Français

DRAFT — requires review by Canadian privacy counsel before publication. Not in force.

Nysroc Privacy Policy

Version: 0.9 (draft) · Last updated: 1 November 2026 · Effective: [DATE OF PUBLICATION]
Other languages: Français (Canada)
Related documents: Privacy summary · Cookie and tracking notice · Sub-processors · Customer Data Processing Addendum (DPA) · Terms of Service

Contents

1. Who we are and what this policy covers
2. Our privacy commitments
3. Our two roles: when we decide, and when our customers decide
4. The personal information we handle
5. Where the information comes from
6. Why we use it, and our legal grounds
7. Consent and your choices
8. Nysroc AI (artificial intelligence)
9. Automated decisions and profiling
10. Website analytics, cookies and advertising measurement
11. Who we share information with
12. Where information is stored, and transfers outside Canada
13. How long we keep information
14. How we protect information
15. Privacy incidents and breaches
16. Your rights and how to use them
17. Province-, country- and state-specific information
18. Health information and HIPAA
19. Children
20. Marketing messages and Canada's anti-spam law (CASL)
21. What we expect of our customers
22. Other companies' services and links
23. Changes to this policy
24. Contact us, our privacy officer, and how to complain

Annex A — How we meet the ten fair information principles (PIPEDA)
Annex B — United States: categories of personal information (CCPA/CPRA table)

1. Who we are and what this policy covers

Nysroc is an all-in-one business platform for Canadian small businesses: website builder and hosting, accounting, point-of-sale connections, CRM, help desk, business phone, files, advertising, video and other tools, delivered as one online service ("the Service").

Nysroc is operated by Scopien Technologies Inc., a corporation registered in Ontario, 300-416 North Service Road East, Oakville, Ontario L6H 5R2, Canada ("Nysroc", "we", "us", "our").

Where the Service is offered. At launch Nysroc is offered only to businesses located in Canada and the United States; sign-up accepts only a Canadian province or territory or a US state. We do not offer the Service to customers in the European Union, the European Economic Area, Switzerland or the United Kingdom. The GDPR and UK GDPR passages in this policy describe how we will handle information if that changes, and apply today only where those laws apply to information we hold anyway (for example a visitor from Europe who contacts us).

This policy explains how we collect, use, disclose, keep and protect personal information when you:

• visit nysroc.com or any of its pages, or contact us;
• sign up for, sign in to, pay for or manage a Nysroc account;
• use the Service in a Nysroc workspace (for example at yourbusiness.nysroc.com/app or on your own domain), the website editor, Nysroc Ads, Nysroc Video, Nysroc Phone or Nysroc AI;
• visit a website that one of our customers built and hosts on Nysroc (limited to what is described in sections 3 and 10);
• contact our support team, chat with our support assistant, or take part in our events, surveys or research.

What this policy does not cover. It does not describe how our customers (the businesses using Nysroc) handle their customers' information; each business is responsible for that and should have its own privacy notice (see section 3). It does not cover the separate services of companies you connect to Nysroc yourself (for example your own Square, Clover, Stripe, Google Ads, Meta or Microsoft Advertising account), which have their own policies. Information about our own employees and job applicants is covered by separate notices.

Words we use. "Personal information" means information about an identifiable individual (called "personal data" in some laws). A "customer" is a business or organisation with a Nysroc account. A "user" is a person who signs in to a customer's account. An "end user" is a person whose information a customer puts into or collects through Nysroc — for example a customer's own clients, callers, website visitors, employees or suppliers. "Customer Data" means the content and personal information a customer and its users put into or collect through the Service.

2. Our privacy commitments

These are promises, and the rest of this policy explains how we keep them:

1. We do not sell or rent personal information, and we do not "share" it for cross-context behavioural advertising. We have not done so in the past 12 months.
2. Your business data is yours. We use Customer Data only to provide the Service as you instruct, to keep it secure, and to meet legal obligations. You can export it at any time and take it with you.
3. No third-party trackers on the sites we host. Websites built on Nysroc use only our first-party measurement script, served from the site's own domain. Advertising measurement is off until a visitor says yes, and Global Privacy Control and Do Not Track signals are honoured automatically.
4. We never see card numbers. Payment cards for Nysroc subscriptions are entered only on our payment processor's page.
5. Nysroc does not train AI models on Customer Data. Section 8 explains, plainly, where our managed AI provider processes data and what you can choose instead.
6. Canada first. Our platform is hosted in Canada. Every exception — and the reason for it — is named in section 12 and on our sub-processor list.
7. Privacy by default. Optional processing (analytics cookies, advertising measurement, marketing email) is off until someone opts in.
8. One accountable person. A named privacy officer is responsible for our compliance (section 24).

