Privacy Policy (Canada)

At Vincdata Technologies Inc. (“we”, “our” and “us”), we are strongly committed to transparency, and we want you to understand how we collect, use, disclose and protect your personal information, as well as how you can manage the information we collect from you.

This Privacy Policy applies to your use of the Application, the Website, and the Content under our Terms of Use, available at https://qchelper.ca/terms (as the terms “Application”, “Website” and “Content” are defined in those Terms of Use) and all associated services (together with the Application, the Website and the Content, the “Services”).

By using the Services, you are accepting the terms of this Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use the Services. If you do not understand, or if you have questions about, this Privacy Policy, please contact us before using, or continuing to use, the Services.

The date on which the Privacy Policy was last amended is indicated above. We reserve the right to change our Privacy Policy from time to time. If we choose to amend this Privacy Policy, we will revise the “last updated” date at the top of this policy when we post the updated version. When we update this Privacy Policy, the updated version will be displayed within the Application and you must accept the updated terms before continuing to use the Services. We will record the version accepted and the date and time of your acceptance. We may also display a prominent notice on our Website when the Privacy Policy has been amended. The amended Privacy Policy is effective on acceptance, or on posting for users who have not yet signed in.

1. INFORMATION

Personal information means information about an identifiable individual (collectively, “personal information”), and does not include information that cannot be attributed to an identifiable individual, such as information of an aggregate or anonymous nature (collectively, “non-personal information”). We will only collect, use, and disclose the personal information that we need in order to provide you with the Services.

2. CONSENT

We will obtain your express consent prior to or when collecting, using, or disclosing your personal information for any purpose not described in this Privacy Policy, or for a purpose that was not identified to you nor reasonably expected at the time of collection, unless we are required or permitted by law not to obtain your consent.

We may rely on your implied consent in certain circumstances, after taking into account factors such as the sensitivity of the personal information and your reasonable expectations. We will limit the collection, use, and disclosure of your personal information to only that which is necessary for the purposes identified, unless you have otherwise consented, or when such collection, use, and/or disclosure is permitted or required by law.

You can always refuse to provide your personal information, except that it may prevent you from using our Services or receiving responses to your inquiries or other information of interest.

3. TYPES OF PERSONAL INFORMATION WE COLLECT

We may collect various types of personal information from you, depending upon how you interact with us or use our Services. This personal information may include your:

• • Contact/Account Information. Name (where given), email address, and account ID. Sign-in is provided by Supabase, Inc. (hosted in AWS ca-central-1, Montreal), which also holds your sign-in password hash; we never see your password. We also retain the access record for each account (email, the dates access was granted or revoked, and a short internal note), acceptance records (user ID, email, document version, timestamp), and ordinary sign-in timestamps.
• • Purchase/Billing Information. If and when paid licences launch, we may collect credit card information, account number, record of purchases, and other information as requested to facilitate payment for the Services. No payment information is collected during the beta.
• • Document Content and Query Data. In order to build the Application’s search index and answer questions, the Application transmits the full extracted text of your documents, sent in segments, and rendered page images where a question is about a page, table, diagram or drawing (up to four pages per question, from any PDF), over an encrypted connection (TLS 1.2 or higher) to Vincdata’s self-hosted servers located in Canada. With each question, the Application also sends your question, the recent messages of that conversation (up to the last 30) and the names and project-relative folder paths of source documents so answers can cite them. A question asking what files exist sends the list of file names and your project’s folder structure. That content is processed in memory to produce the index or the answer; it is not stored on Vincdata’s servers, not disclosed to third-party AI providers, and not used to train AI models. The original document files remain on your device and are not uploaded to Vincdata, with one exception: if you ask a question about a photograph or image, that image file itself is sent so it can be examined. If such a question does not name an image, the most recently indexed image in your project may be sent. Network traffic transits Cloudflare’s network in encrypted form, and sign-in is provided by Supabase, which stores your account and acceptance records but never document content. Limited fragments may appear transiently in error logs, which are deleted within approximately thirty (30) days.
• • Inquiry and Correspondence Data. If you contact us by email (such as at contact@vincdata.ca or privacy@vincdata.ca), we may collect and retain your name, email address, and the content of your correspondence. These mailboxes are hosted by our email provider (Network Solutions, US-based), which stores the correspondence.
• • Usage Records. For each request made through the Application, we record the endpoint, timestamp, token counts, model used, and response time, tied to your account. These records are kept on Vincdata-owned hardware in Canada.
• • Device Information. IP addresses pass through Cloudflare and Supabase to deliver the Services and may appear in ordinary request logs (our server’s logs are deleted within approximately 30 days). We do not use IP addresses to determine your location. On update checks, the Application sends app version, OS type, and CPU architecture.

