Privacy Policy

1. Who we are and what this policy covers

We are subject to British Columbia's Personal Information Protection Act (“PIPA”). Where we collect, use, or disclose personal information in the course of commercial activity that crosses a provincial or national boundary, the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) may also apply. This policy is written to meet the requirements of PIPA and, where it applies, PIPEDA.

This policy covers personal information we collect through genuineai.ca, through direct correspondence with us, and in the course of providing our services.

It does not cover information belonging to our clients' own customers. Where we build or operate a system for a client, and that system handles personal information about the client's customers or staff, our client is the organization accountable for that information under privacy law. We act as a service provider, processing it on the client's instructions and under a written agreement. Individuals with questions about that information should contact the business they dealt with directly.

2. Personal information and contact information

Personal information means information about an identifiable individual.

PIPA distinguishes contact information — an individual's name, position or title, business phone number, business address, and business email — used to contact someone at their place of business. PIPA does not apply to contact information used for that purpose.

Most of what we collect through this website is contact information in that sense. We nonetheless apply the protections in this policy to it, because someone who sends us an enquiry is entitled to know how their details will be handled regardless of how the statute classifies them.

3. What we collect

We collect only what we need for the purposes in Section 4.

When you use our contact form, we collect your name, your company name, your work email address, and what you write in the free-text field describing the work you'd like to hand off.

Please do not put confidential information, personal information about other people, or commercially sensitive material into that field. If you need to share something like that, tell us and we'll arrange a secure route.

When you contact us by phone or email, we collect whatever you choose to tell us.

Website assistant. If you use the assistant on our website, we collect the messages you send it. Those messages are used to answer your question and to improve how the assistant responds. Do not enter payment details, government identification, or information about other people.

Information collected automatically. When you visit this site, Google Analytics records standard usage data — pages viewed, approximate location derived from your IP address, referring site, and browser and device type. This is used in aggregate to understand how the site is used. Section 9 lists every cookie we set and explains how to opt out.

Children. Our services are directed to businesses. We do not knowingly collect personal information from children.

4. Why we collect it

We collect, use, and disclose personal information for these purposes only:

• to reply to your enquiry and correspond with you about it;
• to prepare and deliver a complimentary AI audit if you’ve asked for one;
• to provide, administer, and support services under an agreement with your organization;
• to invoice you and keep accounting records the law requires us to keep;
• to meet our legal and regulatory obligations.

We do not sell personal information. We do not disclose it to third parties for their own marketing. We do not add you to a mailing list because you sent us an enquiry — if we want to send you marketing, we will ask you first, and you can say no.

5. Your information and our AI systems

We build AI automation systems. It matters that we're specific about how that intersects with your information.

We do not use your information to train AI models. Nothing you send us through this website, and nothing belonging to our clients, is used to train or fine-tune machine-learning models — ours or anyone else's.

When AI processes your information, it does so to answer your question, not to learn from it. Where we use an AI service to help handle an enquiry or deliver a service, that information is processed to produce a response and is not retained by the AI provider to improve their systems.

A person is always accountable. Our systems are built to hand off to a human whenever a question needs judgment, and every automation we deliver is designed with that handoff built in. You can always reach a person here.

6. Service providers, and processing outside Canada

We use third-party service providers to run our business — website hosting, email, file storage, and AI processing. When we do, we remain accountable for the information we hand to them, and we use written agreements to require protection comparable to our own.

Where your information is processed:

What that means in practice. Client data held in our database stays in Canada — it is stored in Montreal and does not leave the country. Our website, our email, and our AI processing run on providers in the United States, so information you send us through the contact form or by email is handled there.

We're Canadian-owned and Victoria-based, and we say so on this site. We want to be equally clear that Canadian ownership is not the same as Canadian-only data storage. Where information is stored or processed in another country, it can be reached by the courts, law enforcement, and government authorities of that country under the laws in force there.

If keeping your data in Canada matters to your business, tell us before we start. Our database is already Canadian; we'll tell you honestly what we can and cannot guarantee for everything else.

7. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires.

• Enquiries that don’t become engagements: 24 months from our last exchange, then securely destroyed.
• Client records: for the length of the engagement, then 7 years, to meet tax and accounting obligations.
• Information used to make a decision affecting you: at least 1 year after that decision, so you have a fair chance to ask to see it.

