Privacy Policy

This is an English translation of the French version, which prevails in case of any discrepancy.

1. About this policy

This policy explains how OGS AI Solutions collects, uses, discloses and retains your personal information when you visit ogsaisolutions.com or interact with us through the channels described below, including our AI assistant (chatbot) embedded on the site.

We have written it in plain language, in line with the requirements of Quebec's Act respecting the protection of personal information in the private sector (Law 25) and the guidance issued by the Commission d'accès à l'information.

A link to this policy appears in the footer of every page of the site, near every form that collects information, and within the interface of our AI assistant, so that you can review it before sharing your information.

If anything is unclear or you wish to exercise a right described in this policy, email us at [email protected]. We respond to all requests within 30 days.

2. Who we are

OGS AI Solutions (the "Company," "we," "our") is the registered English translation of OGS Solutions IA, a registered trade name of Olivier Guilbault Savor, a sole proprietor based in Quebec.

Privacy Officer: Olivier Guilbault Savor — [email protected].

3. Scope of this policy

This policy applies to personal information we collect on our own behalf when you:

• Visit ogsaisolutions.com;
• Submit our contact form;
• Book a discovery call through our scheduling tool;
• Interact with our AI assistant embedded on the site;
• Subscribe to our newsletter (where applicable);
• Email us.

This policy does not apply to solutions we design and operate on behalf of our clients (for example, conversational agents embedded in a client's website). In that context, the client determines the purpose of processing, and collection is governed by the client's own privacy policy along with a Privacy Impact Assessment (PIA) and a Data Processing Agreement specific to that engagement. For questions about a client deployment, contact the relevant organization.

If you become our client, your engagement with us will be governed by a service agreement and, where applicable, a data processing agreement, which will prevail over this policy in respect of the engagement itself. This policy continues, however, to apply to your use of the public website (form, AI assistant, newsletter), separately from your client relationship.

4. Personal information we collect

4.1 When you visit the site

We use a cookieless web analytics service that aggregates anonymized technical data (page viewed, referrer, device type, regional country of origin). No unique identifier is associated with your visit, and we cannot identify you from this data.

4.2 When you submit the contact form

We collect the information you provide:

• Name;
• Email address;
• Phone number (optional);
• Organization name (optional);
• Content of your message.

4.3 When you book a discovery call

Our scheduling tool (Cal.com) collects your name, email and selected time slot. Cal.com applies its own privacy policy to information it processes directly.

4.4 When you email us

We receive your email address, the content of your messages and any attachments you include. Please note that emails you send us transit through our email routing provider and our inbox provider (identified in section 6) before reaching our systems. For any communication containing sensitive information, we will set up a secure alternative channel on request.

4.5 When you interact with our AI assistant

Our site features an AI assistant powered by artificial intelligence. When you use it, we collect:

• The text content of your conversation (your messages and the generated responses);
• An anonymous session identifier that maintains the conversation's continuity;
• The timestamp of each exchange;
• Your IP address at the time of the request (used for rate limiting and abuse prevention, then truncated);
• Your user agent (browser type and operating system);
• Any contact information (name, email, phone, organization) you choose to provide explicitly, for example if you request a follow-up or wish to schedule a call.

The assistant never actively requests sensitive information. Section 12 of this policy explains in detail how the assistant works, the providers involved, and the precautions to take.

4.6 Information we do not request

We never request sensitive information (Social Insurance Number, credit card number, health information, etc.) through forms, unencrypted email, or the AI assistant. If you transmit such information on your own initiative, we will ask you to remove it or will use a secure channel, and we will delete it from our systems.

4.7 When you subscribe to our newsletter (where applicable)

If we offer a newsletter, subscription requires your explicit consent through double opt-in (email confirmation). We then collect:

• Your email address;
• Your first name (optional);
• Your language preferences (French or English);
• The date and method of subscription, for the purpose of maintaining a consent record compliant with Canada's Anti-Spam Legislation (CASL).

Each communication includes a working unsubscribe mechanism, processed within a maximum of 10 business days.

5. Why we collect this information

We do not sell your personal information, and we do not use it to train AI models. Specifically, the content of your conversations with our assistant is never transmitted to a third party for model training, and our AI inference providers contractually agree not to use it for that purpose.

We categorize the information you provide to us (for example, by industry, by type of need expressed, or by stage of our commercial relationship) in order to better respond to your requests, personalize our communications, and manage our relationship. This categorization relies on the information you actively communicate to us and is not used to render an automated decision about you within the meaning of section 12.1 of Law 25.

Consent records. For each explicit consent you provide (for example, newsletter subscription, specific data-sharing request), we keep a technical record including the date, time, method of consent, and intended purpose. These records are retained for the duration set out in section 8 and serve solely to demonstrate compliance.

6. With whom we share your information

To deliver our services, we rely on a limited number of carefully selected technical sub-processors. Here is the current list:

How sub-processor changes are communicated. If we replace a sub-processor with another in the same service category (for example, change of scheduling tool) and this does not result in any change of jurisdiction or processing category, this policy will be updated silently, with the new version timestamped. If a change involves the transfer of your information to a new jurisdiction or a new processing category, we will publish a prior notice on the site at least 30 days before it takes effect, unless an urgent security requirement dictates otherwise.

We do not disclose your personal information to third parties for commercial, advertising or resale purposes.

We may be required to disclose your information to a public authority (Revenu Québec, CRA, court, regulator) in response to a valid legal obligation.

7. Transfers outside Quebec

Several of our technical sub-processors identified in section 6 are based in the United States: Cloudflare (hosting and email routing), Google (email inbox), Cal.com (scheduling), and Anthropic (AI inference).

Our primary application hosting (assistant orchestration, database, conversation logs) is provided by OVHcloud Canada Inc. in Quebec (Beauharnois data center), operated by a company whose parent is incorporated under French law. Conversation data is therefore stored in Quebec, but its processing by the AI model involves a cross-border transit to the United States for the duration of inference.

Implications for your rights:

• Information transferred may be subject to the laws of the host country, which may permit access by foreign authorities through legal process (for example, the U.S. CLOUD Act for U.S.-domiciled providers).
• For AI inference, Anthropic contractually agrees to delete your messages within a short retention window (typically 30 days or less) for routine traffic, and never to use them to train its models. Content flagged by Anthropic's trust and safety systems may be retained for longer periods (up to 2 years for inputs and outputs, and up to 7 years for classification scores) where required to enforce its usage policies or comply with applicable law.
• We have conducted a Privacy Impact Assessment for these transfers in accordance with section 17 of Law 25 and concluded that the information receives equivalent protection to that afforded under Quebec law, considering the nature of the information involved, the contractual obligations imposed on our sub-processors, and the technical security measures in place.

To consult a summary of this assessment, write to [email protected].

As our infrastructure evolves, we will evaluate AI inference providers based in Canada or in jurisdictions offering protection equivalent to Law 25, in order to reduce cross-border transfers.

8. Retention periods

At the end of the applicable period, your information is destroyed or irreversibly anonymized.

You may at any time request deletion of a previous assistant conversation by writing to [email protected] with the session identifier or approximate date.

These retention periods apply to information we receive in the normal course of our activities. Any sensitive information transmitted to us in error is deleted upon identification, regardless of the retention periods set out above.

9. Your rights

Under Law 25, you have the following rights:

• Right of access: confirm we hold information about you and obtain a copy.
• Right of rectification: correct inaccurate, incomplete or ambiguous information.
• Right to withdraw consent: withdraw consent at any time where processing relies on it. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal; it takes effect for future processing, and we will cease the relevant processing within the shortest reasonable timeframe.
• Right to cease dissemination or de-indexing: under the conditions set out in the law.
• Right to portability: receive your information in a structured, commonly used technological format (in force since September 2024).
• Right to complain: file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

To exercise a right, write to [email protected]. We may ask for reasonable identity verification. We respond within a maximum of 30 days. No fees apply for ordinary requests; reasonable fees may apply for manifestly excessive, abusive or repetitive requests, in accordance with Law 25.

10. Security

We protect your personal information through reasonable technical and organizational measures, including:

• Encryption in transit (TLS 1.2 or higher) for all communications with the site and the assistant;
• Encryption at rest for databases containing conversation logs;
• Two-factor authentication on administrative accounts;
• Access limited to personnel with a need to know (currently, only Olivier Guilbault Savor has access);
• Regular backups and a recovery plan;
• Periodic reviews of our security practices.

In the event of a confidentiality incident presenting a serious risk of harm, we commit to notify you and to report the incident to the Commission d'accès à l'information as quickly as possible and, where feasible, within 72 hours of becoming aware of the incident, in accordance with Law 25.

In accordance with section 9.1 of Law 25, our services are configured by default at the highest level of confidentiality, without any action required on your part.

11. Cookies and similar technologies

We do not use tracking cookies on this site. Our web analytics service does not set tracking cookies or persistent client-side identifiers, and does not allow us to identify individual visitors. Accordingly, no cookie consent banner is required.

The AI assistant uses session storage (sessionStorage) to preserve the thread of your conversation during your visit. This data stays on your device and is not transmitted to third parties. It is cleared when you close your browser tab.

If we introduce functional or analytics cookies in the future, we will update this policy and seek your consent where required.

12. About our AI assistant

The AI assistant embedded on our site is powered by a generative artificial intelligence model (a large language model). Here is how it works and what you should know before using it.

12.1 How it works

When you send a message to the assistant:

1. Your message is sent to our orchestration infrastructure hosted in Quebec;
2. The message, along with the recent conversation context, is sent to an AI inference provider (Anthropic, based in the United States as of the effective date of this policy);
3. The provider returns a response generated by its model;
4. We display this response in the conversation interface and store the exchange in our Quebec systems for the period set out in section 8.

The assistant does not have access to personal information that you have not yourself shared during the conversation.

12.2 Clearly identified as non-human and privacy notice

The assistant interface clearly indicates that you are interacting with an artificial intelligence, not a human being. Before you send your first message, a visible privacy notice informs you that your messages are processed by AI and retained in accordance with this policy. A link to this policy remains accessible at all times from the header of the conversation window. Your active interaction with the assistant after reading this notice constitutes your consent to the processing described in this policy.

12.3 Limitations of generated responses

The assistant's responses are produced by a statistical model. They may contain errors, outdated information, or statements that do not exactly reflect our actual commercial offering. You should not treat the assistant's responses as:

• Legal, tax, accounting or professional advice;
• Contractual commitments on our part (contractual commitments require a signed written agreement);
• Final pricing or timelines (these are confirmed in writing through a formal proposal).

For any information of consequence, please confirm directly with us by email or during a discovery call.

12.4 Sharing precautions

We recommend not sharing, in your conversation with the assistant:

• Sensitive information (Social Insurance Number, detailed financial information, health information);
• Trade secrets or confidential information of a third party;
• Passwords or login credentials;
• Any information you would not want passing through our sub-processors as identified in section 6.

If you need to share such information to prepare an engagement with us, we will set up an appropriate secure channel (signed confidentiality agreement, encrypted email, etc.).

12.5 Automated decision-making

The assistant's purpose is to inform you and facilitate your interaction with us. It does not render decisions with legal or significant effect about you (for example, it does not assess your eligibility for a service, set binding pricing, or refuse a request). Should we ever use an automated system to render a decision based exclusively on automated processing of personal information, we will inform you at the time of the decision and inform you of your rights under section 12.1 of Law 25.

12.6 How to opt out

Use of the assistant is entirely optional. You may at any time:

• Close the conversation window and use our contact form or scheduling tool instead;
• Request deletion of your conversation by writing to [email protected].

13. Minors

Our services are intended for organizations and professionals. We do not knowingly collect personal information from children under 14 without the consent of the holder of parental authority. If you believe a child has shared their information with us without that consent, write to us and we will delete it.

For all personal information concerning minors (under 18), we apply the enhanced protections set out in Law 25, in particular by limiting collection to what is strictly necessary and being especially attentive to required consent.

14. Changes to this policy

We may amend this policy to reflect changes in our practices, sub-processors, or the applicable legal framework. The date of the most recent update appears at the top of the policy. For any material change affecting the use or sharing of your information, we will publish a notice on the site at least 30 days before it takes effect.

15. How to reach us