Last updated: 22 September 2026
This is a new version of our privacy policy. It replaces the version dated 1 September 2019 and folds in the separate "Data Protection Policy" page, which is now retired. If you want to compare, contact us at the address below and we'll send you the old text.
ArboStar is a brand operated by Innovation Systems Corp, a company registered in Ontario, Canada, with its office at 478 King St W, Office 1206, Toronto, ON M5V 0A8, Canada.
For everything this policy covers, Innovation Systems Corp is the data controller — except where we say we act as a processor (see the next section). Other addresses shown elsewhere on this site (London, Delaware, Sydney) are mailing addresses only, not separate legal entities or branches, and they don't change who the controller is.
We have not appointed a Data Protection Officer — the law doesn't require us to. For any privacy question, contact us directly using the details below.
This policy covers personal data we collect and use for our own purposes: running this website, handling enquiries and demo bookings, managing your ArboStar account and billing relationship, and sending you service and marketing communications. For all of that, we are the controller.
Separately, if you're an ArboStar customer, you and your team use the ArboStar platform to store and manage data about your own clients — for example homeowners or property managers you serve. For that data, you are the controller and we are the processor: we only process it on your instructions, under our Data Processing Agreement, available on request from info@arbostar.com. If you're one of our customer's clients with a question about how your data is used, contact that customer directly, not us. Our current subprocessor list for this processing is available on request from info@arbostar.com.
The rest of this policy is about the first case: data we hold about you as a website visitor, lead, customer contact, or user of our own systems.
Website visitors. Technical data (IP address, browser, device, pages viewed, referring site) collected automatically through cookies and similar technology — see our Cookie Policy for the full list. We also run an IP-based country lookup on our own server, using an offline database, to work out which region you're browsing from (for example, to decide whether to show a cookie banner). This lookup result is not shared with any third party.
Leads and enquiries. If you request a demo, ask for pricing, download a resource, or fill in a contact form, we collect what you give us: name, work email, phone number, company name, and anything you write in a message field. Some of this reaches us indirectly — for example, cold outreach campaigns run through Snov.io, or a meeting you book through Calendly.
Customer account and billing contacts. If your company becomes an ArboStar customer, we collect the name, email, phone number, billing address, and role of the people your company designates as account, billing, or signing contacts, through Pipedrive, the ArboStar Hub billing portal, and related tools.
Contract signers. If you sign a contract with us, we collect your name, email, IP address, and a timestamped signature record through our self-hosted Documenso e-signature system.
SMS subscribers. If you opt in to text messages, we collect your mobile number and your consent record — see "SMS / text messaging" below.
Job applicants. We don't run a job-application form on this site; applications go by email to recruiter@arbostar.com. If you email us a CV, we hold your details only to evaluate that application, and we delete them 6 months after we make a hiring decision.
Sources. Most of this comes directly from you. Some of it reaches us another way:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries, providing quotes, booking demos | Contact details, message content | Contract (steps to enter a contract at your request) |
| Setting up and managing your ArboStar account and billing | Account/billing contact details, company details | Contract (performing our agreement with your company) |
| Processing payments and issuing invoices/receipts | Billing contact details, transaction records (not card numbers — see "Recipients" below) | Contract; legal obligation (tax/accounting records) |
| Contract signing (Documenso) | Signer name, email, IP address, signature timestamp | Contract; legal obligation (evidencing the agreement) |
| Sending service messages (receipts, payment reminders, renewal notices) | Contact details, billing/service status | Contract; legitimate interest — keeping you informed about a service you're paying for |
| Sending marketing emails about ArboStar's own products (we don't send marketing text messages) | Contact details, marketing consent record | Consent; or, for existing customers and people who enquired about our products, legitimate interest under the "soft opt-in" rule — see "Marketing communications" below |
| First-contact emails to business prospects in Canada and the US (Snov.io) | Business contact details found from public sources | Legitimate interest — telling tree care businesses about software made for them, with an opt-out in every message. For UK/EU prospects, we only ever contact companies, not sole traders or partnerships, unless they've opted in |
| Protecting website forms from spam and abuse (Google reCAPTCHA) | IP address, browser and device signals, how the form was filled in | Legitimate interest — keeping automated abuse out of our forms and systems |
| Website analytics and advertising measurement | Cookies/IDs, browsing behaviour | Consent (EEA/UK/Switzerland/Quebec visitors); legitimate interest — understanding and improving our marketing (visitors elsewhere, where opt-out cookie controls apply — see Cookie Policy) |
| Fraud prevention, account security, portal access logging | IP address, user agent, login activity | Legitimate interest — keeping the platform and your account secure |
| Responding to legal requests, enforcing our terms | Relevant records | Legal obligation; legitimate interest — establishing, exercising, or defending legal claims |
| Evaluating a job application you sent us | CV/application content, contact details | Steps taken at your request (pre-contractual) |
We don't make any decisions about you using solely automated processing that have a legal or similarly significant effect on you.