Systems we operate for clients may have their own retention periods, set out in the agreement with that client and disclosed by that client to its own customers.

When we no longer need information for a legal or business reason, we destroy it or render it anonymous.

8. How we protect it

We protect personal information with safeguards appropriate to how sensitive it is:

• information in transit is encrypted using standard transport-layer security;
• information at rest in our database infrastructure is encrypted;
• access is restricted to those who need it for the purposes in Section 4;
• our service providers are bound by written agreements;
• changes to client records are logged, and those logs cannot be altered after the fact.

No system is perfectly secure, and we won't claim ours is. What we will say is that our safeguards are appropriate to what we hold, and that we review them when our systems change.

9. Cookies and analytics

This website uses Google Analytics 4 to understand how visitors use the site — which pages are read, how people arrive, and where they leave. We use it to make the site more useful, not to identify you.

These are the only cookies this site sets:

We do not use advertising cookies. We do not run remarketing or ad targeting, we do not sell information about your browsing, and we do not combine analytics data with the enquiries you send us.

Google Analytics is operated by Google, which processes this information in the United States. Section 6 explains what that means.

How to opt out. Any of these work:

• Install Google’s browser opt-out add-on, which blocks Google Analytics on every site you visit;
• Turn on “Do Not Track” or “Global Privacy Control” in your browser, or use a browser that blocks trackers by default;
• Block or delete cookies in your browser settings.

Nothing on this site stops working if you decline analytics cookies. The forms and the phone number work exactly the same.

10. Your rights

Under PIPA, you have the right to:

See what we hold about you. Ask, and we'll tell you what personal information we have, how we've used it, and who we've disclosed it to. We'll respond within 30 business days, which is the time PIPA allows, and usually much sooner. If we need an extension where PIPA permits one, we'll tell you before the deadline. Access is normally free; if PIPA allows a fee for a request that takes significant work, we'll give you an estimate first and you can decide whether to proceed.

Correct it. If something we hold about you is wrong or incomplete, tell us. If we agree, we'll fix it and — where it's reasonable to do so — tell anyone we disclosed it to in the past year. If we don't agree, we'll note your requested correction on the record so it travels with the file.

Withdraw your consent. At any time, with reasonable notice, by contacting our Privacy Officer. We'll explain what it means in practice — usually that we can't keep corresponding with you or providing a service. Withdrawal doesn't reach backwards, and doesn't cover records the law requires us to keep.

Complain. See Section 13.

There are situations where PIPA permits or requires us to refuse access — for example, where giving you the information would reveal personal information about someone else. If we refuse, we'll tell you why in writing, and tell you how to complain.

11. If something goes wrong

If we determine that personal information in our care has been lost, accessed without authorization, or disclosed without authorization, we assess whether it creates a real risk of significant harm to anyone affected.

Where it does, we notify the people affected as soon as we reasonably can, and report to the Office of the Information and Privacy Commissioner for British Columbia where required or where reporting is the right thing to do. We keep a record of every such incident we identify, whether or not it meets the notification threshold.

Where the information belongs to one of our clients' customers, we notify that client without undue delay so they can meet their own obligations.

12. Privacy Officer

We've designated a Privacy Officer responsible for our compliance with this policy and with privacy law.

Privacy Officer · Genuine AI Solutions · 200–535 Yates Street, Victoria, British Columbia V8W 2Z6 · privacy@genuineai.ca · (778) 486-9993

Send requests for access or correction, questions about this policy, and privacy complaints here.

13. Complaints

Come to us first — we'd rather fix it than have you go elsewhere. If you're not satisfied with how we've handled it, you can complain to:

Office of the Information and Privacy Commissioner for British Columbia · PO Box 9038, Stn. Prov. Govt., Victoria, British Columbia V8W 9A4 · Telephone: 250-387-5629 · Toll-free in BC: 1-800-663-7867 (Service BC — ask for a transfer to 250-387-5629) · Email: info@oipc.bc.ca · oipc.bc.ca

Where PIPEDA applies instead, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

14. Changes to this policy

We may update this policy. The effective date at the top tells you which version you're reading. If a change materially affects how we handle information we already hold, we'll take reasonable steps to let affected people know.

Genuine AI Solutions · 200–535 Yates Street, Victoria BC V8W 2Z6 · (778) 486-9993