Your privacy matters. This Privacy & Cookies Policy explains how AncoraOak Studio and its affiliates (collectively, AncoraOak Asset Management Inc., “AAM,” AncoraOak Advisors LLC, “we,” “us,” “our”) collect, use, disclose, and safeguard information when you access or use our websites, investor portal, data rooms, APIs, and related services (the “Services”).
By using the Services, you consent to this Policy. Capitalized terms not defined here have the meanings in our General Terms of Service.
This Policy is designed to meet transparency obligations under the GDPR, CCPA/CPRA, and similar privacy regimes.
It explains: who we are, your privacy rights, marketing preferences, what data we collect, how and why we use data, cookies and trackers, data sharing, retention, security, children’s privacy, links, integrations, and updates to this Policy.
Controller:
AncoraOak Asset Management Inc. (and where applicable, AncoraOak Advisors LLC) is the controller of your personal data for the Services listed in this Policy.
Contact:
📧 Email: privacy@ancoraoak.studio
📍 Mail: AncoraOak Studio, Attn: Privacy, 150 King St W, Toronto, ON, Canada.
EU/UK representative:
We will appoint one where Article 27 GDPR/UK GDPR applies.
Depending on your jurisdiction, you may have the right to:
We verify each request and respond within the required timeframes. If we decline, you may appeal via the contact above.
We do not discriminate against anyone for exercising these rights.
To exercise your rights, email us at privacy@ancoraoak.studio with the subject line “Privacy Request”, or use Account → Settings → Privacy.
You may manage your marketing subscriptions via unsubscribe links, through Account → Email Settings, or by contacting us directly.
Transactional or service-related messages are not considered “marketing” and cannot generally be opted out of.
We collect data in three main ways:
We may collect:
We may receive data from:
We may also generate or receive aggregated or de-identified data that cannot identify you, unless re-linked.
We avoid processing “special categories” of personal data unless legally required (e.g., for identity verification). Sensitive Personal Information (SPI) is used only for limited lawful purposes such as compliance and security.
We use your data to:
Legal bases include contract performance, legitimate interests, consent (where obtained), and legal obligations.
We use cookies, pixels, local storage, and similar technologies for authentication, analytics, preferences, and (where applicable) advertising.
Categories of cookies:
You can manage cookies through your browser or device settings.
We honor cookie preferences where required by law but do not currently respond to “Do Not Track” signals.
If this changes, we will update this Policy.
We may share your personal data with:
If you ask us to delete your data, we’ll notify relevant third parties where possible.
We retain your data only as long as necessary to fulfill the purposes listed above, while your account is active, or as required by law. After that, data is securely deleted or de-identified.
We primarily operate from Canada and the United States, but may use subprocessors in other jurisdictions.
By using the Services, you consent to lawful cross-border transfers subject to appropriate safeguards (e.g., SCCs, adequacy decisions).
We implement administrative, technical, and physical safeguards aligned with industry standards (access control, encryption, monitoring, incident response).
While we take strong precautions, no system is completely secure.
Our Services are not intended for children under 16. We do not knowingly collect data from them; if we do, we delete it promptly.
Our Services may link to third-party sites. We are not responsible for their privacy practices or content. Please review their own policies.
If you connect third-party accounts (like Google, Microsoft, LinkedIn, GitHub), we only access minimal data needed for that feature—typically your name, email, and profile photo.
You may also allow read-only access to contacts, calendars, or files to use optional scheduling or file-sharing tools.
We store tokens securely, never your passwords. You can disconnect these integrations anytime via Account → Settings → Connected Apps or revoke access directly from the third-party account.
We may update this Policy periodically. Updates take effect upon posting.
Material changes will be highlighted or otherwise communicated where required by law.
Check the “Last Updated” date above for the most current version.
We do not “sell” personal data. You can opt out of data “sharing” for cross-context behavioral advertising.
Sensitive Personal Information (SPI) is used only for essential purposes (compliance, security, service delivery).
Your rights under applicable laws (CPRA, VCDPA, CPA, etc.) include:
Nevada residents may opt out of “sale” of data under NRS 603A by contacting privacy@ancoraoak.studio
Legal bases: Contract, legitimate interests, consent, and legal obligations.
Transfers: When data is moved outside your jurisdiction, we use SCCs or other lawful mechanisms.
Your rights: Access, correction, deletion, restriction, portability, and the right to object.
You may also file complaints with your local data protection authority (e.g., via EDPB).
Under PIPEDA (Canada), you may access, correct, or withdraw consent (subject to legal limits). Commercial messages comply with CASL.
We and our service providers use cookies and similar technologies for site functionality, analytics, and advertising (where applicable).
Here’s how they generally work:
Used to maintain sessions, protect against CSRF, and route traffic.
Examples: aos_session, aos_auth, aos_csrf.
Duration: Session up to 12 months.
Note: Blocking them may prevent login or break functionality.
Store your preferences and consent selections.
Examples: consent_choice, cookie_preferences.
Duration: 6–24 months.
You can adjust settings anytime via Manage Cookies in your account.
Help us measure and improve site usage:
Used to measure or personalize ads (where enabled):
Cookies from embedded platforms like YouTube (YSC, VISITOR_INFO1_LIVE) enable playback and analytics.
Duration: Session–6 months.
Used by infrastructure providers to detect bots and ensure uptime (e.g., __cf_bm).
Duration: About 30 minutes.
Cannot be disabled.
Cookie lifetimes may refresh upon repeat visits to maintain your preferences. Material updates will be posted here and in the banner when required.
Data we collect:
Who we share with:
We will notify you in case of any data breach as required by law.
Please check the “Last Updated” date for changes.