We send marketing email where we have your consent, or — if you're an existing customer, or you gave us your details while asking about or buying our products — about our own similar products, as long as you were given a clear chance to opt out when we collected your details and in every message since (the "soft opt-in" rule). That rule never covers a first email to someone we have had no contact with: those first-contact emails go only to businesses in Canada and the US, and, for the UK and EU, only to companies (never sole traders or partnerships) unless they've opted in.
Every marketing email includes an unsubscribe link. You can also unsubscribe at any time by emailing info@arbostar.com with the subject line "Unsubscribe." You have an absolute right to object to marketing at any time, free of charge, with no need to give a reason — once you tell us to stop, we stop, and we keep a minimal record of your address so we don't contact you again.
This doesn't affect service communications (receipts, payment reminders, renewal notices, security alerts) — those aren't marketing, and you can't opt out of them while your account is active.
We use cookies and similar technology for essential site functions, analytics, and advertising. In the EEA, UK, Switzerland, and Quebec, non-essential cookies only load after you accept them, and you can withdraw consent at any time using the "Cookie settings" link in the site footer. Elsewhere, non-essential cookies may load by default, and you can opt out the same way. Full details, including a table of every cookie and how long it lasts, are in our Cookie Policy.
We don't sell your personal data. We share it with service providers who need it to do their job for us, categorised below. Our full list of subprocessors (for data we process on behalf of our customers, as described above) is available on request from info@arbostar.com.
We may also share data where required by law, to enforce our agreements, or to protect the rights, property, or safety of ArboStar, our customers, or others.
We're based in Canada. Both the European Commission and the UK government have formally recognised Canada's federal privacy law (PIPEDA) as providing an adequate level of protection for personal data transferred from the EEA and UK, for organisations like ours. That means transfers to us don't need extra safeguards.
Several of the service providers listed above are based in the United States. Where a US provider is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), we rely on that certification. Where it isn't, we use Standard Contractual Clauses approved by the European Commission, together with the UK's International Data Transfer Addendum, as the transfer safeguard. You can ask us for a copy of the safeguard that applies to a particular provider at info@arbostar.com.
| Data | Retention |
|---|---|
| Invoices, payments, and signed contract PDFs | 6 years after the end of the relevant fiscal year (Canada Revenue Agency; for UK customers, the UK company-records rule; for Quebec customers, Revenu Québec) |
| Your name, email, and phone number inside our e-signature tool (Documenso), separately from the signed PDF | Deleted 60 days after your account closes |
| Website leads and enquiries that don't convert to a customer, and cold-outreach contacts | 24 months from your last contact with us |
| Hub portal access logs (IP address, browser, login activity) | 12 months, for security investigations |
| Chat widget conversations (Gist) | 24 months from the last message |
| Support tickets and email correspondence | 24 months from resolution, or for as long as the account they relate to is active, whichever is longer |
| Consent and unsubscribe records | Kept as long as needed to demonstrate compliance, even after you unsubscribe — including a minimal record so we don't contact you again |
| Audit log of account and system actions | Kept indefinitely. It can't be edited, and we keep it for security and as legal evidence |
| Job applicant CVs | 6 months after we make a hiring decision |
| Account data after your account closes (Hub client and contact data, saved card profile) | See "Account closure" below |
If UK GDPR, EU GDPR, or a similar law applies to you, you have the right to:
To exercise any of these rights, email info@arbostar.com with the subject line "Privacy request". We may ask you to verify your identity before acting on a request, to make sure we're not handing your data to someone else. There's no fee. We'll respond without undue delay, and at the latest within one month — for complex requests, we can extend this by a further two months, and we'll tell you if we do and why.
