Privacy Policy — Canada

Who this covers

NESTOR LOGIC is based in Montréal, Québec. This policy applies to personal information we handle about visitors to this website, prospective clients, and the authorized users of our platform.

When we operate the platform on behalf of a business client, we act as a service provider following that client's instructions. In that case the client is responsible for its own privacy notices to its customers, and this policy covers only our own handling.

Person responsible for privacy

Law 25 requires every organization to designate a person responsible for the protection of personal information, and to publish that person's title and contact details. Ours holds the title of Privacy Officer and is reachable at privacy@nestorlogic.ai. Write to them with any question, request or complaint — that address reaches the person who answers it, not a queue.

What we collect

Why we use it

We use personal information to provide and secure the platform, verify users and process owner approvals, propagate approved changes to the platforms you connect, maintain the audit record, respond to support requests, handle billing, meet legal obligations, and improve the service. We collect it for these purposes and, where the law requires, with your consent. If we ever want to use information for a materially different purpose, we will ask first.

Here is the reason for each category of information in the table above. Where one category serves more than one reason, each reason is listed on its own rather than grouped together.

Consent

We rely on consent that is clear, free and informed, and we ask for express consent where information is sensitive. You can withdraw consent at any time, subject to legal and contractual limits. Withdrawing consent may mean we can no longer provide part of the service.

Law 25 lets us collect some information without consent — for example where it is necessary to provide the service you have contracted for, to meet a legal obligation, or to keep the platform secure. This table says, for each category, which of those applies.

Where consent is the basis and the information serves more than one purpose, we ask for consent to each purpose separately. We do not treat a single agreement as covering them all.

Where information is stored, and for how long

Client data on the platform is hosted on our Montréal-based infrastructure, with an immutable audit record of approved changes. Information is retained only as long as needed for the purposes described above or as required by law, after which it is destroyed or anonymized. These are the periods we work to:

Who we share it with

We share personal information only with the service providers who help us operate, and only under agreements that limit what they can do with it. There are six, and this is where each one holds the information: hosting, databases and file storage — Beauharnois, Québec; transactional email — Montréal, Québec; AI processing — outside Québec, and personal details are removed before anything is sent to it: a name, an email address or a phone number does not leave our systems; edge protection (the DNS and firewall layer in front of the site) — a global network with points of presence outside Québec, which traffic passes through and where no client information is stored; and website analytics (Google Analytics) — outside Québec, and only if you turn analytics on in the cookie banner; it receives usage data about this website, never the information you submit to us; and form spam protection (Cloudflare Turnstile) — outside Québec; it checks that a form on this site is being completed by a person and receives technical signals about the browser and connection, never the content of what you type. We take no payments through the platform, so no payment processor holds information about you. We use no advertising providers. We do not sell personal information. We may disclose information where the law requires it, to protect our rights, or in connection with a corporate transaction, in each case as permitted by Law 25 and PIPEDA.

Information handled outside Québec

Before personal information is handled outside Québec, Law 25 requires an assessment of privacy-related factors, including the legal framework where it would be handled. The platform itself is hosted in Québec: contact and account details, business details, platform credentials, your communications with us and the approval audit trail are stored and processed in the province. Four parts of the service, however, operate outside it — and because this policy treats log data, IP address and device and browser information as personal information, we say plainly that personal information of that technical kind does leave Québec. These are the transfers, what each one receives, and why: edge protection (the DNS and firewall layer in front of the site) — receives the IP address and connection details of each request, in transit only and with nothing stored, so the site stays available and malicious traffic is filtered before it reaches us; form spam protection (Cloudflare Turnstile) — receives technical signals about the browser and connection, never what you type, to confirm that a form is being completed by a person; website analytics (Google Analytics) — receives usage data about this website, including the IP address the request came from and device and browser information, and only if you turn analytics on in the cookie banner, so we can measure how the site is used; and AI processing — receives the content of a compliance scan or a support request only after a name, an email address and a phone number have been removed, so the assessment or the reply can be produced. Each of these providers is bound by an agreement that limits it to our instructions and forbids any other use. We assess every such transfer against the factors Law 25 lists — the sensitivity of the information, the purpose, the protections around it and the legal framework of the receiving jurisdiction — and no new transfer, and no new category of information to an existing one, begins before that assessment is complete and the contractual protections are in place.

Cookies

This website sets three cookies on its own, and all three are necessary: one that keeps you signed in, one that remembers which language you chose, and one that records your answer to the cookie banner. We run no advertising or profiling cookies at all. Analytics is the single exception, and it is opt-in: if you switch Analytics on in the cookie banner, Google Analytics measures how the site is used and sets its own cookies. Until you do, it is not loaded at all — Law 25 requires any function capable of identifying, locating or profiling someone to be off by default, and ours are. You can change your answer at any time from the cookie banner, or clear cookies in your browser settings.

Automated processing

Our compliance scanner produces assessments about websites, not decisions about individuals. Nothing here profiles visitors by default: we run no advertising or profiling cookies, and any function capable of identifying, locating or profiling someone stays off unless you switch it on.

So you do not have to guess where this could ever apply, here is the only part of the service that deals with a decision about a person rather than a website: the automated security checks that can block a sign-in or flag an account for suspected abuse or fraud. We take no payments through the platform, so no payment or billing-verification provider checks or decides anything about you. The scanner, the audit trail and the approval flow assess websites and record what you approved — they decide nothing about you.

If a decision about you is ever based exclusively on automated processing, we will inform you of it at the time of the decision or before it. At your request, we will also tell you which personal information was used to make the decision, the reasons and the principal factors and parameters that led to it, and that you are entitled to have the personal information used to make it corrected. You may in addition submit your observations to a member of our staff who is in a position to review the decision. Write to the Privacy Officer at privacy@nestorlogic.ai.

Children and young people

Our service is sold to businesses and is not directed at children. We do not knowingly collect personal information from anyone under 14, and we do not open accounts for them. Under Law 25, information about a child under 14 may only be collected with the consent of a parent or guardian, and information about a minor is treated as sensitive by default — we apply that standard. If you believe a child has given us personal information, write to privacy@nestorlogic.ai and we will delete it.

Your rights

Subject to legal limits, you may access the personal information we hold about you, have it corrected, withdraw your consent, receive a copy in a structured, commonly used technological format, and ask us to stop disseminating information or de-index certain results where the law allows. Write to privacy@nestorlogic.ai and we will answer within 30 days, the deadline Law 25 sets.

Confidentiality incidents

If an incident involving personal information presents a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected. The law requires this to be done with diligence; we hold ourselves to a fixed deadline instead — within 72 hours of becoming aware of the incident, and sooner where we can. We maintain a register of incidents, and every incident goes in it whether or not it was reportable.

Complaints

If our response does not resolve your concern, you may contact the Commission d'accès à l'information du Québec, or the Office of the Privacy Commissioner of Canada for matters under PIPEDA.

Changes to this policy

We may update this policy. The date at the top shows the current version, and we will give notice of material changes.