subprocessors.
• Stripe: Privacy policy and service providers.
• Metronome: Privacy policy.

Component previews and imports may request dependencies from services such as esm.sh and jsDelivr, registries you select, and external image, font, video, or audio hosts. Those services can receive technical information associated with the request. Review imported code and external resource addresses before using them.

We may disclose information where reasonably necessary to comply with law, protect rights or security, or complete a lawful business reorganization subject to appropriate protections. We do not make private projects publicly available merely because you use the service.

07Browser storage, connected features, and your choices

The editor uses browser storage for projects, libraries, drafts, history, and preferences. Authentication and payment services may use cookies or comparable technologies needed to operate their services. Our application does not currently install an advertising or cross-site marketing analytics integration.

You can use available export controls to keep a copy of your work, adjust browser storage or cookie settings, and clear site data. Clearing site data can remove local projects and conversation history and may sign you out. It does not remove separate server records, cancel a subscription, or delete information already received by a provider.

You can decline optional AI requests and external-agent connections. Withdrawing consent for an optional feature may prevent us from providing that feature, but it does not prevent basic local editing where otherwise available. Contact us about withdrawing consent for information we control; legal or contractual limits may apply to information needed for an existing transaction or legal obligation.

08Retention and security

We retain information only while there is a reasonable business or legal need for the purposes described here. Retention depends on the type of information, an active account or transaction, support or dispute needs, security, and applicable law. Financial and tax records may need to be retained for several years; Canadian GST/HST records generally have a six-year requirement measured from the end of the relevant year, with exceptions.

Local work remains subject to your browser’s storage and your own deletion choices. Remote-agent records have access-expiry and cleanup mechanisms, but expiry is not a guarantee of immediate deletion. Cloud project snapshots, registry releases and revision records, AI response records, and billing records do not currently have a fixed automatic deletion schedule. Removing a participant ends their membership access. Registry read tokens must be revoked separately, and changing a registry to private restricts subsequent anonymous access. These actions do not delete the project or copies already downloaded or installed. We will consider a deletion request against the purposes and legal requirements that still apply, and delete or anonymize information when it is no longer reasonably needed.

We use measures appropriate to the information and risks, including authenticated account boundaries, protected transport, restricted administrative access, validation of commands, and payment processing through Stripe. No online service or browser storage is completely secure. Avoid submitting unnecessary sensitive information and protect the devices and third-party accounts you use.

09Access, correction, questions, and complaints

You may ask what personal information we hold about you, how it has been used or disclosed, request access or correction, and raise a privacy concern. You may also request deletion or withdraw consent, subject to any legal retention duty, exception, or other limit that applies. A request does not automatically remove a financial record we must keep.

Contact the Privacy Contact below and describe your request. We may need to verify your identity and clarify the records you mean. We will explain any lawful restriction, applicable fee, or reason a request cannot be fully completed. We respond within the timeframe required by applicable law; Alberta PIPA access requests are normally subject to a 45-day response period, with extensions where permitted.

If a concern is not resolved, you can contact the Office of the Information and Privacy Commissioner of Alberta or another privacy regulator with jurisdiction. More information is available in Alberta’s guide to accessing personal information.

Ribbon Studio is intended for people who can legally use and agree to the service. If you believe a child’s personal information has been provided without appropriate permission, contact us so we can assess and address it.

10Updates to this policy

We may update this policy when our features, providers, or legal obligations change. The effective date appears at the top of the page. We will provide notice or obtain additional consent where a material change or applicable law requires it.

These explanations describe Ribbon Studio’s current handling and the connected features when used. A planned paid feature is not active solely because its possible data flow is described here; check its current availability in the app.