--- title: "Privacy Policy for Canadian AI Services | EluxAI" url: "https://eluxai.com/legal/privacy-policy/" description: "How EluxAI collects, uses and protects personal information under PIPEDA and Quebec Law 25, including call recording, AI processing, consent and your rights." --- # Privacy Policy for Canadian AI Services | EluxAI # Privacy policy How EluxAI collects, uses, discloses, retains and protects personal information on our website and in the AI agents we run for businesses across Canada. Last updated: September 12, 2026 ## About this policy This policy explains how EluxAI, a Canadian-owned AI company in Markham, Ontario, handles personal information. We follow the Personal Information Protection and Electronic Documents Act, known as PIPEDA. For Quebec residents, we also follow Quebec's private sector privacy law as amended by Law 25. This policy covers two situations. The first is information we collect for our own purposes, such as when you visit our website, submit our contact form or become a client. The second is information our agents process for clients about their own customers, where we act as a service provider. Sections 1 to 10 follow the 10 fair information principles in Schedule 1 of PIPEDA. ## 1\. Accountability EluxAI is responsible for the personal information under our control. We have designated a Privacy Officer who is accountable for our compliance with Canadian privacy law. For Quebec law, the Privacy Officer is also the person in charge of the protection of personal information. You can write to the Privacy Officer at [innovation@eluxai.com](mailto:innovation@eluxai.com "Email innovation@eluxai.com"). ### When we act for our clients When a business hires EluxAI to answer its calls, texts or email, or to run other agents, that business decides why and how its customers' information is used. The client remains the organization accountable for that information. We process it only on the client's instructions and only for the services the client engaged us to perform. If you are a customer of one of our clients, send access or correction requests to that business first. If you contact us instead, we will forward your request to the client. ### Service providers and processing outside Canada We use service providers for functions such as telephone and messaging networks, cloud hosting, email delivery and AI model processing. Our contracts require them to protect personal information and use it only to perform services for us. Our platform is local-first and can run language and speech models on NVIDIA GPU servers located in Canada. Some service providers may still store or process personal information outside Canada, including in the United States. That information is then subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. Clients who need information to remain in Canada can ask about data residency options before a deployment starts. For Quebec residents, we assess privacy risks before personal information is communicated outside Quebec, as Law 25 requires. ## 2\. Identifying purposes We identify why we collect personal information before or when we collect it. In client deployments, the client sets the purpose and informs its customers. ### Information we collect on our website Our contact form asks for your name, company, email address, phone number, the service you are interested in and a message. Name and email are required, and you must tick a consent box before sending. We use this information to reply to your request, prepare an assessment and keep a record of our conversation. Our hosting servers also record technical information when you visit, such as your IP address, browser type, pages requested and the time. We use these logs to keep the site secure and fix errors. Our website does not currently set analytics or advertising cookies, as our [cookie policy](/legal/cookie-policy/ "Cookie policy") explains. ### Information we collect from clients When you become a client, we collect business contact and billing details, plus the instructions, documents and account access you share. We use them to deliver the services, invoice you and meet our legal and tax obligations. ### Information processed in client deployments Our agents may handle information about our clients' customers and contacts. Depending on the services a client uses, this can include: - Names, phone numbers, email addresses and the content of calls, voicemails, text messages and emails. - Call recordings, transcripts and summaries created from those conversations. - Photos and files that people send by text or email, such as a picture of a leaking pipe. - Documents the client adds to its private AI knowledge base. - Technical information about systems the client authorizes us to test for security weaknesses. We use this information only to perform the services the client requested, following the client's instructions and approval rules. ## 3\. Consent We obtain meaningful consent to collect, use and disclose personal information, unless the law permits otherwise. The form of consent depends on how sensitive the information is and what you would reasonably expect. On our website, you give express consent by ticking the consent box on our contact form before you submit it. In client deployments, our client is responsible for obtaining any consent its customers must give. Our [terms of service](/legal/terms-of-service/ "Terms of service") require clients to do so for the calls, texts and emails they direct our agents to handle or send. ### Withdrawing consent You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Email our Privacy Officer and tell us what you want us to stop. We will explain any consequences, such as being unable to answer an open request. ### Call recording and transcription notice Calls answered or placed by EluxAI agents may be recorded and transcribed. Recordings and transcripts help the agent understand the caller, create accurate tickets and messages, and let the business review what was said. Our clients must give callers notice of recording, and we can set the agent to announce it at the start of each call. If you do not want your call recorded, you can end the call and contact the business another way, such as by email. Voicemails left with an agent are also transcribed. ### Commercial electronic messages and unsubscribing We send commercial electronic messages only with your express or implied consent, as Canada's Anti-Spam Legislation, known as CASL, requires. Each message identifies EluxAI, includes our contact information and contains an unsubscribe mechanism that is free and easy to use. We act on unsubscribe requests without delay and within the 10 business days CASL allows. You can also unsubscribe by emailing [innovation@eluxai.com](mailto:innovation@eluxai.com "Email innovation@eluxai.com"). We may still send messages you need about an active request or engagement, such as invoices, service notices or security alerts. ## 4\. Limiting collection We collect only the personal information we need for the purposes we have identified. Our contact form keeps required fields to a minimum, and we ask clients to share only the data an agent needs to do its job. We collect information by fair and lawful means, never under false pretences. When we design an agent, it asks only for details that serve the task, such as a callback number or service address. ## 5\. Limiting use, disclosure and retention We use and disclose personal information only for the purposes we collected it for, unless you consent to a new purpose or the law requires or permits it. We keep personal information only as long as needed for those purposes and our legal obligations. We do not sell personal information. ### AI processing and automated decisions Our agents use artificial intelligence to understand speech and text, summarize conversations, draft replies, sort requests and suggest