Who holds what
Your member records belong to your organization. Your organization decides what goes in and what comes out; Sembr runs the software that holds it. In the language of privacy law, your organization is the controller and Sembr is the processor.
We do not sell your member data, share it with advertising platforms, or use it for any purpose outside running your workspace. There is no analytics product, no data warehouse and no marketing profile fed from your records.
Where it is stored
In Canada. The database is DigitalOcean Managed PostgreSQL in Toronto, on a private network, and member files sit in DigitalOcean Spaces in Toronto beside it. Backups stay in Toronto too.
Storage is encrypted at rest by DigitalOcean using full-volume LUKS encryption, and every connection to Sembr is over TLS.
Who else touches it
The current list of subprocessors, what each one does and which region it runs in, is at /subprocessors. That page is the authoritative list, kept in one place so it cannot drift out of step with a copy somewhere else. We give 30 days' notice before adding or changing one.
What we do about personal information in our own logs
Application logs are written to record what failed and where, not who it happened to. On paths that handle personal data the exception type is recorded rather than its message, through a shared helper, and a naming-pattern check in our build runs over new code.
Being precise about the limit: that is a pattern check and a shared helper, not a type-aware guarantee. A log call that formatted personal data through a path the check does not recognise would not be caught, and no cross-file data-flow analysis runs today. We would rather tell you the shape of the gap than describe the control and stop there.
AI features
AI is additive and the platform works fully with it switched off.
Member records are never sent from the database to a model. Where organization data has to be referenced, identities are replaced with opaque tokens before anything leaves, and swapped back locally in the answer. Text a staff member types themselves is sent as written, because that text is theirs.
Cookies
Sembr sets no tracking, advertising or third-party cookies anywhere, and runs no analytics.
- This marketing site sets no cookies at all. You can check that yourself in your browser's developer tools.
- The application sets exactly one:
sembr-session, which keeps you signed in. It isSecure,HttpOnlyandSameSite=Lax, and it expires after two hours.
That is the whole list. Strictly-necessary cookies are exempt from opt-in consent under PIPEDA and GDPR alike, so this page is a disclosure rather than a consent wall, and there is nothing here a banner could switch off.
Taking your data out
Every tenant can export everything from the dashboard, as JSON, as one ZIP of CSVs, or as SQL. No support ticket, no exit fee, no notice period.
Keeping and deleting
While your organization's account is open, we keep your data so the software can do its job.
A member who asks to be forgotten is anonymized in place after a short cooling-off period, and the record of the deletion is kept. That is a real capability in the product today.
Where we are not finished, stated plainly: there is no automatic timer that erases a cancelled organization's data. If you close your account, export what you want, then ask us to delete the rest and we will do it and confirm when it is done. Deletion happens because you asked and we acted, not because a scheduled job ran. When that job exists this paragraph will say so.
Reaching us
Use the contact link in the footer. A privacy question reaches a person, not a queue.
About this page
Sembr is a small Canadian company and this policy was written by us, not by counsel. We would rather publish something accurate and plain now than a longer document that says less. It will be reviewed by a lawyer, and the version history will show what changed when it is.