By using the Services, you acknowledge that we will collect, use, and disclose such personal information in accordance with this Privacy Policy. When you index documents, you confirm that you are permitted to use those documents for this purpose.

We strive to uphold data minimization principles and only seek to collect personal information from you for the purposes described in this Privacy Policy.

When we combine non-personal information with personal information, we treat the combined information as personal information. You can always refuse to provide the personal information, but please note that some personal information is necessary to provide the Services.

4. HOW WE COLLECT PERSONAL INFORMATION

We need to collect personal information from you in order to provide you with our Services, as well as to improve the experience of using our Services. You may provide us with personal information in several ways, including, for example when you:

• • use our Services;
• • when we create a trial account for you by invitation;
• • correspond with us;
• • ask for customer service, support or other assistance; or
• • interact with us in any other way, online or offline, including through our Services.

The Application does not use cookies or web beacons; it stores your sign-in session and preferences locally on your device. Our Website also uses no cookies and no analytics.

5. HOW WE USE PERSONAL INFORMATION

Unless otherwise consented by you in advance, or as may be permitted or required by law, we will only use and disclose your personal information to fulfill the purposes for which it was collected (and in accordance with this Privacy Policy).

We may use personal information to do any or all of the following:

• • facilitate your interactions and transactions with us, such as requests for support or additional Services;
• • administer our relationship with you;
• • respond to your requests, communications, suggestions, comments, and inquiries, including your feedback about the Services;
• • analyze and measure performance, maintenance, and operations (such as our customer care interactions with you);
• • develop new products and services and build products and features;
• • ensure our systems are secure;
• • respond to legally binding demands from law enforcement, regulatory authorities or other third parties;
• • defend, protect, or enforce our rights or applicable terms of service;
• • prevent fraud or the recurrence of fraud;
• • assist in the event of an emergency; and
• • comply with applicable law.

Usage records are tied to your account email. We do not de-identify your personal information. We may use non-personal information for any legitimate business purpose.

6. HOW WE DISCLOSE PERSONAL INFORMATION

Except as set forth in this Privacy Policy, or as required or permitted by law, we do not disclose your personal information to any parties other than to our service providers (as described below) and our affiliates, and their respective directors, officers, employees, agents, consultants, advisors or other representatives that have a need to use your personal information to provide or improve our Services, to legal or regulatory authorities, or for other purposes for which you have provided your consent. In no event will we sell or rent your personal information.

We may disclose personal information:

• • to third party service providers (within or outside of Canada) to help us with the uses described in the How We Use Personal Information section above. Personal information in the custody and control of a third party service provider is subject to the laws of the jurisdiction applicable to that third party service provider. We will act in a reasonable manner, including by contractual or other means, to ensure that the third party service provider agrees to similarly be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy and security of your personal information and to similarly comply with applicable privacy legislation with respect to your personal information, but we cannot guarantee such latter compliance by the third party;
• • to comply with your directions or any additional consent you have provided us;
• • to other parties where we are under a duty to disclose your personal information in order to comply with any applicable legal obligation including a regulatory process, or an order of a government institution, investigative body, regulatory body or judicial authority of competent jurisdiction;
• • where we transfer or are considering transferring control of any or all of our assets, operations or services to a third party acquirer of all or substantially all of our assets, including our rights and obligations relating to our Services, to a third party. The third party may continue to retain and use the personal information that you provided to us. We will act in a reasonable manner, including by contractual or other means, to ensure that the third party agrees to similarly be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy and security of your personal information and to similarly comply with applicable privacy legislation with respect to your personal information, but we cannot guarantee such latter compliance by the third party acquirer; and
• • where we merge, consolidate, or amalgamate with a third party, the merged, consolidated, or amalgamated entity may continue to use and disclose your personal information. We will use our best efforts to ensure that the merged, consolidated, or amalgamated entity agrees to similarly be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy of your personal information and to similarly comply with applicable privacy legislation with respect to your personal information, but we cannot guarantee such compliance.

