Privacy Policy

1. Introduction

Adiuvo ("we", "us", or "our") operates the website adiuvo.ca and the Adiuvo ecosystem of products (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.

We are committed to protecting your privacy in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Ontario's applicable privacy legislation, and Canada's Anti-Spam Legislation (CASL).

2. Information We Collect

We collect the following categories of personal information:

2.1 Information You Provide

• Account registration details (name, email address, phone number, mailing address)
• Payment and billing information processed through our third-party payment processor (Stripe)
• Communications you send to us (contact form submissions, support requests, feedback)
• Content and data you input while using our products

2.2 Information Collected Automatically

• Device and browser information (IP address, browser type, operating system)
• Usage data (pages visited, features used, session duration, referral source)
• Cookies and similar tracking technologies (see Section 9)

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain the Service — including account creation, authentication, subscription management, and customer support
• To improve and enhance Adiuvo products — usage patterns and interaction data are analyzed to produce stronger, more accurate results across all products and AI-powered features
• To process transactions — billing, invoicing, and payment processing through Stripe
• To communicate with you — service announcements, security alerts, billing notifications, and responses to your inquiries
• To ensure security and prevent fraud — detecting unauthorized access, abuse, or violations of our Terms of Service
• To comply with legal obligations — as required by applicable Canadian law

Product improvement: Data you provide and generate while using the Service may be used in aggregate or anonymized form to train, calibrate, and improve the AI models and algorithms that power Adiuvo products. This ensures the ecosystem continuously delivers more accurate and relevant results for all users.

4. Legal Basis for Processing (PIPEDA)

Under PIPEDA, we process your personal information based on the following lawful grounds:

• Consent — You provide consent when you create an account, submit information through forms, or use our Service
• Contractual necessity — Processing necessary to fulfil our obligations under the Terms of Service and any subscription agreements
• Legitimate interests — Improving our products, preventing fraud, and ensuring security, where such interests are not overridden by your privacy rights
• Legal compliance — Where required by Canadian federal or provincial law

5. Disclosure of Your Information

We do not sell, rent, or trade your personal information. We may share your information with:

• Service providers — Third-party vendors who assist in operating the Service (e.g., Stripe for payments, cloud hosting providers). These providers are contractually required to protect your data and use it only for the purposes we specify.
• Legal authorities — When required by law, subpoena, court order, or governmental regulation, or to protect our rights, property, or safety
• Business transfers — In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction

6. Authorized Staff Access (Support Impersonation)

To provide customer support, troubleshoot account issues, and assist with configuration, designated Adiuvo staff may temporarily access your account using a controlled impersonation feature. While impersonating, staff act within your account as if logged in as you, and may view or modify the same information you can.

6.1 Who Can Use This Feature

Only Adiuvo personnel with the "staff" role on the platform may initiate an impersonation session. This is a deliberately small group of authorized employees and contractors who require account-level access as part of their support, engineering, or operations responsibilities.

6.2 Audit Trail

Every impersonation session is recorded. For each session we retain:

• The identity of the staff member who initiated the session
• The customer account that was accessed
• The start and end timestamps
• The IP address and user-agent of the staff member's session
• An optional reason recorded by the staff member

In addition, every individual API request executed during an impersonation session is logged with its method, path, response status, duration, and (for write requests) a truncated copy of the request body. This per-request log allows us — and you — to reconstruct exactly what was done on your behalf.

6.3 Oversight Controls

Access to the impersonation audit log is intentionally narrower than the ability to perform impersonation. Only superusers and members of an explicitly maintained impersonation_auditors group may view the audit trail. This separation ensures that the activity of staff is independently reviewable rather than self-monitored.

6.4 Session Lifetime & Safeguards

• An impersonation session is active until the staff member explicitly exits, or until they log out (which automatically ends the session).
• A persistent on-screen banner is displayed throughout the session so the staff member is always aware they are acting on a customer's behalf.
• Staff cannot "nest" impersonation — an impersonated session cannot start another.
• Permission checks always evaluate against the real staff identity, so staff-only privileges do not leak into the customer's session.

