Privacy Policy

This policy explains how [registered company name, to be confirmed] (“Aidrome”, “we”, “our”) handles personal information when you visit aidrome.ai, contact us, or send us a document for review. We wrote it to be read, not skimmed past. If something is unclear, ask us at [privacy contact email, to be confirmed].

Who we are

Aidrome is a readiness and advisory firm incorporated in Ontario, Canada, with its registered office in North Bay, Ontario. We're responsible for the personal information described in this policy.

Our person in charge of the protection of personal information is our Managing Principal and Founder. You can reach them at [privacy contact email, to be confirmed].

What we collect

Information you give us

• Contact details: your name, work email, company, role, company size, the type of buyer you're dealing with, and your buyer's deadline.
• Documents you upload: a security questionnaire, RFP clause or similar document. These may contain information about your company and, sometimes, about people.
• Your messages to us, including NDA requests and anything you share on a call.

Information collected automatically

• Basic technical data such as IP address, browser type and the pages you request, which our hosting and security providers record to run and protect the site.
• Bot protection: our forms use Cloudflare Turnstile, which checks signals from your browser to tell people from automated traffic.
• Privacy-friendly analytics: we use Cloudflare Web Analytics to count visits. It doesn't use cookies or track you across other sites.

We don't use advertising or tracking cookies, and we don't sell personal information.

Why we use it

• To review your document and send you a short gap read.
• To send you an NDA, if you ask for one, before you share a document.
• To reply to you, arrange a call, and prepare a proposal if you ask for one.
• To keep the site and our systems secure, including scanning uploads for malware.
• To meet our legal obligations.

We only use your information for these purposes, or for others you agree to. We'll ask before sending you marketing emails, and you can unsubscribe at any time.

To prepare a gap read, we may process your document with Fulcrum, our own platform, which uses large language models. [which AI model providers process documents, where, and whether they may retain or train on the content, to be confirmed]. Our people review every finding before it reaches you.

Legal bases (GDPR)

If the GDPR applies to you, we rely on steps you ask us to take before entering a contract (reviewing your document, sending an NDA), our legitimate interests in running and securing our business, your consent where we ask for it, and legal obligations.

How we protect documents you upload

Questionnaires are often confidential. When you upload one:

• It travels over an encrypted connection straight to storage in Toronto, Canada.
• It's encrypted at rest with encryption keys Aidrome controls.
• It's scanned for malware before anyone on our team can open it.
• Only the members of our team working on your request can access it, and every access is logged.
• It's deleted automatically after 90 days [retention period, to be confirmed], or sooner if you ask.

If your document is confidential, you can ask for an NDA first and share it only once the NDA is signed. Where an NDA is in place, its terms apply alongside this policy.

Who we share it with

We share personal information only with service providers who help us run Aidrome, under contracts that limit how they can use it:

• Google Cloud: storage of uploaded documents, in Toronto, Canada.
• Vercel: website hosting, in the United States.
• Cloudflare: bot protection, analytics and network security, globally.
• Resend: delivery of form notifications to our team, in the United States.
• [CRM, scheduling tool and AI model providers, to be confirmed]

You can ask us for our current list of subprocessors at any time. We may also disclose information if the law requires it.

Transfers outside your province or country

Some providers process information outside Canada, mainly in the United States. Information held in another country can be subject to that country's laws and accessed by its authorities. For residents of Quebec, we assess the protection offered before information leaves Quebec. For transfers from the EU, UK or Nigeria, we use safeguards recognised by those laws, such as standard contractual clauses.

How long we keep it

• Uploaded documents: 90 days, then deleted automatically.
• Contact details and correspondence: for as long as we're in contact and as needed for legal and accounting purposes [retention period for contact records, to be confirmed].
• Security logs: for a limited period, to investigate and prevent misuse.

Your rights

Depending on where you live, you can ask us to:

• access the personal information we hold about you, and correct it;
• delete it, or stop using it for a particular purpose;
• withdraw your consent, where we rely on it;
• give you a copy in a structured, commonly used format (Quebec, EU, UK and Nigeria);
• restrict or object to certain processing (EU, UK and Nigeria).

Email [privacy contact email, to be confirmed] and we'll respond within 30 days. We may need to confirm your identity first.

If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, your local data protection authority in the EU or UK, or the Nigeria Data Protection Commission.

Children

Our services are for businesses. We don't knowingly collect information from anyone under 16.

Changes to this policy

We'll post any changes here and update the date at the top. If a change is significant, we'll tell people we're in contact with.

Contact

Questions or requests: [privacy contact email, to be confirmed]. You can also read our Terms of Use.