Privacy Policy

1. Introduction

How AI Connects Inc. ("we", "our", "us") operates the AI Governance platform. This Privacy Policy explains what information we collect when you use the alpha service, how we use it, and the controls you have over it.

2. Information We Collect

We collect information you provide directly:

• Account information (name and email address from your chosen sign-in provider)
• GitHub repository metadata when you connect a repository for scanning
• Scan inputs you submit (configuration choices, custom policies you upload)
• The content of messages you send in the product

We also collect information automatically:

• Operational logs (request paths, status codes, timestamps)
• Telemetry needed to operate the service and improve reliability

When you run a scan or use the assistant, we send your content to AI model providers to produce the result. See section 4a.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the service
• Authenticate you and gate access to your own data
• Perform the scans and analyses you request
• Respond to your support requests
• Detect, investigate, and prevent abuse
• Assess whether our checks are actually working
• If you opt in under section 7 of the Alpha Agreement, write general rules from what we find in your work

We do not sell your data. We do not train models on your repository contents or your scan inputs.

Writing a general rule in our own words is not model training.

4. Data Storage & Security

Your account data and findings are stored in Canada — AWS ca-central-1 and Supabase ca-central-1 — and are gated by row-level security so other customers cannot access them. Access by our staff is limited to operational necessity. We use industry-standard transport security (TLS) for data in transit and at-rest encryption provided by our cloud storage providers.

4a. AI Processing & Cross-Border Transfer

We do not use your content to train AI models. To do what you ask it to do, the alpha sends your content to AI model providers who process it for us. Today those are Amazon Web Services, Inc. (Amazon Bedrock, which runs the Anthropic Claude models we use) and NVIDIA Corporation (hosted inference for open models). Both process your content in the United States, where it is subject to United States law, including access by United States authorities under that law.

We send your content to these providers only to produce the result you asked for. We will notify you by email, and update this policy, at least 30 days before we add or change a provider that processes your content. If you do not want your content processed outside Canada, do not use the alpha.

5. Data Retention

Alpha-period retention defaults: account data is retained while your account is active and for 30 days after you stop using the service. Operational logs are retained for 90 days. Scan findings are retained for as long as your account is active. General rules derived under the optional permission in section 7 of the Alpha Agreement are kept indefinitely, and are deleted if you withdraw that permission.

6. Sub-processors

We use a small set of named providers to operate the service:

• Amazon Web Services — hosting, Canada; Bedrock inference, United States
• Supabase — auth and database, Canada
• NVIDIA — inference, United States
• GitHub — repository access, United States
• Cloudflare — network and DNS

We will publish any addition here at least 30 days before it takes effect.

7. Your Rights

You may request a copy of the personal information we hold about you, ask us to correct inaccurate information, or ask us to delete your data. You may also withdraw the optional permission you gave under section 7 of the Alpha Agreement at any time. Send requests to [email protected]. We will respond within 30 days.

8. Changes

We will publish changes here. Where a change adds a purpose for which we use your information, or adds a provider that processes your content, we will give at least 30 days' notice and ask you to accept the new version of the Alpha Agreement before it applies to you. Changes apply only from the date you accept them.

9. Contact

Questions about this policy can be sent to [email protected].