DRAFT - for legal review before launch. Not yet in force. NEEDS OLIVER'S REVIEW.

Privacy Policy

Last updated: [DATE]. Operator: MONAD INDUSTRIES SOFTWARE CORP. ("we"). Contact / Privacy Officer: gillesolivieroffice@gmail.com.

1. What we collect

• Your answers: country and region, applicant type, stage, size, revenue band, sector, funding needs, hiring plans and, only if you choose, owner-group information (for example women-owned, Indigenous, veteran, disability). Owner-group answers are optional and used only to match programs.
• Student path: country and region, level and field of study, whether you want co-op or summer work or to start a business, optional age band and optional group information (same rules as above).
• Optional deadline reminders: only if you sign up, your email address and the ids of the programs you matched. Nothing else is stored with it (no answers, no group information). You can delete it any time with the “Delete my reminder email” button. Reminder sending is not switched on yet; no reminder emails are sent.
• An optional business plan (PDF, JPG or PNG, up to 3 files, 10 MB each). We check the file type from its contents.
• Done-for-you quote requests: only if you send one, your name, email, country, the service you are asking about, an optional deadline and what you write about your application. We store it so we can reply with a quote; the form itself sends no email. Ask us to delete it any time.
• Payment: handled by Stripe; we receive confirmation of payment, not your card details.
• Technical data: IP address for rate-limiting and security (short-lived), a session cookie.

1a. File uploads

• Each file is held in server memory only while we read it: PDFs by text extraction, photos by optical character recognition on our own server. The file itself is not sent to xAI or any other third party.
• Government ID numbers (SIN, SSN/ITIN, National Insurance numbers) and email addresses are removed from the extracted text. Only that redacted text is sent to xAI to suggest answers, which you confirm or change.
• Files are wiped from memory as soon as reading finishes and are never written to disk, a database or our logs.

2. Why

To provide the service you request (contract, GDPR/UK GDPR Art. 6(1)(b)); with your consent for optional owner-group information and file processing (PIPEDA; Quebec Law 25; GDPR Art. 9(2)(a) where it is special-category data); security and fraud prevention (legitimate interests); legal obligations (payment records).

3. Subprocessors and transfers

• xAI LLC (United States) - AI model (Grok) that reads redacted plan text and drafts application outlines from program facts and your non-identifying answers. Owner-group answers are not sent to xAI. We request no retention for training.
• Neon (Postgres, region [TBD]) - stores match results and, if you sign up, reminder email + matched program ids.
• Render (hosting, region [TBD]).
• Stripe (payments).

Quebec residents (Law 25): privacy impact assessment for transfers outside Quebec [TO COMPLETE]. EU/UK: transfers rely on Standard Contractual Clauses / the UK IDTA or Addendum [TO CONFIRM].

4. Retention

Uploads: deleted immediately after processing. Session state: memory, expires after 2 hours of inactivity. Match results: [12 months] then deleted, or sooner on request. Payment records: as required by law. Reminder sign-ups: until you delete them or [retention period TBD].

5. Your rights

Access, correction, deletion, portability, withdrawal of consent, objection and restriction (GDPR/UK GDPR); access and correction (PIPEDA); Quebec Law 25 rights. Matches are produced by fixed published-criteria rules and have no legal effect. Complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the UK ICO, or your EU supervisory authority.

6. Security

TLS, strict security headers, rate limiting, redaction before AI processing, no document storage.

7. Children

Not intended for users under 16 (13 in the US).