3. Our two roles: when we decide, and when our customers decide

Privacy laws treat the organisation that decides why and how personal information is used differently from the organisation that only handles it on someone else's behalf. Nysroc plays both roles.

When we act as a processor we do not use Customer Data for our own purposes, except to secure and operate the Service, to produce aggregate, de-identified service statistics (for example total page views served, never combined to identify anyone), or where the law requires. We will not re-identify de-identified data.

4. The personal information we handle

We collect only what we need for the purposes in section 6. Below, items marked (processor) are Customer Data we handle on a customer's behalf.

4.1 Account and identity

• Your name, business email address, password (stored only by our sign-in service, Nysroc Login, as a salted one-way hash — never readable by our staff), the business name, province or territory, preferred language, and the web address you choose (for example yourbusiness.nysroc.com), and optional custom domain.
• If you sign in with Google: your Google account's name, email address, and a unique account identifier. We do not receive your Google password.
• Multi-factor authentication settings (for example that an authenticator app is enrolled; the secret itself is stored encrypted by Nysroc Login).
• Users you invite: their names, emails, roles and permissions.

4.2 Billing and subscription

• Subscription plan, trial dates, invoices, payment status, tax registration numbers (GST/HST/QST) if you provide them, billing address or postal code, and the last four digits, brand and expiry of the card on file.
• Card numbers and security codes are never sent to or stored by Nysroc. You type them only on the secure page of our payment processor, Stripe, which processes them under its own PCI DSS Level 1 programme. We receive a token and the limited details above.

4.3 Customer Data in workspaces (processor)

• Business records such as customers, contacts, leads, suppliers, items, prices, quotes, orders, invoices, payments, journal entries, stock, projects, employees (if you use HR and payroll features), documents and files, calendars and bookings, help-desk tickets and conversations, website content, form submissions, email and messaging conversations, and notes.
• The content is chosen by the customer. It can include sensitive information (for example payroll data or social insurance numbers). Health information must not be stored in Nysroc (section 18). The customer is responsible for collecting it lawfully; see sections 18 and 21.

4.4 Phone and call data — Nysroc Phone (processor)

• Phone numbers, caller ID, extensions, call times and durations, call direction and outcome, voicemail, the link between a call and a CRM or help-desk record, and call recordings where the customer has turned recording on.
• AI call summaries, if the customer turns them on (see section 8).
• Information needed by our telecommunications carrier to route calls, including the 911 civic address registered for each number.

4.5 Point-of-sale and payment-app connections (processor)

• When a customer connects its own Square or Clover account (or, later, other point-of-sale systems), we receive sales, refunds, items, prices, stock counts, locations, tender types and processing fees, and any customer details the point-of-sale system holds for a sale, and we post them into the customer's books.
• When a customer connects its own Stripe account to its books, we receive payments, fees, refunds and payouts.
• We store the access tokens for these connections encrypted. We do not receive full card numbers from any of these systems.

4.6 Website visitor analytics — Nysroc Analytics (processor)

On websites hosted by Nysroc, our first-party script (/_n/a.js, served from the site's own domain) records:

• Always, without cookies and without consent-dependent identifiers: the page visited, the referring site, campaign tags in the link (UTM parameters), whether an ad link was followed (but not the ad click identifier itself), form submissions, store purchases (amount in CAD), clicks on phone links, and a daily-rotating visitor key calculated from the site, the visitor's IP address and browser type with a secret that changes every day. The key cannot be reversed, cannot link visits across days, and the IP address is never stored.
• Only if the visitor accepts "Site measurement": a first-party cookie _nya with a random visitor identifier (kept up to 13 months) and the first source that brought the visitor to the site, so returning visits and first-touch attribution can be measured.
• Only if the visitor accepts "Advertising (attribution)": the advertising click identifier from the link (for example from Google, Microsoft or Meta ads), so the business can see which ad worked and, if it runs ads through Nysroc Ads, report conversions to its own ad account (section 4.7).
• Known bots and crawlers are ignored. Details are in the cookie and tracking notice.

