Legal

Privacy and personal data protection policy

Effective October 20, 2026

1. Who we are

SetupAI Services Inc. ("SetupAI", "we", "our", "us") is a Quebec consulting firm specializing in artificial intelligence strategy, transformation and delivery, based in Montreal, Quebec, Canada.

This privacy policy (the "Policy") applies to the personal information we hold or that is under our control, including information collected when you visit our website, as well as across all of our activities: consulting services, client relationship management, recruitment, and the operation of our digital tools (the "Services").

SetupAI is responsible for the personal information it collects.

Person in charge of the protection of personal information
Email: info@setupai.ca

If you access or use our Services, you agree to be bound by the terms of this Policy.

2. Personal information we collect

In the course of our Services, SetupAI collects the following categories of personal information.

2.1 Identification information

• First and last name
• Business email address
• Phone number, where you provide it
• Job title and organization name
• Mailing address, in the context of an engagement or invoicing

2.2 Transactional information

• Billing details
• Client and supplier account information
• History of engagements and transactions
• Information relating to the Services we have delivered

2.3 Information about our collaborators and job applicants

This category applies where we recruit, employ or pay an individual:

• Name, contact details and, for payroll purposes only, social insurance number
• Résumé, diplomas and certifications
• Employment or service contracts and application files
• Time records by engagement
• Compensation and benefits information

2.4 Browsing information

• IP address
• Browser and operating system type
• Pages requested, date and time

This data is logged by our hosting provider solely to keep the service secure and working properly. The website uses no analytics, advertising or personalization cookies: see section 9.

2.5 Information you provide voluntarily

• The content of our email exchanges
• The answers you enter in the meeting booking form
• Résumé and information submitted with an unsolicited application
• Information provided in the course of a business relationship

When you provide information voluntarily, you acknowledge that we have no control over the nature and type of information you choose to send us. If you choose to include sensitive personal information, you expressly consent to its collection, use and disclosure by SetupAI in accordance with this Policy, including to third parties located in and outside Quebec.

SetupAI takes reasonable steps to ensure that the information it uses or discloses is accurate, complete and up to date. It is your responsibility to inform us of any significant change.

3. Purposes of processing

SetupAI collects and uses personal information for the following purposes.

3.1 Delivering our Services

• Carrying out AI strategy, design and delivery engagements.
• Managing client relationships: communications, follow-ups and reports.
• Answering your requests before a contract is entered into.
• Invoicing and accounting.

3.2 Improving our Services and communications

• Analyzing client needs and satisfaction.
• Sending professional communications.
• Developing case studies.

3.3 Security and compliance

• Detecting and handling security incidents.
• Meeting our legal and regulatory obligations.
• Managing access rights to our systems.

We do not sell your information, we do not use it for profiling, and we make no decision based solely on automated processing that produces legal effects concerning you. Information will not be used for purposes other than those described above unless we have obtained your consent, or where the law requires or permits it.

4. Processors and disclosure to third parties

Within SetupAI, access to personal information is strictly limited to the people for whom it is necessary to carry out their duties.

SetupAI uses processors and third-party tools, in particular for website hosting, email and office software, some of which are established outside Quebec. These third parties are contractually required to protect personal information in accordance with the Act respecting the protection of personal information in the private sector.

4.1 Artificial intelligence platforms

In the course of our engagements, we may use artificial intelligence models provided by third parties, including OpenAI and Anthropic. SetupAI ensures that no personal information is sent to these platforms without a prior privacy impact assessment, and that no sensitive personal information is sent to them without the explicit consent of the person concerned. We favour configurations that exclude the reuse of data for model training.

4.2 Meeting booking

Meetings are booked through Calendly (Calendly LLC, United States). The information you enter in the booking form is processed there.

SetupAI does not sell or rent your personal information to third parties.

5. Transfers outside Quebec

Because some of our processors are established outside Quebec, your personal information may be transferred to and processed in other Canadian provinces or abroad.

In accordance with section 17 of the Act respecting the protection of personal information in the private sector, SetupAI carries out a privacy impact assessment (PIA) before any transfer outside Quebec, to confirm that the information will receive an adequate level of protection. Where we disclose sensitive personal information outside Quebec, we obtain your express consent.

You can obtain information about the terms of these transfers by contacting our person in charge of the protection of personal information.

6. Retention periods

SetupAI retains your personal information only for as long as necessary to fulfill the purposes for which it was collected, or to meet its legal obligations:

• Client records and engagements: 7 years after the end of the engagement, due to our tax and accounting obligations
• Requests that did not lead to a project: 3 years after our last exchange
• Collaborator and employee records: for the duration of the engagement, then 5 years
• Unsuccessful applications: 6 months, unless you consent to longer retention
• Hosting provider technical logs: according to our hosting provider's retention policy

Once these periods expire, or once the purposes for which the information was collected have been fulfilled, it is securely destroyed or anonymized.

7. Exercising your rights

Withdrawing consent. You may withdraw your consent at any time, subject to applicable legal restrictions. The withdrawal takes effect within 30 days of your request; if we are unable to respond within that time, we will let you know. Withdrawing your consent may prevent us from continuing to provide certain Services to you.

Access. You have the right to confirmation that we hold information about you, to consult it and to obtain a copy. Where it was collected electronically, we provide it in a structured, commonly used technological format. Access is free of charge; reasonable fees may apply for transcription, reproduction or transmission.

Correction. You may request the correction of information that is inaccurate, incomplete or ambiguous, or whose collection, disclosure or retention is not authorized by law.

De-indexing. You may request that the dissemination of information about you cease, or that any hyperlink giving access to it be de-indexed, on the conditions set out in the law.

To exercise these rights, or for any complaint regarding your personal information, send a written request to our person in charge of the protection of personal information at info@setupai.ca, providing sufficient proof of identity. We respond within 30 days of receiving your request.

8. Security of personal information

SetupAI implements appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration or destruction, including:

• Role-based access control and the principle of least privilege
• Two-factor authentication across all of our tools
• Encryption of data in transit and at rest
• Periodic privacy risk assessments
• Privacy awareness training for our collaborators
• A confidentiality incident register and notification protocol

No mechanism offers flawless security, and a degree of risk always remains. In the event of a confidentiality incident presenting a risk of serious injury, SetupAI notifies the Commission d'accès à l'information du Québec and the people affected within the prescribed time limits.

9. Cookies and similar technologies

Our website uses no cookies for analytics, advertising or personalization. It loads no analytics script, and its fonts are served from the website itself, with no call to an external service.

The only records kept are our hosting provider's technical logs, necessary to keep the service secure and working properly, described in section 2.4.

If we were to introduce non-essential cookies, your consent would be requested before they are placed and you could withdraw it at any time. You can also configure your browser to refuse or delete cookies.

10. Changes to this policy

SetupAI reserves the right to amend this Policy at any time, in particular to reflect legislative, regulatory or operational changes. Any change appears on this page, and the effective date is shown at the top of it. The version in force is always available on request.

11. Contact us

For any question regarding this Policy or the protection of your personal information:

Person in charge of the protection of personal information
SetupAI Services Inc.
Email: info@setupai.ca

If you are not satisfied with our answer, you may file a complaint with the competent authority.

Commission d'accès à l'information du Québec
Website: cai.gouv.qc.ca
Phone: 1 888 528-7741