Privacy Policy

1. Privacy Officer

Altaris inc., located in Montreal (Quebec), Canada, is responsible for the protection of personal information collected through the altaris.ca platform. For any questions, contact us at: confidentialite@altaris.ca

2. Information Collected

We collect the following information:

• Identification: name, professional email, company name
• Diagnostic: responses to the AI maturity questionnaire, scores, recommendations
• Conversations: messages exchanged with the AI assistant during the diagnostic
• Technical: IP address (for consent purposes), aggregated usage data

3. Purposes of Processing

• Conduct the AI maturity diagnostic and generate personalized recommendations
• Improve the quality of our services and platform
• Communicate with you regarding your diagnostic (transactional and follow-up emails)
• Comply with our legal obligations

4. Consent

In accordance with Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information), we obtain your explicit consent before collecting and processing your personal information. This consent is obtained when you create your account and is timestamped.

You may withdraw your consent at any time by deleting your data from your dashboard or by contacting us.

5. Your Rights

Under Law 25, you have the following rights:

• Right of access: obtain a copy of your personal information (JSON export)
• Right of rectification: correct inaccurate information
• Right to erasure: request the deletion of your data
• Right to unsubscribe: stop receiving our email communications
• Right to withdraw consent: withdraw your consent to processing

To exercise these rights, access the "My Data" section of your dashboard or contact us at confidentialite@altaris.ca. We will respond within 30 days.

6. Data Retention

• Diagnostic data: retained as long as your account is active
• AI conversation data: retained for 12 months after the last activity
• Anonymized data for statistical purposes: retained indefinitely
• After account deletion: data anonymized within 30 days

7. Security

We implement technical and organizational security measures to protect your personal information:

• Data encryption in transit (TLS/HTTPS) and at rest
• Row-level security (RLS) policies in the database
• Request rate limiting
• Data hosted in Canada
• Data access restricted according to the principle of least privilege

8. Third-Party Processors and Transfers

Some of our processors may process your data as part of our services:

• Supabase: database hosting (Canada)
• Anthropic / OpenAI: artificial intelligence models for the diagnostic
• Resend: transactional email delivery
• Vercel: web application hosting

No personal information is sold or shared with third parties for marketing purposes.

9. Breach Notification

In the event of a privacy breach presenting a risk of serious harm, we will notify the affected individuals and the Commission d'accès à l'information du Québec (CAI) as soon as possible, in accordance with Law 25.

10. Changes

This policy may be updated. In the event of a substantial change, we will inform you by email or through the platform.

11. Contact

For any questions regarding this policy or your personal information: