Privacy Policy
This English version is provided for convenience only. In case of any discrepancy, the French version prevails.
1. Privacy Officer (RPP)
In accordance with the Act respecting the protection of personal information in the private sector (PPIPS, hereinafter "Law 25"), Agentic Quebec Inc. has designated a Privacy Officer responsible for the protection of personal information:
Any question, request for access, correction, withdrawal of consent, or complaint relating to this policy must be addressed to the Privacy Officer at the address above.
2. Personal Information Collected
Agentic Quebec Inc. applies the principle of data minimization: we collect only the information strictly necessary to operate the Service, to perform our legal and contractual obligations, and to secure the platform.
| Category | Examples | Legal basis |
|---|---|---|
| Contact details | Name, email address, telephone number, organization name | Performance of contract / legal obligation |
| Contractual information | Quotes, signed contracts, invoices, business correspondence | Performance of contract / legal obligation (tax, accounting) |
| Billing information | Billing address, payment-processor (Stripe) customer ID, subscription status, transaction history. We never store the full credit card number. | Performance of contract / legal obligation |
| Account and session data | Account identifier, authentication token stored locally by the application on your workstation, IP address processed for security and fraud prevention | Legitimate interest (security) / performance of contract |
| Usage logs | Technical logs, request timestamps, AI model usage volume for billing, reliability and security purposes | Performance of contract / legitimate interest (security, billing) |
| Connected-service credentials | Access and authorization tokens for third-party services you choose to connect (e.g. Google, Microsoft 365, QuickBooks, HubSpot, GitHub), stored solely to operate the integration at your direction | Performance of contract / consent |
3. Purposes of Collection and Processing
The information collected is used exclusively for the following purposes:
- Establishing and maintaining the contractual relationship (quotes, contracts, billing);
- Authenticating users and securing account access;
- Providing the agreed artificial intelligence services;
- Processing payments and managing subscriptions;
- Complying with applicable tax, accounting, and legal obligations in Quebec;
- Communicating with the client in connection with the service (support, updates, legal notices).
No information is used for marketing purposes without express and separate consent.
4. Disclosure to Third Parties and Processors
Agentic Quebec Inc. does not sell, rent, or share its clients' personal information with third parties for commercial purposes.
Limited sharing may occur only in the following cases:
- Processors and service providers — cloud hosting, payment processing, and accounting service providers, bound by confidentiality agreements compliant with Law 25 and authorized to use the information only to provide their services to Agentic Quebec Inc. (see Section 5 for the list and location of our main processors);
- Legal obligations — in response to a court order or applicable legal requirement;
- Business transfer — in the event of a merger or acquisition, the same protections apply to the assignee.
5. Location and Transfers Outside Quebec
Agentic Quebec Inc.'s primary infrastructure (application hosting and client data storage) is located in Canada. However, to provide certain essential features, we rely on processors whose processing may, in part, take place outside Quebec, in particular in the United States.
| Processor | Purpose | Processing location |
|---|---|---|
| Stripe | Payment processing and billing | United States |
| Intuit QuickBooks | Accounting and invoicing | United States |
| OVHcloud | Cloud hosting and AI model execution (inference on graphics processing units — GPUs) | Canada (application hosting) and European Union (GPU processing for AI model inference) |
To ensure the availability and performance of our artificial-intelligence features, part of the processing — namely AI model inference performed on graphics processing units (GPUs) — is carried out in OVHcloud data centres located in the European Union. The data transmitted for this purpose is limited to the content strictly necessary to process your request, is encrypted in transit, and is neither retained on a persistent basis by the infrastructure provider nor used to train AI models. This processing is governed by appropriate contractual clauses ensuring an adequate level of protection.
6. Payment Processing — Stripe
Payment processing is entrusted to Stripe, Inc., a PCI-DSS-certified payment processor. When you provide payment information, it is transmitted directly to Stripe over an encrypted connection. Agentic Quebec Inc. never stores your full credit card number on its own servers; we retain only a Stripe customer identifier, the billing address, and the subscription status, for billing management purposes. Stripe's payment processing is governed by Stripe's privacy policy.
7. Retention Period
Personal information is retained only for as long as necessary for the purposes for which it was collected, in accordance with the following legal obligations:
| Type of information | Retention period | Justification |
|---|---|---|
| Contact details (active client) | Term of contract + 3 years | Civil prescription period (art. 2925 C.C.Q.) |
| Contractual documents, invoices, and billing information | 7 years after the end of the fiscal year | Federal and provincial tax obligations (ITA / QSTA) |
| Account, session, and usage logs | 12 months maximum | Security, incident detection, billing |
| Business correspondence | 3 years after the end of the relationship | Civil prescription period (art. 2925 C.C.Q.) |
Upon expiry of these periods, the information is irreversibly destroyed or anonymized in accordance with secure procedures.