next steps. The platform runs on NVIDIA GPUs, and some processing may use outside AI model providers under contract. We do not use one client's data to train models for another client without written permission. Agents work under approval rules that our clients control. Actions that carry risk, such as sending sensitive replies, publishing content or changing records, can require a person to approve them first. Agent actions are written to an audit log, and clients can stop agents at any time with a kill switch. We do not make decisions with legal or similarly significant effects on individuals based only on automated processing. If a client configures an agent to make such a decision, the client must inform the people affected and offer human review. ### When we disclose information We may disclose personal information to: - Service providers who perform services for us under contracts that protect the information. - Our clients, when we collected the information on their behalf. - Professional advisers, such as lawyers and accountants, who owe us duties of confidentiality. - A buyer or successor in a business transaction, under an agreement that protects the information. - Courts, regulators or law enforcement, when the law requires or permits disclosure. ### How long we keep information We keep contact form submissions for up to 24 months after our last communication with you, unless you become a client. We keep client business records for the length of the engagement and then for the period tax and corporate laws require. We keep server logs only as long as security and troubleshooting need. In client deployments, the client sets retention periods for recordings, transcripts, messages and knowledge base documents. At the end of an engagement, we return or delete client data as the contract requires, subject to backup cycles and legal holds. When information is no longer needed, we securely delete it or make it anonymous. ## 6\. Accuracy We keep personal information as accurate, complete and up to date as its purpose requires. You can ask us to correct information about you at any time. Transcripts and AI summaries can contain mistakes, such as a misheard phone number. Clients can review and correct them and check the original recording before relying on a summary. ## 7\. Safeguards We protect personal information with security safeguards suited to its sensitivity. These physical, organizational and technical measures are designed to prevent loss, theft and unauthorized access, disclosure, copying, use or modification. No system is perfectly secure, so we keep improving them. They include: - Encryption of information in transit between browsers, devices, our platform and our service providers. - Access controls that limit personal information to the people and agents who need it for their role. - Isolated workspaces, so each client's data, agents and knowledge base stay separate from other clients. - Audit logs that record agent actions and administrative access. - Confidentiality obligations and privacy training for our team. ### Breach notification If a breach of security safeguards creates a real risk of significant harm to someone, we report it to the Office of the Privacy Commissioner of Canada. We also notify affected individuals as soon as feasible and inform other organizations that can reduce the risk of harm. We keep a record of every breach of security safeguards for at least 24 months, as PIPEDA's breach rules require. For Quebec residents, we report confidentiality incidents that present a risk of serious injury to the Commission d'accès à l'information and to the people affected. When a breach involves data we process for a client, we notify that client promptly and support its own notification duties. ## 8\. Openness We make information about our privacy practices easy to find and understand. This policy is linked from every page of our website. You can ask our Privacy Officer for more detail about our practices, the types of service providers we use or how a specific service handles personal information. ## 9\. Individual access You have the right to know whether we hold personal information about you, to access it and to learn how it has been used and disclosed. Send your request to our Privacy Officer. We respond within 30 days and will tell you if we need more time or cannot share certain information, and why. We may ask you to confirm your identity first. Access is free in most cases, and we will tell you about any fee in advance. You can challenge the accuracy of your information and ask us to amend it. ### Rights for Quebec residents under Law 25 If you live in Quebec, Law 25 gives you additional rights under Quebec's private sector privacy law. You can exercise them by writing to our Privacy Officer, and we respond within 30 days. - **Access.** You can ask to see the personal information we hold about you and receive a copy. - **Rectification.** You can ask us to correct information that is inaccurate, incomplete or ambiguous. You can also ask us to delete information collected or kept without legal authority. - **De-indexation.** You can ask us to stop disseminating your personal information or to de-index a hyperlink attached to your name. This applies when dissemination seriously harms your reputation or privacy, as the law describes. - **Portability.** You can ask for computerized personal information you gave us in a structured, commonly used technological format. You can also ask us to send it to a person or organization you choose. - **Notice of automated decisions.** If a decision about you is based only on automated processing, you will be told at or before the time of the decision. On request, you can learn what information was used and the main reasons and factors behind the decision. You can have that information corrected and submit observations to a person who can review the decision. When a client makes an automated decision using our agents, that client gives this notice and review. ## 10\. Challenging compliance You can challenge our compliance with this policy or with privacy law. Start by writing to our Privacy Officer and describing your concern. We investigate every complaint, tell you the outcome and change our practices or policies when a complaint is justified. If you are not satisfied with our response, you can file a complaint with the [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/ "Office of the Privacy Commissioner of Canada"). Quebec residents can also complain to the [Commission d'accès à l'information du Québec](https://www.cai.gouv.qc.ca/ "Commission d'accès à l'information du Québec"). ## Children Our website and services are designed for businesses, not children. We do not knowingly collect personal information from anyone under 16 through our website. If you believe a child has sent us personal information, contact our Privacy Officer and we will delete it. When a client's agents receive messages from minors, the client handles that information under the law and its own policies. ## Changes to this policy We update this policy when our practices, our services or the law change. The date at the top of this page shows when it last changed. If we make a significant change to how we use personal information, we will post a notice on our website and ask for your consent again where the law requires. ## Contact our Privacy Officer Send privacy questions, access or correction requests and complaints to our Privacy Officer. People answer Monday to Friday, 9 a.m. to 6 p.m. Eastern. - Email: [innovation@eluxai.com](mailto:innovation@eluxai.com "Email innovation@eluxai.com") - Phone: [(289) 800-1722](tel:+12898001722 "Call EluxAI at (289) 800-1722") - Location: Markham, Ontario, Canada You can also send a message through our [contact page](/contact/ "Contact EluxAI"), or return to our [legal information hub](/legal/ "Legal information").