If you're not satisfied with our response, you have the right to complain to a supervisory authority:
We comply with Canada's federal privacy law (PIPEDA) and Canada's Anti-Spam Legislation (CASL), and with Quebec's Law 25. Our person responsible for the protection of personal information is our Chief Executive Officer, reachable at info@arbostar.com or at the postal address below. If you're in Quebec, we'll respond to an access or correction request within 30 days. If you're unsatisfied with how we've handled a request, you can complain to the CAI (link above).
Providing certain data is necessary to enter into or perform a contract with us — for example, we can't set up your account, process payment, or send you a signed contract without your contact details. Where that's the case, we say so at the point of collection. If you don't provide it, we may not be able to provide the service you've asked for. Everything else (like marketing consent) is optional, and declining it just means you won't get those communications — it doesn't affect the underlying service.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
What we send. Where you have given consent, ArboStar and the tree care companies using the ArboStar platform send transactional SMS text messages relating to a service you have requested. These include estimate notifications, appointment confirmations, crew arrival and scheduling updates, invoice notifications, and replies to questions you send us. We do not send marketing text messages.
How consent is collected. Consent is collected through a dedicated checkbox that is unchecked by default and is separate from acceptance of our Terms and Conditions. Consent is never bundled into general terms acceptance and is never a condition of receiving service. A publicly viewable example of the consent form and its disclosure language is available at arbostar.com/sms-opt-in.
Message frequency and cost. Message frequency varies, based on your service activity. Message and data rates may apply. Mobile carriers are not liable for delayed or undelivered messages.
Opting out and getting help. You may cancel at any time by replying STOP to any message. You will receive a single confirmation and no further messages unless you opt in again. Reply HELP for assistance, or contact us at support@arbostar.com or 1.833.272.6267.
How we treat your mobile number. Mobile numbers collected for text messaging are used only for the purposes described above. They are never sold, and they are never shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from all other data sharing.
We use administrative and technical safeguards appropriate to the data we hold: encryption of data in transit and at rest where applicable, access controls limiting who inside ArboStar can see what, and separation between our own systems and the customer data we process. Card payments run entirely through Authorize.net's hosted payment fields — we never receive or store your full card number. If we become aware of a personal data breach likely to affect you, we'll notify you and any required regulator without undue delay, as the law requires.
You can ask us to close your account and delete your associated personal data at any time by emailing info@arbostar.com.
The same timeline applies to the data you keep about your own clients in the ArboStar platform; the details are in our Data Processing Agreement, available on request from info@arbostar.com.
ArboStar is a business-to-business service. It is not directed at, and we do not knowingly collect personal data from, anyone under the age of 18. If you believe a minor has provided us with personal data, contact us and we'll delete it.
Our website may link to other sites. We're not responsible for the content or privacy practices of sites we don't operate. We encourage you to read the privacy policy of any site you visit.
ArboStar's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
We may update this policy from time to time. We'll post the revised version here with a new "Last updated" date, and for material changes, we'll take reasonable steps to let you know (for example, a site notice or an email to active customers).
Version history: this version replaces the policy dated 1 September 2019, and folds in the separate "Data Protection Policy" page, which previously covered similar ground and is now retired.
Innovation Systems Corp 478 King St W, Office 1206 Toronto, ON M5V 0A8, Canada Email: info@arbostar.com (subject line "Privacy request")
