Quebec Law 25 compliance.

Responsible person

In accordance with section 3.1 of the Act respecting the protection of personal information in the private sector (chapter P-39.1), we have designated a person responsible for the protection of personal information:

Paul Arnac, CEO, Boréal Tech Solutions, Inc.

Email: privacy@borealtech.solutions

Address: Boréal Tech Solutions, Inc., Montreal, QC, Canada.

Information collected and purposes

To provide the Luna service to your business, we collect:

• Customer data (you): company name, contact, email, phone, payment information. Purpose: contract management and billing.
• Luna configuration: services, hours, FAQ, custom voice. Purpose: training the AI agent for your business.
• Caller data (your customers calling your Luna number): transcriptions, call metadata, approximate geolocation. Purpose: receptionist service execution.

Consent

Consent is obtained:

• For the customer (business subscribed to Luna): on signing the service contract.
• For callers: through an introduction message at the start of the call ("This call may be analyzed to improve service") or through your publicly posted privacy policy.

Consent may be withdrawn at any time, subject to ongoing contractual obligations.

Hosting

All primary data is hosted in Canada (Supabase, ca-central-1 region).

Technical subprocessors with transfers outside Canada (Stripe for payment, Anthropic for the AI engine, Twilio for telephony) are covered by contractual clauses equivalent to the Canadian protection standard, per section 17 of Law 25.

Privacy impact assessment (PIA)

Boréal completed a PIA covering the entire Luna service in September 2024. A PIA specific to your deployment (your business, your scenarios) is delivered with the setup.

On request, we can share the summary of the system PIA with your legal team under NDA.

Your rights under Law 25

You have the right to:

• Access information concerning you
• Request correction of inaccurate information
• Withdraw your consent
• Request portability (transfer to another provider, since September 2024)
• Be informed of any automated decision concerning you
• Request cessation of dissemination or de-indexing

Response time: maximum 30 days.

Recourse: Quebec Commission d'accès à l'information, cai.gouv.qc.ca.

Security and incidents

Technical measures: TLS 1.3 encryption in transit, AES-256 at rest, two-factor authentication, centralized logging, annual audits.

Organizational measures: least-privilege access, annual personal information protection training, incident registry.

In case of a confidentiality incident presenting serious risk, we notify the Commission d'accès à l'information and affected individuals as quickly as possible (target: 72 hours).

Retention

Call data is retained for 12 months by default, configurable up to 24 months or as little as 30 days. At the end of the period, data is irreversibly deleted.

Accounting data is retained for 7 years (tax obligation).

For any question

Responsible person: privacy@borealtech.solutions.