Privacy Policy

AlloTech.AI respects your privacy and processes your personal information in accordance with Quebec Law 25, the Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable laws.

1. What personal data we collect

1.1 Account and billing data

When you register, we collect your name, email address, company name, and billing information. Payments are processed by certified third-party processors; we do not store your card numbers.

1.2 Usage and conversation data

We collect messages you exchange with AI employees, tasks you submit, documents you upload to enrich the agent's memory (RAG), usage logs, and associated metadata (timestamp, session identifier, action type). This data is necessary to operate the service and improve response quality.

1.3 Technical data

We automatically collect your IP address, browser type, operating system, pages visited on the marketing site, and analytics events, subject to your consent.

2. Why we process your data

We use your data to:

• provide and operate the SaaS platform and AI employees (contract performance);
• manage your account, plan, and credits;
• ensure security, fraud prevention, and compliance;
• respond to your support requests;
• send transactional communications and, with your consent, marketing communications;
• meet our legal obligations, including under Law 25.

3. Legal basis

Processing is based on:

• performance of the service contract for platform use;
• your consent for analytics cookies, preferences, and marketing communications;
• AlloTech's legitimate interest in security and service improvement;
• applicable legal obligations in Quebec and Canada.

4. Processors and transfers

By default, your data is hosted in Canada. We use Canadian or Law 25-compliant providers for hosting, databases (PostgreSQL, Redis, Qdrant), and infrastructure. Default language models are provided by Kimi (Moonshot) and Ollama; other providers may be configured depending on your plan. No cross-border data transfer occurs by default. When foreign processing is necessary, it is governed by appropriate contractual clauses.

5. Data retention

We retain personal data only as long as necessary for the purposes described or as required by law. Account and billing records are kept for seven (7) years for tax purposes. Conversations and RAG documents are kept for the duration of the contract and deleted within 90 days of termination, unless otherwise required by law. Security logs are retained for twelve (12) months.

6. Your rights under Law 25 and PIPEDA

You have the following rights:

• right of access to your personal information;
• right to rectification of inaccurate or incomplete data;
• right to data portability in a structured, commonly used format;
• right to erasure (right to be forgotten), subject to our legal obligations;
• right to withdraw consent at any time for marketing and cookies;
• right to file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

To exercise your rights, write to [email protected]. We respond within thirty (30) days of receiving your request.

7. Approval gates and auditability

Consistent with our « Law 25 by design » approach, every action with real-world effect passes through an approval gate. Actions, approvals, and rejections are recorded in an audit log accessible to your account administrators.

8. Cookies and similar technologies

We use essential cookies required for site operation, analytics cookies to measure audience, and preference cookies for language and display settings. Non-essential cookies require your consent. See our Cookie Policy for details.

9. Privacy Officer

The Privacy Officer is:

• Salem Boudehb, CEO
• Email: [email protected]
• Address: Laval, Quebec, Canada

10. Changes

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be posted on this page with a new effective date.