8. Artificial Intelligence and Automated Decisions
Agentic Quebec Inc.'s services rely on artificial intelligence (AI) agents that may produce automated decisions or recommendations. We apply the following AI governance principles:
a) Human-in-the-Loop oversight
Any decision with significant impact is subject to a human validation step. Our systems are designed so that a user or administrator can review, correct, or cancel any action proposed by the agent before it is executed.
b) Guard Rails
Technical and organizational control mechanisms govern the AI agents: action-scope limits, audit logs, escalation rules, and emergency interruption mechanisms.
c) Consent and acknowledgment of risk
d) Processing by AI models
We log only metadata about each request (notably the IP address, the AI model used, and the number of tokens processed) for reliability, security, and billing purposes. The content of your requests and the outputs generated is not logged, retained, or analyzed by Agentic Quebec Inc. The AI models run on OVHcloud infrastructure, including GPU servers located in the European Union (see Section 5); your data is not used to train third-party providers' AI models. Any use of data for internal improvement is limited to aggregated and de-identified data.
e) Responsibility
Agentic Quebec Inc. designs and maintains the systems; responsibility for decisions made after disabling the oversight mechanisms rests with the user or organization that made that choice. Detailed terms are set out in the Terms of Service.
f) No evaluative or commercial profiling
Our AI agents process only the data necessary to perform the requested tasks. They may retain a working memory — consisting of information you provide or ask them to remember — to maintain continuity of tasks across sessions. This memory is user-directed: you can review, modify, or erase it at any time. We perform no profiling for evaluation, behavioural prediction, advertising, or commercial targeting, and no decisions are made on the basis of characteristics protected by the Charter of Human Rights and Freedoms.
9. Cookies and Similar Technologies
The application running on your workstation stores only the authentication data strictly necessary to maintain your session, locally on your own device. This data remains on your device and is never used for any tracking or profiling purpose.
10. Security Measures
We implement technical and organizational security measures proportionate to the sensitivity of the information held, including:
- Encryption of data in transit (TLS 1.2+) and at rest;
- Restricted access to personal information based on the principle of least privilege;
- Access and audit logs retained for incident detection;
- Periodic privacy impact assessments (PIA) when introducing new processing;
- Staff training on obligations arising from Law 25.
As no method of transmission or storage is completely secure, we cannot guarantee absolute security.
11. Your Rights
In accordance with Law 25, you have the following rights regarding your personal information held by Agentic Quebec Inc.:
| Right | Description |
|---|---|
| Access | Obtain a copy of the information we hold about you. |
| Rectification | Have any inaccurate, incomplete, or ambiguous information corrected. |
| Deletion | Request the erasure of your information, subject to our legal retention obligations. |
| Portability | Receive your information in a structured, commonly used technological format. |
| Withdrawal of consent | Withdraw your consent to a processing activity, subject to contractual or legal consequences. |
| Human review | Be informed that a decision concerning you was made by an automated system, and request human review of it. |
To exercise any of these rights, please contact our Privacy Officer: admin@agent-qc.net. We will respond within 30 days of receiving your request, in accordance with the law.
12. Confidentiality Incidents
Agentic Quebec Inc. maintains a register of confidentiality incidents in accordance with the Regulation respecting confidentiality incidents (PPIPS).
In the event of an incident presenting a serious risk of harm, we undertake to:
- Notify the Commission d'accès à l'information (CAI) as soon as possible;
- Directly notify the affected individuals where required;
- Document the incident, the measures taken, and the corrective actions applied.
To report an incident or security concern: admin@agent-qc.net.
13. Changes to This Policy
Agentic Quebec Inc. reserves the right to modify this policy at any time to reflect legislative, operational, or technological changes. Any change will be published on this page with a new effective date.
In the event of a substantial change affecting your rights, we will notify you directly by email at the address on file in your client record.
14. Complaints and Contact
If you believe that your personal information rights have not been respected, you may:
- Contact our Privacy Officer directly: admin@agent-qc.net — we undertake to process your complaint within 30 days;
- File a formal complaint with the Commission d'accès à l'information du Québec (CAI).
In case of any discrepancy in interpretation between the French and English versions of this policy, the French version prevails.