6.5 Your Right to the Audit Trail

On request, we will provide you with the complete audit log of any impersonation session involving your account, including who accessed it, when, and what actions were performed. Send your request to [email protected] and we will respond within 30 days, in accordance with your access rights under PIPEDA (Section 11).

7. AI-Powered Features

Adiuvo provides AI-powered features across its ecosystem of products, including content generation, risk assessment, and inter-agent communication. Access to AI features depends on your subscription plan.

7.1 AI Access by Plan

7.2 Shared LLM Pool (Professional, Business, Enterprise)

When you use AI features through Adiuvo's shared pool, your prompts are routed through our infrastructure to a third-party inference provider. Our shared-pool provider operates under a Zero Data Retention (ZDR) policy, meaning inference data is not retained by the provider after the response is delivered.

Platform Learning: By default, Adiuvo may retain and use anonymized or aggregated prompt and response data from shared-pool AI interactions to improve the accuracy, quality, and reliability of AI features across the Adiuvo platform. This data is stripped of personally identifiable information before use. You may opt out of platform learning at any time from your account settings. Opting out does not affect your access to AI features — your prompts will continue to be processed normally but will not be used for platform improvement.

We apply automated PII detection on shared-pool payloads before they reach the provider as a supplementary safeguard. You should not include sensitive personal data, financial data, health information, or authentication credentials in AI prompts when using the shared pool.

7.3 Bring Your Own Key (Business & Enterprise)

Business and Enterprise clients may provide their own API key from a supported LLM provider. When using BYOK mode, prompts are routed using your key. We do not store, inspect, or log prompt or response content. Your API key is encrypted at rest (AES-256) and decrypted only in memory at request time. You control the relationship with your chosen provider and are bound by their terms and privacy policy.

When using BYOK mode, Adiuvo does not store prompt or response content. Adiuvo may collect anonymized usage patterns and aggregate interaction metadata as necessary to maintain service quality, prevent abuse, and improve product features. You may opt out of non-essential data collection from your account settings.

7.4 Metadata Logging

For all AI requests, we log operational metadata only: request count, latency, token usage, timestamp, and provider. We never log prompt or response content. Metadata is retained for 90 days for billing and operational purposes.

AI Data Handling Policy: For complete details on data handling, prohibited data categories, liability allocation, and compliance considerations, please contact us at [email protected] to request a copy of our full AI Data Handling Policy.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. If you close your account, we will retain your data for a reasonable period to comply with legal obligations, resolve disputes, and enforce our agreements. Anonymized or aggregated data that cannot identify you may be retained indefinitely for analytics and product improvement purposes.

9. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential cookies — Required for the Service to function (authentication, session management)
• Analytics cookies — Help us understand how visitors interact with the Service so we can improve it
• Preference cookies — Remember your settings and preferences

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Service.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (TLS/SSL), secure server infrastructure, access controls, and regular security assessments. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Your Rights

Under PIPEDA and applicable Ontario law, you have the right to:

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate or incomplete information
• Withdrawal of consent — Withdraw your consent to the processing of your personal information (subject to legal or contractual restrictions)
• Deletion — Request deletion of your personal information, subject to our legal retention obligations
• Complaint — File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

12. International Data Transfers

Adiuvo's own infrastructure is located in Montreal, Canada. However, certain service providers used by the platform operate infrastructure in other jurisdictions. When you use AI features through our shared pool, prompts transit from our Canadian infrastructure to inference endpoints located in the United States. Where your personal information is transferred internationally, we ensure appropriate safeguards are in place to protect your data in accordance with PIPEDA.

Business and Enterprise clients using BYOK mode should assess international transfer requirements with their own chosen LLM provider.

13. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised effective date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Adiuvo

Kingston, Ontario, Canada

Email: [email protected]

Questions about how we handle your data?