4.7 Advertising — Nysroc Ads (processor)

• When a customer connects its own Google Ads, Meta (Facebook and Instagram) or Microsoft Advertising account, we store the connection tokens encrypted (AES-based authenticated encryption, key held in our secret manager), and handle campaign settings, budgets, ad copy and images, landing pages, daily spend and results.
• Server-to-server conversions: when a visitor who accepted "Advertising (attribution)" submits a form, buys something or taps to call, Nysroc can send the conversion to the customer's own ad account. Only SHA-256 hashed email address and/or phone number, the click identifier, an event identifier, time and value leave Nysroc. Nothing is sent for visitors who declined, who did not choose, or whose browser sends Global Privacy Control or Do Not Track. No advertising pixel or tag is ever placed in the visitor's browser.
• The ad network receives this information as the customer's vendor or as an independent company under the customer's own agreement with it, not as Nysroc's sub-processor.

4.8 Video — Nysroc Video (processor)

• Scripts, screens generated from the customer's website or product data, narration audio, captions, and finished video files.
• Avatar videos are produced by HeyGen. If the customer uses its own HeyGen key, HeyGen processes the script and any likeness or voice the customer chose under the customer's own HeyGen account. If Nysroc's own HeyGen key is ever offered, HeyGen becomes our sub-processor and will be listed as such. Nysroc does not create biometric templates of anyone's face or voice.
• Finished videos used in ads are made available to the ad network through a signed link that expires after 24 hours.

4.9 AI prompts and outputs (processor, see section 8)

• The questions and instructions users give Nysroc AI, the records the AI reads on the user's behalf (with that user's permissions), and the answers, drafts and summaries it produces; usage metering (tokens, feature, time).

4.10 Support, chats and tickets (controller)

• Messages, chat transcripts with our support assistant, emails, screenshots and files you send us, call notes, ticket history, and satisfaction ratings.
• With your permission and only for the ticket, our support staff may view your workspace. Every such access is recorded in the audit log you can see.

4.11 Audit logs (controller for the log; the records it points to remain Customer Data)

• A tamper-evident, append-only record of security-relevant actions: sign-ins and failed sign-ins, permission changes, exports, deletions, billing changes, domain changes, ad approvals, support access, and similar. Each entry records who acted (user identifier, email, role), when, from which IP address and browser, and what changed. Entries are chained by cryptographic hash and sealed to write-once storage, so they cannot be silently altered.

4.12 Device, security and technical logs (controller)

• IP address, browser and device type, operating system, language, timestamps, pages and API endpoints requested, error reports, performance metrics and request traces; abuse-prevention signals (for example proof-of-work challenge results and rate-limit counters). We protect our forms with a self-hosted proof-of-work check instead of a third-party CAPTCHA, so no visitor data goes to a CAPTCHA company.

4.13 Marketing, communications and visitors to nysroc.com (controller)

• Your marketing preferences and consent records (what you agreed to, when and how), email engagement where you have consented, event registrations, survey answers, and information you give us when you request a demo or contact sales.
• Business contact information of people at prospective customers and partners, from them or from public business sources.
• Visitors to nysroc.com: see the cookie notice. Our marketing site does not use advertising trackers.

4.14 Information we do not want

Please do not send us, or put into Nysroc AI, information that the Service does not need — for example full card numbers outside the payment page, passwords, or health information (section 18).

5. Where the information comes from

• From you — when you sign up, use the Service, contact us or fill in a form.
• From your organisation — when an administrator invites you or puts your information into a workspace.
• Automatically — from your browser or device when you use the Service or visit a Nysroc-hosted website (section 4.12, section 10).
• From services you connect — Google sign-in; your point-of-sale, payment, ad, video or other accounts; our payment processor (payment status and limited card details).
• From public or business sources — for example business registries and professional networking profiles, for business-to-business sales only.

6. Why we use it, and our legal grounds

We identify our purposes at or before collection and use information only for those purposes or ones a reasonable person would consider appropriate in the circumstances. For individuals whose information is subject to the EU or UK GDPR, the right-hand column shows our legal basis.

We do not use personal information for any new purpose without telling you and, where required, getting your consent first.

7. Consent and your choices

• Meaningful consent. We ask for consent in plain language, separately from other terms where the law requires, and we make clear what is optional. We get express consent for sensitive information and for any use you would not reasonably expect.
• Withdrawing consent. You can withdraw consent at any time, subject to legal or contractual limits, for example by unsubscribing, changing settings, using "Cookies" in a site footer, or contacting us. Withdrawal does not affect processing already done. We will tell you if withdrawing means we cannot provide part of the Service.
• Settings you control: marketing preferences; website visitor measurement (per visitor); Nysroc AI on/off and AI mode (per workspace); call recording and AI call summaries (per workspace); connected apps (connect or disconnect at any time); export and account deletion.
• Quebec. Consent is requested for each specific purpose, in clear and simple terms, and the most privacy-protective settings apply by default to tracking and profiling functions (section 9). Nysroc AI (managed) is a feature the customer's administrator controls for its workspace; it is on by default with the disclosure and choices in section 8 [COUNSEL: confirm this against s. 9.1 of Quebec's act].

8. Nysroc AI (artificial intelligence)

Nysroc AI is the assistant inside the Service and the engine behind AI features (website builder, ad copy, video scripts, call and ticket summaries, reply drafts, plain-language questions about your books). This section tells you exactly where it runs.

8.1 Three ways to power Nysroc AI — the customer chooses

Default. Nysroc AI (managed) is on by default for every new workspace, in every province and state, including Quebec. Before it is first used, administrators see where it runs (the residency label "China") and the choices in section 8.5, and they can switch it off, switch to their own key (BYOK) or make the workspace Canada-only at any time in Settings → AI.

A self-hosted Nysroc model running in Canada is planned and will be added as a mode when available. Each model shows a residency label in Settings → AI so administrators know where requests go.

8.2 What is sent to the AI provider

Only what a feature needs for the request a user makes: the instruction, and the records the AI tool reads on that user's behalf with that user's own permissions (for example invoice totals for "who owes us more than 60 days?", or a call transcript for a call summary). The AI never has more access than the signed-in user. Actions that change data, send messages, post or pay always show a preview and need a person to confirm, unless the customer's administrator turns that off for a specific action.

8.3 Training and retention

• Nysroc does not use Customer Data, prompts or outputs to train or fine-tune any AI model.
• Nysroc keeps prompts and outputs for 30 days for audit and troubleshooting, then deletes them; an administrator can set this to 0 days. Prompt bodies are not written to our application logs.
• DeepSeek's own terms. At the date of this draft, DeepSeek's published Open Platform (API) terms do not include a written commitment that API inputs and outputs will not be used to train its models, do not state a retention period, do not offer a data processing agreement, and are governed by the law of the People's Republic of China. [COUNSEL / DECISION PENDING: Nysroc is seeking a written agreement with DeepSeek covering no training, retention, confidentiality, security and incident notice. Until one is signed, this paragraph must stay in the published policy.] We therefore cannot promise that DeepSeek will not retain or use data sent to it beyond what its own terms say.

8.4 Risks of processing in China — plain disclosure

Information sent to Nysroc AI (managed) leaves Canada and is processed and stored in China. While there, it is subject to the laws of China, which may allow government authorities to require access to it without the notice, oversight or remedies that Canadian law provides, and Canadian privacy regulators have limited ability to enforce rights there. See section 12.

8.5 Your choices

• Turn Nysroc AI off for the whole workspace, or for specific features, in Settings → AI.
• Switch to your own AI key (BYOK) with a provider and region you choose (for example one that processes in Canada).
• Mark a workspace "Canada-only": only models whose processing stays in Canada can then be selected, which today means BYOK with an in-Canada endpoint or, when available, the self-hosted Nysroc model. Managed DeepSeek processing is blocked for that workspace.
• Use AI only for low-risk content (for example marketing copy), and keep it off for payroll, HR, call recordings and sensitive records.

8.6 Do not send health or other regulated data to Nysroc AI (managed)

Nysroc AI (managed) is not designed for personal health information, information protected by HIPAA, social insurance numbers, government ID numbers, financial account numbers, information about children, or other information that a law or contract requires you to keep in Canada or with a specific level of protection. Customers must not send such information to Nysroc AI (managed). Use BYOK with a suitable provider, or keep AI off for those records.

8.7 Accuracy

AI output can be wrong. Treat it as a draft. You can ask us to correct inaccurate personal information that appears in output we keep.

9. Automated decisions and profiling

Nysroc does not make decisions about individuals based exclusively on automated processing that produce legal effects or similarly significant effects (for example refusing credit or employment).

We do use automated tools for security and abuse prevention (rate limits, proof-of-work challenges, blocking repeated failed sign-ins, flagging suspicious sign-ups). If an automated control blocks or restricts your account or sign-up, you can contact us and a person will review the decision. On request we will tell you (as Quebec's Law 25 and the GDPR require) what personal information was used, the reasons and main factors behind the decision, and your right to have that information corrected, and you can submit your observations to a member of our staff who can review it.

AI features (section 8) produce suggestions and drafts for people to review; they do not make decisions about individuals on their own.

Profiling and tracking technologies (Quebec s. 8.1). Functions that can identify, locate or profile a person — visitor identifiers and advertising measurement on Nysroc-hosted sites — are off by default and are turned on only by the visitor's choice in the consent banner (section 10).

10. Website analytics, cookies and advertising measurement

Full details, including every cookie and storage item by name, purpose and lifetime, are in our Cookie and tracking notice. In short:

• nysroc.com and our sign-up and account pages use only strictly necessary cookies (sign-in session, security, language preference). We do not run advertising trackers on them, and our typeface is served from our own servers (no third-party font service).
• Websites built on Nysroc serve their typeface from the site's own address (no third-party font service) and load our first-party script and a consent banner, which links to the business's own privacy notice, with equal-weight "Accept all", "Decline" and "Choose" buttons. Both optional categories ("Site measurement" and "Advertising (attribution)") are off until the visitor accepts. The choice can be changed at any time from the "Cookies" link in the site footer; withdrawing consent deletes the visitor cookie and the stored first-visit source from the browser.
• Global Privacy Control and Do Not Track are honoured. When a browser sends either signal, the banner is not shown, both categories stay off, and no identifier or ad-click data is kept. (Some large platforms say they do not respond to Do Not Track; we do.)
• No third-party script, pixel or tag is placed on a Nysroc-hosted site by Nysroc. A customer can still add its own code to its site; that is the customer's responsibility.

11. Who we share information with

We disclose personal information only as described here, and only the minimum needed.

1. Sub-processors and service providers who host, deliver or support the Service for us — for example our cloud host in Canada, our payment processor, our email delivery provider, our telecommunications carrier and our managed AI provider. They are bound by written contracts to use the information only for our instructions, to protect it at a level comparable to ours, and to delete or return it. The current list, with what each does and where, is at nysroc.com/legal/subprocessors. We give customers at least 30 days' notice before adding or replacing a sub-processor that handles Customer Data, so they can object under the DPA.
2. Services you or your organisation connect. When you connect Google sign-in, a point-of-sale system, your own Stripe, an ad account, HeyGen, an automation, or any other third-party service, we send that service the information needed for the connection you asked for. That service handles it under its own terms and privacy policy.
3. Your organisation. If you use a workspace your employer or client controls, its administrators can see and manage your activity and content in that workspace.
4. Professional advisers (lawyers, auditors, insurers) under confidentiality obligations.
5. Legal requirements and protection of rights. We disclose information to government, courts or law enforcement only when required by law (for example a valid warrant, production order or subpoena) or permitted by law in an emergency threatening someone's life, health or security. Our rules:
   • we review each request for legal validity and scope and challenge requests that are unlawful or overly broad;
   • we disclose the minimum required;
   • we notify the affected customer before disclosing, unless the law forbids it or there is an emergency, and we encourage the authority to seek the data from the customer directly;
   • we intend to publish a yearly count of such requests [PROPOSED].
6. Business transfers. If Nysroc is involved in a merger, acquisition, financing, reorganisation or sale of assets, information may be disclosed to the parties under strict confidentiality, and only as Canadian law permits. We will notify affected customers before their information becomes subject to a different privacy policy.
7. With your consent or at your direction, in any other case.

We never sell or rent personal information, never disclose it to data brokers, and never disclose it to third parties for their own marketing.

12. Where information is stored, and transfers outside Canada

12.1 Canada first

The Nysroc platform — workspaces, websites, databases, files, call recordings, backups and audit logs — is hosted in Canada with OVHcloud in Beauharnois, Quebec, on two dedicated servers (primary and replica), with encrypted off-site backups in Toronto, Ontario.

Note for Quebec: copying encrypted backups from Beauharnois (Quebec) to Toronto (Ontario) is a communication outside Quebec. We have documented an assessment of it under section 17 of Quebec's private-sector privacy act [TO BE COMPLETED before launch]; both locations are in Canada, under the same provider and the same contract and security controls.

12.2 Where information leaves Canada, and why

12.3 How we protect transfers

• Transparency (PIPEDA, Alberta PIPA, BC PIPA). Information sent outside Canada is subject to the laws of that country and may be accessible to its courts, law enforcement and national-security authorities. Alberta's PIPA requires us to tell you the countries where our service providers may collect, use, disclose or store personal information for us (listed above and on the sub-processor page) and to answer questions about it: ask our privacy officer.
• Quebec (Law 25, s. 17). Before communicating personal information outside Quebec we assess whether it will receive adequate protection, considering its sensitivity, the purpose, the protection measures (including contractual ones) and the legal framework of the receiving country, and we put the arrangement in a written agreement. For processing by DeepSeek in China, this assessment is required and has not yet been completed [COUNSEL — OPEN ITEM: complete and document the s. 17 assessment before publication. Business decision of 1 November 2026: Nysroc AI (managed) stays on by default for all workspaces, including in Quebec, with the disclosure in sections 8.1 and 8.4, the off switch, BYOK and the Canada-only setting in section 8.5].
• EU / UK. The Service is not offered to customers in the EU, EEA, Switzerland or UK at launch (section 1). If that changes: Canada has an EU adequacy decision for organisations subject to PIPEDA, and the UK recognises Canada as adequate on the same basis. For onward transfers from Canada to countries without adequacy (including the United States where no framework applies, and China), we use the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement), with transfer impact assessments and supplementary measures. [COUNSEL — before any EU/UK offering: DeepSeek offers no data processing agreement or SCCs at the date of this draft.]

13. How long we keep information

We keep personal information only as long as needed for the purposes in this policy or as the law requires, then we securely destroy it or anonymize it according to generally accepted best practices. Proposed periods (source of truth for engineering: catalog/retention.yaml and catalog/plans.yaml; final periods to be confirmed by counsel):

Information used to make a decision about a person is kept long enough to let that person access it and seek recourse — at least one year under PIPEDA guidance.

14. How we protect information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

• Encryption in transit (TLS 1.2 or higher on every public endpoint, HTTPS-only, automatic certificates for customer domains) and encryption at rest for databases, files, backups and call recordings, with keys managed separately from data; extra application-level encryption for secrets such as connection tokens and AI keys.
• Tenant isolation: each customer workspace runs as its own site with its own database and its own identity realm.
• Strong sign-in: Nysroc Login with multi-factor authentication (authenticator-app codes), single sign-on across modules, session expiry, protection against password guessing, and a self-hosted proof-of-work check against automated abuse.
• Least privilege: our staff access production systems only when needed, with MFA, through audited channels; access to a customer's workspace for support requires the customer's permission and is logged where the customer can see it.
• Audit trail: tamper-evident, hash-chained audit log sealed to write-once storage.
• Secure engineering: code review, dependency updates, automated tests, secrets never in code or logs, no card data, passwords or tokens in events or logs.
• Monitoring and resilience: security monitoring and alerting, DDoS protection from our host, backups with restore tests, and an incident response plan.
• People and suppliers: confidentiality agreements and privacy training for staff; due diligence and written contracts with sub-processors.
• Privacy impact assessments for any new or changed system that involves personal information, as Quebec's Law 25 requires, and before any communication of personal information outside Quebec.

No system is perfectly secure. You help by using a strong unique password, turning on MFA, and limiting who has administrator rights.

15. Privacy incidents and breaches

• We keep a register of all confidentiality incidents and breaches of security safeguards, including those that do not need to be reported, for at least 24 months (PIPEDA) and as required by Quebec's regulation [PROPOSED: 5 years], and give it to the regulators on request.
• If a breach creates a real risk of significant harm (PIPEDA, Alberta PIPA) or a risk of serious injury (Quebec), we notify the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner of Alberta, and other authorities as applicable, and the affected individuals, as soon as feasible, and take steps to reduce the risk.
• Where GDPR applies, we notify the competent supervisory authority within 72 hours where required.
• When an incident affects Customer Data, we notify the affected customer without undue delay (target: within 48 hours of confirming it) [ALIGN with the DPA] and give it the information it needs to meet its own obligations.

16. Your rights and how to use them

Depending on where you live, you have some or all of these rights. We extend the core rights to everyone, wherever they live.

How to make a request.

• Account holders can view, correct, export and delete much of their information themselves in Account (nysroc.com/account), including two-click cancellation and full export.
• Or email privacy@nysroc.com, or write to our Privacy Officer at the address in section 24. Requests can be made in English or French.
• Customer Data: if your request is about information a business keeps in Nysroc, contact that business. If you contact us, we will forward the request to it promptly (with your permission) and help it respond.

Verification. We verify your identity before acting, using information we already hold (for example confirming control of the account email). We ask for no more than necessary and delete verification information after use. You may use an authorized agent (US states) or a legal representative; we may ask for proof of authority. Under Quebec law, the heir, liquidator or spouse/close relative of a deceased person may obtain certain information as the law provides.

Timing and cost. We respond within 30 days (PIPEDA, Quebec, Alberta; one month under GDPR; 45 days under US state laws), and tell you if we need an extension the law allows, and why. Requests are free; we may charge a minimal fee only where the law allows for excessive or repeated requests, and we tell you first. If we refuse a request in whole or part, we tell you in writing why, the law we rely on, and how to complain or appeal.

Appeals (US states). If we decline your request, you can appeal by replying with "Privacy appeal" to privacy@nysroc.com within 60 days. We decide appeals within the period your state's law sets and tell you how to contact your state Attorney General if you disagree.

17. Province-, country- and state-specific information

17.1 Canada (federal — PIPEDA)

Nysroc is subject to the Personal Information Protection and Electronic Documents Act for commercial activities. Annex A shows how we meet its ten fair information principles. Complaints: Office of the Privacy Commissioner of Canada (section 24).

17.2 Quebec (Law 25 — Act respecting the protection of personal information in the private sector)

• Person in charge of the protection of personal information: our Privacy Officer (section 24); title and contact details are published on this page.
• Governance: we have adopted policies and practices governing personal information (roles and responsibilities of staff throughout the life cycle of information, retention and destruction, complaint handling); this policy summarises them in plain terms, and a fuller description is available from our Privacy Officer.
• Privacy impact assessments for every information system or electronic service delivery project involving personal information, and before any communication outside Quebec (section 12.3).
• Confidentiality incident register and notification to the Commission d'accès à l'information and affected persons (section 15).
• Automated decisions (section 9), tracking/profiling technologies off by default (sections 9–10), de-indexing and portability rights (section 16).
• Destruction or anonymization once the purpose is achieved (section 13).
• French language: this policy, our cookie notice and our privacy summary are available in French, and the French version is equally authoritative [COUNSEL: confirm interaction with the Charter of the French language for contracts of adhesion].
• Complaints: Commission d'accès à l'information du Québec (section 24).

17.3 Alberta and British Columbia (PIPA)

Where Alberta's Personal Information Protection Act or British Columbia's Personal Information Protection Act applies (for example to personal information about employees of customers in those provinces, or where they apply instead of PIPEDA), we follow them, including Alberta's requirements to disclose the countries where our service providers handle personal information (section 12) and to notify the Alberta Commissioner of breaches with a real risk of significant harm. Complaints: Office of the Information and Privacy Commissioner of Alberta or of British Columbia (section 24).

17.4 European Economic Area, Switzerland and the United Kingdom

• Controller: Nysroc (section 1) for the information in section 3 marked "controller"; legal bases in section 6.
• Not offered at launch. The Service is offered only in Canada and the United States (section 1), so no EU (GDPR Art. 27) or UK representative is appointed. One will be appointed before the Service is offered in the EU or UK.
• Data protection officer: not currently required; our Privacy Officer handles all enquiries [COUNSEL to confirm].
• Transfers: section 12.3.
• Complaints: the supervisory authority where you live or work, or where an alleged infringement took place.

17.5 United States

Notice at collection. Annex B lists the categories of personal information we have collected in the past 12 months, the sources, the purposes, how long we keep each, and the categories of recipients. We do not sell or share personal information (as those terms are defined in the California Consumer Privacy Act as amended by the CPRA), and we have no actual knowledge of selling or sharing information of consumers under 16. We do not use or disclose sensitive personal information except for permitted purposes (providing the Service, security, fraud prevention, legal compliance), so the right to limit does not need to be exercised. We do not offer financial incentives tied to personal information.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing.

Other states. Residents of states with comprehensive privacy laws — including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — have the rights in section 16 to the extent their law provides, including confirmation, access, correction, deletion, portability, opting out of targeted advertising, sale and significant profiling (which we do not do), and appeal. Global Privacy Control is honoured as an opt-out signal.

When we process personal information as a service provider / processor for a customer, the customer's privacy notice governs and we follow the customer's instructions under the DPA.

18. Health information and HIPAA

• Nysroc does not offer health-information hosting at launch. Customers must not store health information in Nysroc: no patient records, clinical notes, diagnoses, prescriptions, health card numbers or protected health information (PHI).
• Nysroc is not a "covered entity" under the US Health Insurance Portability and Accountability Act (HIPAA), is not a business associate, and does not sign Business Associate Agreements (BAAs) at launch. Nysroc AI (managed) must never receive health information.
• Clinic websites. Website forms on Nysroc's clinic and health-practice templates tell visitors not to send health information; they are for contact and appointment requests only. Practices must not use Nysroc forms to collect patient health records.
• Canadian health information. Health-care providers in Canada (for example Ontario custodians under PHIPA, or those subject to Alberta's HIA or Quebec's health information law) remain responsible for their patients' information. Nysroc is not offered as an agent or electronic service provider for personal health information at launch, so providers may use Nysroc for their business operations (website, bookings requests, accounting, CRM for non-clinical contacts) but must keep patient health records in a system designed for them.

19. Children

The Service is for businesses. You must be at least 16 (and the age of majority where you live to enter into the Terms) to create an account or be a user. We do not knowingly collect personal information from children under 16 for our own purposes, and our marketing is not directed at children. If you believe a child has given us personal information, contact privacy@nysroc.com and we will delete it. Customers that collect information about children through their own websites or workspaces (for example a dance school) are responsible for obtaining consent from a parent or guardian where the law requires it (under 14 in Quebec; under 13 for US COPPA purposes).

20. Marketing messages and Canada's anti-spam law (CASL)

• We send commercial electronic messages about Nysroc only with your express consent or where CASL permits implied consent (for example an existing business relationship within the time limits CASL sets, or a business email address you published without saying you don't want messages).
• Every marketing message identifies us, includes our mailing address and contact information, and has a working unsubscribe link. We process unsubscribe requests promptly and within 10 business days at the latest.
• We keep records of consent (what, when, how) to prove it.
• Service messages (receipts, trial reminders, security alerts, notices of changes to the Terms or this policy) are not marketing; you will receive them while you have an account.
• Customers' own campaigns: when a customer sends email or messages through Nysroc (for example Nysroc Campaigns or Nysroc Inbox), the customer is the sender and is responsible for CASL compliance; Nysroc provides unsubscribe handling and consent records to help.

21. What we expect of our customers

When you, as a customer, use Nysroc to collect or use other people's information, you are responsible for doing so lawfully. In particular you must:

• publish your own privacy notice on your website and to your customers, and keep the consent banner on your Nysroc-hosted site enabled;
• obtain any consent the law requires — for example to record phone calls (tell callers at the start of the call), to send marketing (CASL), to upload hashed conversions to your ad accounts, and to collect children's or health information;
• decide whether to use Nysroc AI and in which mode, and not send health or other regulated information to Nysroc AI (managed) (section 8.6);
• respond to your own customers' privacy requests (we will help, as set out in the DPA);
• configure retention for call recordings and other records to meet your own obligations.

The Customer Data Processing Addendum sets out both parties' obligations in detail.

22. Other companies' services and links

The Service connects to services operated by others (for example Google, Meta, Microsoft, Square, Clover, Stripe, HeyGen and automation apps), and websites may link to other sites. Their handling of your information is governed by their own policies. Disconnecting an integration in Nysroc stops our exchange of data with it; to delete data the other company already holds, contact it directly.

23. Changes to this policy

We review this policy at least once a year and when our practices change. If we make a material change — for example a new purpose, a new category of sensitive information, a new country where information is processed, or a new sub-processor that handles Customer Data — we will notify account holders by email and in the Service at least 30 days before it takes effect, and ask for new consent where the law requires. The date at the top shows the latest version; previous versions are available on request [PROPOSED: archive of past versions at /legal/privacy/history].

24. Contact us, our privacy officer, and how to complain

Privacy Officer / Person in charge of the protection of personal information
Zameer Mulla, Chief Executive Officer
Nysroc — Scopien Technologies Inc.
300-416 North Service Road East, Oakville, Ontario L6H 5R2, Canada
Email: privacy@nysroc.com [OPEN ITEM: mailbox to be created and monitored before publication]

We acknowledge complaints within 5 business days [PROPOSED], investigate every complaint, and tell you the outcome and any measures taken. If you are not satisfied, you may complain to a regulator at any time:

• Office of the Privacy Commissioner of Canada — priv.gc.ca · 1-800-282-1376 · 30 Victoria Street, Gatineau, Quebec K1A 1H3
• Commission d'accès à l'information du Québec — cai.gouv.qc.ca · 1-888-528-7741
• Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca · 1-888-878-4044
• Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca · 250-387-5629
• EU/EEA: your national data protection authority · UK: Information Commissioner's Office (ico.org.uk)
• US: your state Attorney General or, in California, the California Privacy Protection Agency (cppa.ca.gov)

[COUNSEL: verify regulator contact details at publication.]

Annex A — How we meet the ten fair information principles (PIPEDA Schedule 1)

Annex B — United States: categories of personal information (past 12 months)

We do not sell or share any category. Customer Data we process as a service provider is governed by the customer's notice.

Version history: 0.9 (draft, 1 November 2026) — first complete draft for counsel review; replaces the one-paragraph placeholder page.