Privacy Policy

1. Introduction

TrueNorth Data Inc. ("TrueNorth Data," "we," "us," or "our") is committed to protecting your privacy and the security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our secure virtual data room platform (the "Service").

TrueNorth Data is designed to meet the requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Where your data is hosted

Documents, the application and the primary database are hosted in Canada (Montréal, Quebec). Some of the vendors we rely on to deliver the Service operate outside Canada, as described below and in Section 6 (Sub-Processors):

• Document storage and the application run on Google Cloud in the northamerica-northeast1 (Montréal) region
• The application database is hosted by Supabase on AWS in the ca-central-1 (Montréal) region
• Copilot (AI) processing, when enabled, uses Google Vertex AI in the northamerica-northeast1 (Montréal) region
• Transactional email (invitations and account notifications) is sent through Resend, which operates from the United States; recipient email addresses and the content of those messages are processed outside Canada

Hosting in Canada is intended to support your own data-residency and security obligations. It does not by itself make any deployment compliant with a particular requirement. See Section 6 (Sub-Processors) below for the vendors we rely on to deliver the Service and where each operates its infrastructure.

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, phone number, job title, and organization name when you register for an account
• Profile Information: Profile photo, professional details, and communication preferences
• Documents and Files: Any documents, files, or content you upload to the Service
• Communications: Messages, comments, and other communications you send through the Service

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Service, and interaction patterns
• Device Information: Browser type, operating system, device identifiers, and screen resolution
• Log Data: IP address, access times, and referring URLs
• Audit Logs: Records of sign-ins, document views and downloads, edits and permission changes within data rooms, kept for security and compliance purposes

3.3 Information from Third Parties

We may receive information about you from your organization's administrator, other users who invite you to data rooms, or identity verification services when required for compliance purposes.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send technical notices, updates, security alerts, and administrative messages
• Respond to your comments, questions, and customer service requests
• Monitor and analyze usage trends to improve user experience
• Detect, investigate, and prevent fraudulent transactions and unauthorized access
• Maintain comprehensive audit logs for compliance and security purposes
• Comply with legal obligations and enforce our agreements
• Provide AI document analysis features (when enabled by your organization)

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

• With Your Organization: If you access TrueNorth Data through an organization account, your organization's administrators may access your account information and activity
• With Other Users: Information you share in data rooms is visible to other authorized users of those data rooms
• Service Providers: We work with the sub-processors listed in Section 6 below to operate our Service, all of whom are bound by confidentiality and data-processing agreements
• Legal Requirements: We may disclose information if required by Canadian law, legal process, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with continued protection of your information
• With Your Consent: We may share information with your explicit consent

6. Sous-traitants

TrueNorth Data fait appel aux sous-traitants suivants pour fournir le Service. Chacun est lié par une entente de traitement des données :

• Google Cloud : hébergement de l’application, stockage des fichiers et Vertex AI pour le Copilote lorsqu’il est activé (région northamerica-northeast1 / Montréal)
• Supabase, Inc. : hébergement géré de la base de données (infrastructure exploitée sur AWS ca-central-1 / région de Montréal)
• Resend : envoi de courriels transactionnels (notifications de compte et invitations), exploité depuis les États-Unis, à l’extérieur du Canada; les adresses courriel des destinataires et le contenu de ces messages y sont traités
• OnlyOffice : édition de documents dans le navigateur, hébergée par TrueNorth Data au sein de notre propre infrastructure — le contenu des documents n’est jamais transmis aux serveurs d’OnlyOffice

Nous mettrons à jour cette liste si nous ajoutons ou remplaçons un sous-traitant et, lorsque la loi ou un contrat l’exige, nous en donnerons un préavis.

7. Data Security

TrueNorth Data met en œuvre des mesures de sécurité, notamment :

• Encryption: Chiffrement AES-256 des données au repos et TLS pour les données en transit; lorsqu'elle est activée pour votre déploiement, une clé gérée par TrueNorth Data dans Cloud KMS chiffre aussi les nouveaux documents
• Access Controls: Role-based access control, multi-factor authentication, and session management
• Audit Logging: Les connexions, consultations, téléchargements, modifications et changements d'autorisations sont consignés dans une piste d'audit à chaîne de hachage. Audit entries are written on a best-effort basis.
• Infrastructure Security: The application and document storage run on Google Cloud in the northamerica-northeast1 (Montréal) region, and the database is a managed PostgreSQL service hosted in Montréal (Supabase on AWS ca-central-1). Physical security of the data centres is provided by those providers.

8. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required by law or your organization's requirements. Specifically:

• Account Data: Retained while your account is active and deleted when you ask us to, subject to legal and contractual retention requirements
• Documents: Retained according to your organization's data room settings and policies
• Audit Logs: Audit logs are retained under our audit retention policy; the retention period is confirmed in your agreement.

9. Your Privacy Rights

Under PIPEDA and applicable provincial legislation, you have the following rights:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal and contractual retention requirements
• Withdrawal of Consent: Withdraw consent for certain processing activities
• Portability: Request a copy of your data in a portable format
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

To exercise these rights, contact us at privacy@truenorthdata.io. We will respond to your request within 30 days.

10. Résidents du Québec (Loi 25)

Si vous résidez au Québec, vous disposez de droits supplémentaires en vertu de la Loi sur la protection des renseignements personnels dans le secteur privé (Loi 25), notamment le droit d’être informé des catégories de renseignements personnels recueillis, des fins de la collecte et des catégories de personnes qui y ont accès; le droit de demander que vos renseignements soient désindexés ou communiqués dans un format technologique structuré et couramment utilisé; et le droit de retirer votre consentement au traitement qui repose sur celui-ci, sous réserve des limites légales et contractuelles.

La responsable de la protection des renseignements personnels de TrueNorth Data, identifiée à la section 15 (Nous joindre), est responsable de la protection des renseignements personnels des résidents du Québec. TrueNorth Data n’utilise pas de prise de décision automatisée pour rendre des décisions produisant des effets juridiques ou des effets significatifs similaires à votre égard.

11. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential Cookies: Required for the Service to function (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use the Service

You can control cookies through your browser settings. Note that disabling essential cookies may affect Service functionality.

12. AI Features

TrueNorth Data offers optional AI features including document summarization, search, and analysis. When these features are enabled:

• AI processing, when enabled, uses Google Vertex AI in the northamerica-northeast1 (Montréal) region
• Document content is processed only when you explicitly request AI assistance
• AI interactions are logged for audit purposes
• TrueNorth Data n'utilise pas le contenu des documents pour entraîner des modèles d'IA. Copilote envoie le contenu à Google Cloud Vertex AI, qui le traite selon les conditions de Google Cloud applicables aux données des clients.
• Your organization administrator can enable or disable AI features

13. Children's Privacy

TrueNorth Data is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or through the Service. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: