Privacy Policy

1. Introduction

This privacy policy describes how 9410-4668 Québec inc., operating under the name Neo Solution ("we", "our", "us"), collects, uses, discloses and protects your personal information in accordance with Quebec's Act respecting the protection of personal information in the private sector (" Law 25 ").

This policy applies to all users of our NeoAISolution platform, including our website, applications and artificial intelligence services.

2. Person Responsible for the Protection of Personal Information

In accordance with Law 25, we have designated a person responsible for the protection of personal information within our organization.

3. Personal Information Collected

We collect the following categories of personal information:

4. Collection Methods

We collect your personal information through the following means:

Direct Collection

When you create your account, submit forms or use our services.

Automatic Collection

Through technological means when you use the platform (server logs, session data).

Third-Party Collection

Through our authentication provider AWS Cognito when you sign in to your account.

5. Purposes of Processing

We use your personal information for the following purposes:

• Provide our artificial intelligence services and enable platform use
• Manage your account and authenticate your identity
• Improve our services and develop new features
• Ensure platform security and prevent fraud
• Comply with our legal and regulatory obligations
• Provide customer support and respond to your requests
• Measure the effectiveness of our advertising campaigns (provenance parameters associated with the account at signup — NEO-0006)

6. Consent

We obtain your consent for the collection and use of your personal information in accordance with Law 25.

We collect explicit consent for the use of our AI services that process your data.

Your consent is obtained when you create your account and accept our terms of use.

Right to Withdraw Consent

You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

To withdraw your consent, contact our person responsible for the protection of personal information at the address below. Note that withdrawal of consent may limit or prevent use of certain services.

7. Disclosure to Third Parties

We may disclose your personal information to the following categories of third parties:

• Cloud Infrastructure Provider: Amazon Web Services (AWS) — Platform hosting and data storage
• Artificial Intelligence Service Providers: Anthropic, Google AI, OpenAI, xAI — Processing AI requests and generating responses
• Authentication Provider: AWS Cognito — Authentication and identity management

These providers comply with recognized security standards and hold certifications such as SOC 2, ISO 27001 and other industry standards.

8. Transfers Outside Quebec

Some of your personal information may be transferred and processed outside Quebec.

Transfers may occur to Canada (outside Quebec) and the United States, where some of our service providers are located.

Our main infrastructure is hosted in the AWS Canada (Central) region located in Montreal (ca‑central‑1).

Before any transfer, we conduct a privacy impact assessment and ensure that the recipient provides adequate protection of personal information.

We implement contractual and technical measures to ensure a level of protection equivalent to that provided by Quebec legislation.

9. Data Retention

We retain your personal information only for the duration necessary for the purposes for which it was collected.

• Account data: retained for the duration of your account. On a deletion request the account is deactivated and a 30-day recovery window opens, during which you can reactivate it; past that window the data is purged
• Conversation history: accessible as long as the user does not delete it; permanent deletion follows account data retention cycle
• System logs: 90 days
• Backups: 30 days
• Exchanges held with the Fable model: 30 days, at the provider and outside Canada — a requirement Anthropic places on that model, not a choice of ours (see section 10)

Upon expiration of the retention period, data is either deleted or irreversibly anonymized.

You may request deletion of your data at any time by contacting our person responsible for the protection of personal information.

10. Automated Decisions and Artificial Intelligence

Our platform uses artificial intelligence technologies to provide its services. In accordance with section 12.1 of Law 25, we inform you of the following:

Your data is processed by artificial intelligence systems to generate responses to your requests.

AI analyzes your prompts and the context provided (attached documents, conversation history) to generate relevant responses. These responses are suggestions and do not constitute binding decisions.

You retain full control over the use of generated responses. No decision with legal or significant effects is made entirely automatically without human intervention.

The AI providers used are: Anthropic, Google AI, OpenAI and xAI.

Data sent to AI providers includes: your prompts, content of documents attached to the conversation and conversation context.

You may contact us to obtain explanations about the general operation of our AI systems and how your data is used.

We do not accept that data sent to AI providers be used to train their models. The providers we use (through their enterprise APIs) are contractually committed to not retaining your data and to processing it only to generate responses to your requests, except as described in the next paragraph.

One exception to the above: the Fable model. Anthropic designates it a Covered Model and, on that basis, requires 30-day retention of exchanges wherever the model is offered; that retention happens at the provider, outside Canada. For every other model, no retention takes place anywhere but Canada. Data retained this way is never used to train models without express permission. Fable is offered on paid plans only, and the model is picked conversation by conversation, so you keep control over what is sent to it.

11. Security Measures

We implement appropriate technical and organizational security measures to protect your personal information:

• Encryption of data in transit (TLS) and at rest (AES-256)
• Role-based access controls and principle of least privilege
• Logging and monitoring of data access
• Infrastructure hosted on AWS, certified SOC 2, ISO 27001
• Staff training on personal information protection
• Security incident response procedures

12. Your Rights

In accordance with Law 25, you have the following rights regarding your personal information:

Right of Access

Obtain confirmation that we hold personal information about you and receive a copy.

Right to Rectification

Have your inaccurate, incomplete or equivocal personal information corrected.

Right to Erasure

Request deletion of your personal information when it is no longer necessary or when you withdraw your consent.

Right to Portability

Receive your personal information in a structured and commonly used technological format, or request its transfer to another organization. This right is exercised by request to the privacy officer: the service does not currently offer a self-serve export.

Right to Object

Object to certain processing of your personal information.

Right to Withdraw Consent

Withdraw your consent at any time for processing based on it.

To exercise your rights, contact our person responsible for the protection of personal information by email at privacy@neoaisolution.com. Identity verification may be required to process your request.

We will respond to your request within 30 days of receipt. This period may be extended by an additional 30 days if necessary, in which case we will inform you.

If your request is refused, we will inform you in writing, stating the reasons for the refusal as well as available recourses, including filing a complaint with the Commission d'accès à l'information du Québec.

13. Privacy Incidents

A privacy incident is unauthorized access, use or disclosure of personal information, or the loss thereof.

We have implemented procedures to detect, report and manage privacy incidents.

In the event of an incident presenting a risk of serious harm, we will notify you as soon as possible and inform the Commission d'accès à l'information du Québec.

Notification will be made diligently, and no later than 72 hours after discovery of the incident.

Following an incident, you may exercise your access rights to verify whether your information has been compromised and request corrective measures.

14. Complaint Process

If you believe your personal information protection rights have not been respected, you may file a complaint with us.

Send your complaint by email to privacy@neoaisolution.com describing the nature of your concern.

We will acknowledge receipt of your complaint within 10 business days and provide you with a response within 30 days.

If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec.

15. Commission d'accès à l'information du Québec

The Commission d'accès à l'information du Québec (CAI) is the body responsible for ensuring compliance with the Act respecting the protection of personal information in the private sector.

You have the right to file a complaint with the CAI if you believe your personal information protection rights have not been respected.

16. Changes to the Policy

We may modify this privacy policy from time to time to reflect changes in our practices or for other operational, legal or regulatory reasons.

In the event of changes, we will inform you upon your next login to the application.

You will need to consent to each new version of the privacy policy to continue using the application.

The date of the last update is indicated at the top of this policy.

17. Contact

For any questions regarding this privacy policy or to exercise your rights, please contact us: