Privacy policy

Who is responsible

What data we process

The private AI agent service may see or process the following types of data, depending on what the client connects:

• Contact data (name, email, phone, company)
• Messages, requests and exchange histories with clients
• Content, files and instructions provided by the client
• Technical data (logs, IP addresses, session identifiers)
• Business data (leads, notes, invoices, statuses)
• Technical secrets (API keys, tokens, access) — only if necessary for the service

Why and on what basis

Data is processed to provide the agreed service: installation, configuration, support and light managed hosting of the AI agent. The client determines the purposes and remains responsible for the legality of collecting and using their own data.

Minimization and security

• We limit processed data to what is necessary for the service.
• Secrets (passwords, API keys, tokens) are transmitted through a reasonably secure channel and stored in an approved vault or manager — never published or exposed.
• Access to your systems is used only to provide the service, fix a problem or execute an authorized request.
• At contract end, unnecessary access must be revoked or renewed by the client.

Communication outside Quebec and third parties

The service may use cloud tools, APIs, AI models or hosting located outside Quebec. The client acknowledges that processing outside Quebec may be possible. Before using such tools with personal information, we document the provider, the data involved, the processing region and reasonable protections.

Your rights

Under Law 25, you may request access, correction or deletion of your personal information, or withdraw consent. We cooperate reasonably with requests concerning data we manage.

• To exercise a right: write to info@reponsespretes.com.
• We respond within a reasonable time. Complex or disputed requests may require validation by legal counsel.

Security incidents

In case of unauthorized access, API key leak or any breach of confidentiality, we notify the client promptly and cooperate to limit risks. The client determines, with their privacy officer or legal counsel, whether a declaration to the Commission d'accès à l'information is necessary.

Written contract

Any Private AI Service engagement is covered by a written service contract (scope, virtual machine access, data, confidentiality, liability and support) provided and signed before work begins. No amount is billed without a contract and prior agreement.