We disclose non-personal information to third parties as reasonably necessary to meet our business needs. We do not disclose your personal information to third parties for their own direct marketing purposes without your consent.

7. HOW WE PROTECT PERSONAL INFORMATION

We are concerned about ensuring the security of your personal information, and we have taken appropriate measures to ensure its security and confidentiality. In order to build the Application’s search index and answer questions, the Application transmits the full extracted text of your documents, sent in segments, and rendered page images where a question is about a page, table, diagram or drawing (up to four pages per question, from any PDF), over an encrypted connection (TLS 1.2 or higher) to Vincdata’s self-hosted servers located in Canada. With each question, the Application also sends your question, the recent messages of that conversation (up to the last 30) and the names and project-relative folder paths of source documents so answers can cite them. A question asking what files exist sends the list of file names and your project’s folder structure. That content is processed in memory to produce the index or the answer; it is not stored on Vincdata’s servers, not disclosed to third-party AI providers, and not used to train AI models. The original document files remain on your device and are not uploaded to Vincdata, with one exception: if you ask a question about a photograph or image, that image file itself is sent so it can be examined. If such a question does not name an image, the most recently indexed image in your project may be sent. Network traffic transits Cloudflare’s network in encrypted form, and sign-in is provided by Supabase, which stores your account and acceptance records but never document content. Limited fragments may appear transiently in error logs, which are deleted within approximately thirty (30) days. We will only retain your personal information (such as account and contact information) for the period of time reasonably required to fulfill the purposes for which it was collected.

An organization must protect personal information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. Our principal service providers are Supabase, Inc. (sign-in and account records; hosted in AWS ca-central-1, Montreal; US-headquartered) and Cloudflare, Inc. (network transit; TLS terminates at Cloudflare’s edge, so content is decrypted briefly at a Cloudflare location that may be outside Canada, then re-encrypted to our servers in Canada; nothing is stored). Our email provider (Network Solutions) stores correspondence sent to our contact and privacy addresses. All of our service providers and contractors are contractually obligated to employ appropriate data security measures with respect to your personal information and to collect, use, disclose and retain it only within the scope required for the provision of our Services. Your personal information may be collected, used, disclosed, or stored outside of Canada by our service providers in the course of providing their services, and while outside Canada, your personal information will be subject to the laws of the jurisdiction in which it is located. You may contact our Privacy Officer (see Contact Us) with questions about the collection, use, disclosure or storage of your personal information by service providers outside Canada. However, we are not responsible for the actions and privacy policies of these third parties. Check the privacy policies of these third parties for information on their privacy practices.

We try our best to safeguard personal information once we receive it, but please understand that no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure. If you suspect an unauthorized use or security breach of your information, please contact us as soon as possible.

We retain account data for the life of the account. Usage records are retained for as long as your account is active and for up to twelve (12) months after it is closed. Error logs are deleted within approximately 30 days. Acceptance records (recording your acceptance of this Privacy Policy and Terms of Use) are retained as proof of acceptance.

8. ARTIFICIAL INTELLIGENCE

The Application uses artificial intelligence (“AI”) to generate answers to your questions based on the documents you have indexed. The following describes how AI is used within the Services:

• • How AI Works in the Application. In order to build the Application’s search index and answer questions, the Application transmits the full extracted text of your documents, sent in segments, and rendered page images where a question is about a page, table, diagram or drawing (up to four pages per question, from any PDF), over an encrypted connection (TLS 1.2 or higher) to Vincdata’s self-hosted servers located in Canada. With each question, the Application also sends your question, the recent messages of that conversation (up to the last 30) and the names and project-relative folder paths of source documents so answers can cite them. A question asking what files exist sends the list of file names and your project’s folder structure. Our AI system processes this information to generate an answer with citations to the source documents in your indexed files. That content is processed in memory to produce the index or the answer; it is not stored on Vincdata’s servers, not disclosed to third-party AI providers, and not used to train AI models. The original document files remain on your device and are not uploaded to Vincdata, with one exception: if you ask a question about a photograph or image, that image file itself is sent so it can be examined. If such a question does not name an image, the most recently indexed image in your project may be sent. Network traffic transits Cloudflare’s network in encrypted form. Limited fragments may appear transiently in error logs, which are deleted within approximately thirty (30) days.
• • No Third-Party AI Providers. All AI processing is performed on our own infrastructure. We do not use third-party or public cloud AI providers to process your questions or documents. Your document content is not shared with any external AI services. We do not use your documents, excerpts, page images, questions, or answers to train or improve any AI model.
• • Local Document Storage. The original document files remain on your device and are not uploaded to Vincdata, with one exception: if you ask a question about a photograph or image, that image file itself is sent so it can be examined. If such a question does not name an image, the most recently indexed image in your project may be sent. The search index created by the Application also remains on your local machine. Document text is transmitted to Vincdata’s servers during indexing and when answering questions, but it is processed in memory only and not stored.
• • AI-Generated Answers. The answers provided by the Application are generated by AI based on the documents you have indexed. You are solely responsible for verifying the accuracy of any AI-generated answers against the cited source documents before relying on them. We do not guarantee the completeness or accuracy of any AI-generated answers. The Application is intended to assist with, not replace, professional judgment in construction quality control and document management. The Application does not provide engineering services; outputs must not be relied on for engineering, quality-control, or safety decisions.

9. YOUR CHOICES

We offer you certain choices in connection with our Services.

Access to your personal information

On your reasonable written request, we will provide you, not later than 30 days from our receipt of your request, or such additional time as required by law, with access to or information about your personal information (if any) under our custody or control, and the names of persons to whom, and any circumstances in which, your personal information has been and is being disclosed by us. You must provide sufficient information in your request to allow us to verify your identity and identify the information you are seeking.

If you request a copy of your personal information and the personal information can reasonably be reproduced, we will provide you with a copy of the personal information, or, if applicable, we will give you reasons for any delay in providing a copy of the requested personal information. All requests may be subject to minimal costs, in accordance with applicable privacy legislation.

We reserve all rights not to disclose personal information, in whole or in part, in certain circumstances permitted or required by law, including but not limited to where:

• • the personal information is protected by any legal privilege;
• • the disclosure of the personal information would reveal confidential commercial information;
• • the disclosure could reasonably be expected to threaten the life or security of another individual;
• • the personal information was generated in the course of a formal dispute resolution process; or
• • the personal information was collected by us without your knowledge and consent for reasonable purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.

If access to your personal information is refused, in whole or in part, we will provide you with the reasons for the refusal, the provision of applicable privacy legislation on which the refusal is based, and the contact information of the Privacy Officer who can answer your questions about the refusal, and will inform you that you may ask for a review of the refusal in accordance with applicable privacy legislation.

To submit a request to access your personal information or designate an authorized agent to make a request to access your personal information, please contact us. Our security procedures mean that we may request proof of identity before we disclose your personal information to you.

Updating your personal information

The accuracy of the personal information we have about you is very important. To submit a request that we update your personal information, please contact us.

On your request, we will make every reasonable effort to correct outdated personal information, or errors or omissions in your personal information where that personal information is in our custody or control. Such request must be in writing, signed by you, and include sufficient detail to enable us to identify any personal information in our custody or control in relation to the request.

We will, as soon as reasonably practical and not later than 30 days from our receipt of your request, or within such additional time as permitted or required by law, either correct the personal information and, if applicable and reasonable to do so, send correction notifications to any third party to whom we disclosed the incorrect personal information, or decide not to correct the personal information, but we will annotate the personal information under our control to indicate that a correction was requested but not made.

We will inform you of the action that we have taken in response to your request for correction, the contact information of the Privacy Officer who can answer your questions about your request for correction, and that you may ask for a review of the action taken in accordance with applicable privacy legislation.

Deleting your data

The Application includes “Delete All Data” and “Clear Chat History” buttons that allow you to delete your local data. To request deletion of your account, email privacy@vincdata.ca. In most cases your account will be closed within 30 days of your request; after that, records are retained or deleted as described under How We Protect Personal Information.

Email communications

We may email you about your account and the trial. Any marketing email would include an unsubscribe link. Certain emails are necessary for the operation of the Services and you will continue to receive those.

10. THIRD PARTY WEBSITES AND APPS

The Services may contain links to other websites or apps operated by third parties. Please be advised that the practices described in this Privacy Policy do not apply to information gathered through these third-party websites and apps. We have no control over, and are not responsible for, the actions and privacy policies of third parties and other websites and apps.

11. CONTACT US

If you have questions, concerns, or would like to access/update/change your personal information, you can contact us in the following ways:

For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file.