Privacy Policy

1. Data controller

NEXUS AI (Montréal (Québec), Canada) is the controller of your personal information. For any privacy question: privacy@nexus.ai.

2. Person in charge of the protection of personal information

In accordance with s. 3.1 of Quebec Law 25, the person exercising the highest authority within NEXUS AI is responsible for the protection of personal information. This role is held by: Président, NEXUS AI, Montréal (Québec), Canada.

You can reach the privacy officer at: privacy@nexus.ai. Their title and contact details are published on this page.

3. Data we process

Account data (name, email, organization, role); Service configuration and usage data; business data you entrust to the agents ("Customer Content"); AI diagnostic answers and associated contact details; technical data (logs, IP address, device type); billing data (via our payment processor).

4. Purposes and legal bases

Provide and secure the Service (contract performance); billing (legal obligation/contract); improvement and analytics with your consent; operational communications (legitimate interest); compliance with our legal and accounting obligations (OHADA/SYSCOHADA, taxation).

5. Minimization and AI

Before any processing by an AI model, sensitive data is minimized (redaction of personal data, metadata, or isolation per the configured level). The model receives only what is necessary. No decision producing significant legal effects is made without appropriate human oversight.

6. Hosting and communications outside Quebec

Primary hosting: your data is hosted in Canada (Supabase infrastructure, region ca-central-1 — Montreal).

Some functions involve communicating information to providers located OUTSIDE Quebec. In the United States: Stripe (payments), Resend (email delivery), Sentry (error monitoring), Anthropic (AI models), Vercel (site delivery), Meta and Twilio (WhatsApp/SMS messaging). In China: DeepSeek (audit analyses) — this provider only receives MINIMIZED data: personal information (emails, phone numbers, identifiers) is automatically redacted before any transmission.

In accordance with s. 17 of Law 25, a privacy impact assessment (PIA) is carried out before each communication of personal information outside Quebec, to verify it receives adequate protection.

The full, up-to-date list of sub-processors, their roles and jurisdictions is available at /legal/sous-traitants.

7. Processors

We use processors (hosting, payment, email, AI model providers, messaging) bound by contractual confidentiality and data-protection commitments. The named, up-to-date list is published at /legal/sous-traitants. Any addition or replacement is subject to 30 days prior notice.

8. Retention periods

AI diagnostic contact details and answers (leads): 24 months after collection, then deletion or anonymization.

Account data: duration of the contractual relationship, then deletion or anonymization subject to legal retention obligations (e.g. accounting records: 10 years in OHADA zone, 6 years in Canada).

Email click-tracking data (delivery/engagement measurement): 12 months.

Audit logs and work certificates may be retained longer for evidentiary purposes, in minimized form.

9. Security

Encryption at rest and in transit, strict per-organization isolation (Row-Level Security), tamper-proof certificate chain, key rotation, emergency stop. See our Trust & Security page.

10. Confidentiality incidents

We maintain a register of confidentiality incidents in accordance with ss. 3.5 to 3.8 of Law 25.

If an incident presents a risk of serious injury, we diligently notify the Commission d'accès à l'information (CAI) as well as any affected person, and take reasonable measures to reduce the risk and prevent recurrence.

11. Automated decisions

In accordance with s. 12.1 of Law 25, if a decision based exclusively on automated processing of your personal information is made about you, you are informed at or before the time of the decision.

Upon request, we disclose: the personal information used, the reasons and principal factors that led to the decision, and your right to have that information corrected. You may submit observations to a member of our personnel who is in a position to review the decision.

By design, the platform default mode is copilot: significant decisions require human validation until autonomy is explicitly granted by the customer.

12. Portability

In accordance with s. 27 of Law 25 (and art. 20 GDPR), you may obtain the computerized personal information you provided to us in a structured, commonly used technological format.

Requests should be addressed to the privacy officer: privacy@nexus.ai.

13. Your rights

Depending on applicable law: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and — in Quebec — de-indexing and information about automated decisions. To exercise your rights: privacy@nexus.ai. You may also lodge a complaint with the competent authority (CAI in Quebec, CNIL/EU authorities, APDP/NDPA/Information Regulator in Africa).

14. Cookies

Cookie use is detailed in our Cookie Policy, with granular consent management and a named table of cookies set.

15. Changes

We may update this Policy. The last-updated date appears at the top. Material changes will be notified to you.