Privacy Policy

1. Introduction

TrueNorth Data Inc. ("TrueNorth Data," "we," "us," or "our") is committed to protecting your privacy and the security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our secure virtual data room platform (the "Service").

TrueNorth Data is designed to meet the requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Where your data is hosted

Documents, the application and the primary database are hosted in Canada (Montréal, Quebec). Some of the vendors we rely on to deliver the Service operate outside Canada, as described below and in Section 6 (Sub-Processors):

• Document storage and the application run on Google Cloud in the northamerica-northeast1 (Montréal) region
• The application database is hosted by Supabase on AWS in the ca-central-1 (Montréal) region
• Copilot (AI) processing, when enabled, uses Google Vertex AI in the northamerica-northeast1 (Montréal) region
• Transactional email (invitations and account notifications) is sent through Resend, which operates from the United States; recipient email addresses and the content of those messages are processed outside Canada

Hosting in Canada is intended to support your own data-residency and security obligations. It does not by itself make any deployment compliant with a particular requirement. See Section 6 (Sub-Processors) below for the vendors we rely on to deliver the Service and where each operates its infrastructure.

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, phone number, job title, and organization name when you register for an account
• Profile Information: Profile photo, professional details, and communication preferences
• Documents and Files: Any documents, files, or content you upload to the Service
• Communications: Messages, comments, and other communications you send through the Service

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Service, and interaction patterns
• Device Information: Browser type, operating system, device identifiers, and screen resolution
• Log Data: IP address, access times, and referring URLs
• Audit Logs: Records of sign-ins, document views and downloads, edits and permission changes within data rooms, kept for security and compliance purposes

3.3 Information from Third Parties

We may receive information about you from your organization's administrator, other users who invite you to data rooms, or identity verification services when required for compliance purposes.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send technical notices, updates, security alerts, and administrative messages
• Respond to your comments, questions, and customer service requests
• Monitor and analyze usage trends to improve user experience
• Detect, investigate, and prevent fraudulent transactions and unauthorized access
• Maintain comprehensive audit logs for compliance and security purposes
• Comply with legal obligations and enforce our agreements
• Provide AI document analysis features (when enabled by your organization)

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

• With Your Organization: If you access TrueNorth Data through an organization account, your organization's administrators may access your account information and activity
• With Other Users: Information you share in data rooms is visible to other authorized users of those data rooms
• Service Providers: We work with the sub-processors listed in Section 6 below to operate our Service, all of whom are bound by confidentiality and data-processing agreements
• Legal Requirements: We may disclose information if required by Canadian law, legal process, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with continued protection of your information
• With Your Consent: We may share information with your explicit consent

6. Sub-Processors

TrueNorth Data uses the following sub-processors to provide the Service. Each is bound by a data-processing agreement:

• Google Cloud: application hosting, file storage, and Vertex AI for Copilot when enabled (northamerica-northeast1 / Montréal region)
• Supabase, Inc.: managed database hosting (infrastructure operated on AWS ca-central-1 / Montréal region)
• Resend: transactional email delivery (account notifications and invitations), operated from the United States, outside Canada; recipient email addresses and the content of those messages are processed there
• OnlyOffice: in-browser document editing, self-hosted by TrueNorth Data within our own infrastructure — document content is not sent to OnlyOffice's own servers

We will update this list if we add or replace a sub-processor and, where required by law or contract, provide advance notice.

7. Data Security

TrueNorth Data implements security measures, including:

• Encryption: AES-256 encryption for data at rest and TLS for data in transit; when enabled for your deployment, new documents are also encrypted with a key managed by TrueNorth Data in Cloud KMS
• Access Controls: Role-based access control, multi-factor authentication, and session management
• Audit Logging: Sign-ins, views, downloads, edits and permission changes are recorded in a hash-chained audit trail. Audit entries are written on a best-effort basis.
• Infrastructure Security: The application and document storage run on Google Cloud in the northamerica-northeast1 (Montréal) region, and the database is a managed PostgreSQL service hosted in Montréal (Supabase on AWS ca-central-1). Physical security of the data centres is provided by those providers.

8. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required by law or your organization's requirements. Specifically:

• Account Data: Retained while your account is active and deleted when you ask us to, subject to legal and contractual retention requirements
• Documents: Retained according to your organization's data room settings and policies
• Audit Logs: Audit logs are retained under our audit retention policy; the retention period is confirmed in your agreement.

9. Your Privacy Rights

Under PIPEDA and applicable provincial legislation, you have the following rights:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal and contractual retention requirements
• Withdrawal of Consent: Withdraw consent for certain processing activities
• Portability: Request a copy of your data in a portable format
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

To exercise these rights, contact us at privacy@truenorthdata.io. We will respond to your request within 30 days.

10. Quebec residents (Law 25)

If you are a resident of Quebec, you have additional rights under Quebec's Act respecting the protection of personal information in the private sector (Law 25), including the right to be informed of the categories of personal information collected, the purposes of collection, and the categories of persons who have access to it; the right to request that your information be de-indexed or provided in a structured, commonly used technological format; and the right to withdraw consent to processing that relies on it, subject to legal and contractual limits.

TrueNorth Data's Privacy Officer, identified in Section 15 (Contact Us), is responsible for the protection of personal information for Quebec residents. TrueNorth Data does not use automated decision-making to make decisions producing legal or similarly significant effects about you.

11. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential Cookies: Required for the Service to function (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use the Service

You can control cookies through your browser settings. Note that disabling essential cookies may affect Service functionality.

12. AI Features

TrueNorth Data offers optional AI features including document summarization, search, and analysis. When these features are enabled:

• AI processing, when enabled, uses Google Vertex AI in the northamerica-northeast1 (Montréal) region
• Document content is processed only when you explicitly request AI assistance
• AI interactions are logged for audit purposes
• TrueNorth Data does not use document content to train AI models. Copilot sends content to Google Cloud Vertex AI, which processes it under Google Cloud's terms for customer data.
• Your organization administrator can enable or disable AI features

13. Children's Privacy

TrueNorth Data is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or through the Service. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: