Privacy Notice
Effective October 20, 2026 · Last updated October 20, 2026
1. Who we are
AutoDoc Solutions Inc. (“AutoDoc”, “we”, “our”, “us”) provides research-and-development documentation and tax-credit claim automation services. We are a Canadian company and our production systems run in Canada.
This notice explains what personal information we handle, why, who else is involved, where it is processed, how long we keep it, and what rights you have. It covers our website, our dashboard at dashboard.autodocai.io, our AI workspace, and our evidence pipeline.
2. Our role: processor for customer data, controller for our own
This distinction determines who you should contact about your information.
- For our customers’ data we are a processor (a “service provider”). When a company engages us, it decides what we process and why; we act on its instructions and for no other purpose. If you are an employee or contractor of one of our customers and your name appears in that company’s code commits, project tickets or personnel roster, your employer is the controller and you should direct requests to it. We will support it in responding, and we will forward any request we receive to its named contact within 2 business days.
- For our own business data we are the controller — prospect and customer contact details, account and billing records, and personnel records. For those, contact us directly using section 11.
3. Information we handle
As controller (our own business)
- Contact information you give us: name, work email, company, phone number.
- Account and billing records.
- Personnel and contractor records for our own people.
As processor (on a customer’s instruction)
- Developer identifiers — author names and email addresses in git commit metadata, and branch or pull-request author names, from repositories the customer authorises us to clone.
- Project-management content — ticket reporter and assignee names, page and document authors, from Jira, Confluence, Notion or Shortcut connections the customer authorises.
- Personnel roster data — name, role, employment dates and project allocation from a roster the customer uploads.
- Platform accounts — email address, user ID, organisation membership and role for users the customer’s administrator creates.
- Operational records — job and session metadata, and audit logs recording user ID, action, outcome and source IP address.
What we do not handle
The product has no need for, and we do not process: government identifiers, health or medical records, financial account numbers, biometrics, race or ethnicity, religion, sexual orientation, trade-union membership, or precise location.
Compensation amounts are excluded by design, not by policy. Our payroll reader discards every money-bearing column as it reads a roster, and every monetary figure in a generated document is emitted as a placeholder for a human consultant to complete. Salary figures do not enter our systems.
4. Why we handle it
- To produce a customer’s documentation. Identifying who performed qualifying research work, and assembling contemporaneous evidence of it, is the service. This is the only purpose for which customer content is used.
- To operate and secure the service — authentication, authorisation, support, audit logging, and detecting unauthorised access.
- To communicate with you about our services, and to respond to enquiries you send us.
- To meet legal obligations.
Our lawful basis, where one is required, is the performance of our contract with the customer for processor activities, and legitimate interest or your consent for our own business contacts.
5. We never use customer content to train models
We do not use customer content to train, fine-tune, or evaluate any AI model. We never have, and no customer needs to opt out, because it is not something we offer to do.
Specifically, we will not:
- train, fine-tune or evaluate any model on customer content;
- use customer content to improve the product outside that customer’s own engagement;
- aggregate or anonymise customer content for benchmarking, analytics or marketing;
- claim any ownership of or licence to customer data beyond what delivering the contracted service requires.
This is enforced architecturally as well as contractually. All AI inference runs on Amazon Bedrock, which does not retain inputs or use them to train its models. Our own accuracy measurement runs against an invented company with fabricated data, specifically so that no customer content is ever used for measurement. We also do not use customer content to make automated decisions about any individual; our output is a draft document for human review.
6. Where your information is stored and processed
Storage: Canada, without exception
Customer data at rest never leaves Canada. Every customer datastore — object storage, databases, logs and backups — is in the AWS Canada (Central) region in Montréal. No cross-region replication is configured on any of them, and backups are held in a single Canadian vault with no copy to any other region.
AI processing: may occur outside Canada, and is set per customer
We want to be precise here rather than reassuring, because the honest answer is not a simple one.
Large AI models are not offered in a Canada-only configuration by any provider available to us. The Anthropic Claude models our pipeline uses cannot currently be run inside Canada at all — we attempted to configure Canada-only inference and the platform does not support it for these models. So when our automated pipeline analyses evidence, excerpts of that content may be processed by Amazon Bedrock in regions outside Canada.
How that is controlled:
- The permitted regions are a per-customer setting, chosen with that customer, and may be set to United States regions, European regions, or any AWS commercial region.
- The setting must be set explicitly before a run is permitted. There is no default. A pipeline run is refused outright if no region route has been chosen, so cross-border processing cannot happen by accident or by omission.
- Only excerpts are sent as part of a model request, and the model provider retains nothing. Nothing is stored outside Canada.
- Our assistant feature currently processes its requests in a United States region.
- A customer that requires no processing whatsoever outside Canada cannot today be served by the automated large-model pipeline. We tell prospective customers this before contracting rather than after.
Our interactive AI workspace sessions are configured for Canadian-only inference and are not in service at the time of this notice.
Under PIPEDA, transfers for processing are permitted and we remain accountable for information we transfer. Our transfers rely on our agreement with Amazon Web Services, which incorporates the European Standard Contractual Clauses, together with the UK Addendum where applicable. For Quebec, we assess transfers outside the province before they occur, as Law 25 requires.
