Privacy Policy

Introduction

Systèmes Telos Machina inc. ("Telos Machina", "we", "our") is committed to protecting the personal information of people who visit our website and do business with us. This privacy policy describes how we collect, use, retain, and protect your personal information, in compliance with Quebec's Act to modernize legislative provisions as regards the protection of personal information (Law 25).

By using our website or providing us with your information, you consent to the practices described in this policy.

1. Personal Information Collected

We collect only the information necessary for the purposes described in this policy. This information comes directly from you when you fill out our contact form or communicate with us.

Contact Form

• First and last name: to identify you and personalize our communications
• Email address: to respond to your inquiry
• Company name: to understand your business context
• Phone number (optional), if you wish to be contacted by phone
• Message: the description of your inquiry or project

Browsing Data

Our site is hosted by Cloudflare, which processes your IP address to route requests and protect the site from abuse. We measure traffic with Cloudflare Web Analytics, a tool that uses no cookies and no fingerprinting and shows us aggregate data only: pages viewed, country of origin, device type and browser. We collect no data that could identify you individually.

Cookies

Our website uses only essential cookies required for it to function: your theme preference (light or dark) and your language preference. We use no advertising, behavioural tracking or analytics cookies.

2. Use of Information

Your personal information is used for the following purposes:

• Responding to your information and consultation requests
• Preparing service proposals tailored to your needs
• Communicating with you in the context of a business relationship
• Improving our website and the experience it offers
• Fulfilling our legal obligations

We do not use your information for unsolicited commercial outreach without your prior consent. We do not sell, rent, or share your personal information with third parties for commercial purposes.

3. Third Parties

Your information may be shared with third parties in the following circumstances:

• Service providers: we use third-party vendors for the hosting and security of our website (Cloudflare) and, in the course of delivering our AI workflow architecture services, third-party cloud and AI infrastructure providers based in the United States. The section below describes this transfer specifically.
• Legal obligations: we may disclose your information if required by law or compelled to do so by a court order.

Cross-border transfer to our AI service provider

Your personal information may be communicated to Anthropic PBC, a company based in the United States. The content of the engagements we carry out for you is processed by the Claude AI system, which we use as a working tool to design and deliver our services. Personal information contained in the documents, emails, or data you entrust to us during an engagement may therefore pass through it. Processing takes place in the United States.

Anthropic PBC is bound to us by a Data Processing Agreement that contractually governs this communication. That agreement prohibits it from using your information to train its AI models and incorporates recognized standard contractual clauses for the protection of personal information. The processing nonetheless remains subject to United States law, including the CLOUD Act, under which US authorities can compel a US-based provider to produce information it holds.

Anthropic PBC is our only AI provider. We do not send your information to any other provider of artificial intelligence models.

Other communications outside Quebec

Two other US-based services handle information, for reasons unrelated to artificial intelligence:

• Google LLC (United States), for hosting our email and working documents on Google Workspace. Your name, email address, the content of our correspondence, and any attachments you send us are therefore stored there, including anything submitted through the contact form. This is the broadest communication on this list.
• Website analytics and operations tooling (Google LLC, Cloudflare). These handle aggregate browsing data, not the information you entrust to us during an engagement. They receive neither your emails nor your documents.

4. Data Retention

We retain your personal information for as long as necessary for the purposes for which it was collected, or as required by law, according to the following categories:

• Information processed in connection with a services engagement: destroyed once the purposes of the engagement are fulfilled, subject to any retention period imposed by law.
• Signed contracts and related accounting records (services agreements, invoices): retained for 6 years from the end of the relevant fiscal year, in accordance with Canada Revenue Agency record-keeping requirements.
• Contact-form inquiries that do not lead to an engagement: destroyed no later than 24 months after our last exchange.

Upon expiry of the applicable retention period, your information is securely destroyed or anonymized.

5. Your Rights (Law 25)

Under Law 25, you have the following rights regarding your personal information:

• Right of access: you may request to consult the personal information we hold about you.
• Right of rectification: you may request the correction of inaccurate, incomplete, or ambiguous information.
• Right to portability: you may request that your information be provided to you in a commonly used technological format.
• Right to erasure: you may request the destruction of your information in the circumstances provided by law.
• Right to de-indexing: you may require that dissemination cease, or that a hyperlink giving access to your personal information be de-indexed, when that dissemination contravenes the law or a court order, or causes you serious injury that outweighs the public's interest in knowing that information.
• Right to explanation: if a decision concerning you is made on the basis of automated processing, you may request that the decision be reviewed by a person (see Section 6).
• Withdrawal of consent: you may withdraw your consent to the use of your information at any time, subject to legal and contractual restrictions.

To exercise any of these rights, please contact our Privacy Officer (see Section 9). We respond to every request within 30 days, as required by sections 27 and 28 of Law 25.

6. Automated Decision-Making

Telos Machina does not use fully automated processing, without human involvement, to make a decision about you. Our AI-assisted workflows support our decisions; they do not make them alone.

Should this change, we would inform you at the time of the decision, as required by section 12.1 of Law 25. On request, you could then: be informed of the personal information used to reach the decision, learn the main factors and parameters that led to it, and raise your comments with a person able to review the decision.

7. Who Has Access to Your Information

Telos Machina is a two-founder company. Only the co-founders have access to the personal information collected through this website, to the extent necessary to manage the business relationship. The Privacy Officer is identified in Section 9. As of the date of this policy, no additional employee or contractor has access to it.

8. Security

We implement reasonable administrative, technical, and physical security measures to protect your personal information against unauthorized access, disclosure, modification, or destruction.

In practice:

• Encryption in transit: all traffic to our website and to the systems that handle your information is encrypted in transit. Our internal servers are reachable only over an encrypted private network, never directly from the public internet.
• Access control: only the two founders have access to systems holding personal information. Each client's data is isolated from every other client's, and access is granted service by service rather than across the board.
• Credential management: the access keys and passwords for our services are held in a managed secrets vault, never in a configuration file, a code repository, or an email.
• Encryption at rest: information held by our hosting and database providers is encrypted at rest by those providers.

In the event of a privacy incident presenting a serious risk of harm, we will notify the Commission d'accès à l'information du Québec and the affected individuals, in accordance with our obligations under Law 25.

9. Privacy Officer

In accordance with section 3.1 of Law 25, Systèmes Telos Machina inc. has designated a Privacy Officer:

Write to this address with any question about the protection of your personal information, or to exercise any of the rights described in section 5. We respond within the timeframes required by law.

10. Complaints

If you believe your personal information has not been handled in accordance with this policy or with Law 25, please first address your complaint to our Privacy Officer (Section 9). We acknowledge receipt of your complaint and aim to respond within 30 days.

If you are not satisfied with how your complaint was handled, or if you prefer to contact the oversight authority directly, you may file a complaint with the Commission d'accès à l'information du Québec (CAI):

11. Changes to This Policy

We reserve the right to modify this privacy policy at any time. The most current version will always be available on this page, with the date of the last update. We encourage you to review this page regularly.

In the event of a material change, we will notify you by email (if we have your address) or by a prominent notice on our website.

12. Applicable Law

This policy is governed by the laws of the Province of Quebec and the applicable federal laws of Canada, in particular the Act to modernize legislative provisions as regards the protection of personal information (Law 25) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

Any dispute relating to this policy shall be submitted to the exclusive jurisdiction of the competent courts of Quebec.