Privacy policy.

1. Who we are

Boréal Tech Solutions, Inc. ("Boréal", "we") is a Quebec corporation headquartered in Montreal. We operate Luna, a bilingual AI receptionist platform offered to North American SMBs.

Person responsible for personal information protection: Paul Arnac, CEO. For any question, write to privacy@borealtech.solutions.

2. Information we collect

To provide the Luna service, we collect and process the following categories:

• Customer account: company name, contact name, email, phone, billing address, payment information (via Stripe).
• Luna configuration: services, hours, FAQ, scenarios, custom voice, connected integrations.
• Call data (on your Luna number): text transcriptions, metadata (time, duration, inbound number, approximate geolocation). Audio recordings are opt-in.
• Technical data: IP address, browser, device, event logs for security.
• Cookies and identifiers: utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, fbclid to measure ad attribution (boreal_utms cookie, 30 days).

3. Why we collect it

Information is used exclusively to:

• Provide, configure and improve the Luna service
• Authenticate users and secure accounts
• Issue invoices and process payments
• Measure acquisition channel performance (advertising, partners)
• Communicate with you about service evolution
• Comply with our legal obligations (Law 25, PIPEDA, accounting retention)

4. Hosting and transfers

Data is hosted in Canada by default. No transfer to the United States is performed without written agreement, except for certified subprocessors (Stripe, Anthropic) covered by contractual clauses equivalent to the Canadian federal standard.

5. Retention

Call data is retained for 12 months by default, configurable up to 24 months or as little as 30 days depending on your needs. Accounting data is retained for 7 years (tax obligation). UTMs are retained for 30 days in the browser cookie.

6. Sharing with third parties

We never sell your data. We only share with:

• Necessary technical subprocessors (Stripe for payment, Anthropic for the AI engine, Twilio for telephony, LiveKit for real-time, Resend for email, Supabase for storage)
• Legal authorities upon formal requisition only

All our subprocessors are bound by data processing agreements.

7. Your rights

Under Law 25 and PIPEDA, you have the right to:

• Access your data and obtain a copy
• Request correction of inaccurate information
• Withdraw your consent
• Request portability (transfer to another provider)
• Request deletion (subject to contrary legal obligations)
• File a complaint with the Quebec Commission d'accès à l'information or the Office of the Privacy Commissioner of Canada

Maximum response time: 30 days.

8. Security

TLS 1.3 encryption in transit, AES-256 at rest. Two-factor authentication available. Annual security audits. In case of an incident, we notify affected individuals within 72 hours per Law 25.

9. Cookies

We use essential cookies (authentication, cart, language preference) and measurement cookies (UTMs). Non-essential cookies respect your browser settings.

10. Changes

This policy may be updated. The date at the top indicates the current version. For significant changes, we notify you by email at least 30 days before they take effect.

11. Contact us

Questions, access requests or complaints: privacy@borealtech.solutions.

Boréal Tech Solutions, Inc. · Montreal, QC, Canada.