7. Who else is involved (subprocessors)
We use a small number of service providers. This is the complete list of those that can access customer data or operate our production systems.
| Provider | What it does | What it can access | Location |
|---|---|---|---|
| Amazon Web Services, including Amazon Bedrock and AWS Amplify | All production infrastructure — compute, storage, databases, encryption, backups — plus all AI model inference and dashboard hosting | All categories, inside our own encrypted and isolated account. Bedrock receives model-request excerpts and retains nothing | Canada for storage; see section 6 for inference |
| GitHub (Microsoft) | Hosts our own source code and issues the short-lived tokens used to clone customer repositories | Our source code and build metadata. Customer repositories are cloned from customer-controlled accounts into ours; we hold the access tokens the customer grants | United States |
| Atlassian (Jira, Confluence) | Project-management integration, connected only on a customer’s authorisation | That customer’s project-management content and connection tokens | Per Atlassian’s regions |
| Notion | Project-management integration, connected only on a customer’s authorisation | That customer’s workspace content and connection tokens | United States |
| Shortcut | Project-management integration, connected only on a customer’s authorisation | That customer’s project content and connection tokens | United States |
| Google Workspace (Google) | Our corporate email, documents and device management | Business correspondence and our own personnel records. Customer content only if a customer emails it to us | United States and global |
Atlassian, Notion and Shortcut are connected per customer, and only when that customer chooses to connect them. We never connect a customer’s project-management tools on our own initiative, and each customer’s credentials are stored separately and are never returned by our API.
We use no AI model provider other than Amazon Bedrock. This is a constraint on our architecture, enforced by an automated test that fails our build if another provider is introduced.
Changes to this list
Before we engage a new subprocessor with access to customer data, or replace an existing one, we give every affected customer 30 days’ advance written notice naming the provider and what it would access. A customer may object within that period, and if the objection cannot be resolved it may terminate the affected service without penalty. Only then is access granted. Removing a provider requires no notice period and is reported at our next review.
8. How long we keep it
Specific periods, rather than “as long as necessary”.
| Information | Retention period |
|---|---|
| Cloned repository content | Duration of the engagement, plus 30 days after offboarding |
| Project-management content extracted from an integration | Duration of the engagement, plus 30 days after offboarding |
| Documents a customer uploads | Duration of the engagement, plus 30 days after offboarding |
| Generated reports and documentation | Duration of the engagement, plus 30 days after offboarding |
| Job and processing metadata | 90 days after the job completes, then deleted automatically |
| AI workspace session records | 90 days after the session ends, then deleted automatically |
| Application and system logs | 1 year |
| Security and audit logs | 1 year |
| Backups | 35 days, in Canada only |
| Platform user accounts | Until removed by the customer’s administrator or at offboarding |
| Prospect and marketing contact details (we are controller) | Until you ask us to stop, or 24 months of inactivity |
| Our own personnel records (we are controller) | As required by employment-records law |
A customer may request earlier deletion at any time. Because each customer’s content is held in storage dedicated to that customer, deletion is a scoped operation rather than a search across shared systems, and we confirm it in writing when it is complete.
9. How we protect it
These are measures we have implemented, not intentions. We describe them plainly because overstating security is itself a privacy problem.
- Encryption. Customer data is encrypted at rest with customer-managed encryption keys under our control, with automatic key rotation enabled, and in transit with TLS.
- Separation between customers. Each customer gets dedicated, separately encrypted storage and its own access role. Our processing components hold no standing access to customer storage; they must assume a role scoped to one customer at a time.
- Access decided on the server. Every request is authorised against membership recorded on our side. A request naming an organisation the user does not belong to is refused, never silently redirected.
- Multi-factor authentication is required for every account on our platform, with a 12-character minimum password length.
- Credentials are never exposed. Integration credentials are held in a managed secrets service and are never returned by our API; secret-shaped values are stripped from logs.
- Logging and monitoring. Privileged actions are audit-logged, with account-wide audit logging, continuous threat detection and configuration monitoring enabled, and alerting to a monitored address.
- Backups. Daily backups with 35-day retention, in an access-locked vault in Canada.
- Reviews. We verify our controls monthly and review access quarterly, and we keep the dated output of both.
We are candid about the limits: no system is perfectly secure, we cannot guarantee absolute security, and we do not currently hold a completed independent third-party security certification such as SOC 2 or ISO 27001. We are working toward a SOC 2 examination and will not describe ourselves as certified until an auditor says so. Our major infrastructure providers do hold such attestations.
10. Your rights
Depending on where you live, you may have the right to access your personal information, correct it, ask for it to be deleted, obtain a portable copy, object to or ask us to restrict how it is handled, withdraw consent you previously gave, and not be subject to a decision made solely by automated means. You may also complain to a regulator — in Canada, the Office of the Privacy Commissioner of Canada, or the Commission d’accès à l’information for Quebec.
Where to send a request. If your information is in a customer’s data — for example your name in your employer’s code or tickets — please contact your employer, which controls that data and decides such requests. If you contact us instead, we will forward your request to its named contact within 2 business days and tell you that we have.
For information we hold as controller, contact us using section 11. We acknowledge within 2 business days and respond within 30 days. We do not charge for a first request and we will not treat you differently for making one.
Cookies and tracking. We do not set advertising or cross-site tracking cookies. The storage we use is strictly necessary to sign you in and keep your session working.
11. Contact us
Our privacy lead is accountable for this notice, for our handling of personal information, and for breach assessment and notification decisions.
Privacy and data-protection enquiries, and individual-rights requests:
Email: privacy@autodocai.io
Attention: Privacy Lead
General enquiries: hello@autodocai.io
By post:
AutoDoc Solutions Inc.
643 Ceremonial Dr.
Mississauga, ON L5R 3H9
Canada
12. If something goes wrong
If a security incident affects, or is reasonably likely to affect, a customer’s data, we notify that customer within 24 hours of confirming it, and provide substantive detail within 72 hours, updated as our investigation continues. We notify the relevant regulator as soon as feasible where the law requires it, and we support the controller in notifying affected individuals.
13. Changes to this notice
We may update this notice. When we do, we change the “Last updated” date above and post the new version here. For a change that materially affects how we handle customer data — including adding a subprocessor — we notify affected customers directly and in advance, as described in section 7.