Privacy Policy — INTO Consulting

Overview

INTO AI Inc., operating as INTO Consulting ("INTO," "we," "us," "our"), respects your privacy.

This policy explains what personal information we collect through our website at www.weareinto.consulting, why we collect it, who we share it with, how long we keep it, and the choices and rights available to you.

What this policy covers. Our public website, the forms and scheduling links on it, and the marketing and business communications we send.

What this policy does not cover. Personal information we process for a client while delivering a consulting engagement. That processing is governed by the services agreement and any data processing addendum signed with that client. Where such an agreement conflicts with this policy in respect of client engagement data, the signed agreement governs.

Separate policies apply to some INTO products and services:

• Alfi Matching: www.weareinto.consulting/alfi-matching/privacy
• INTO for Hospitality: www.weareinto.ai/privacy-policy

We do not sell personal information. Our own analytics are not configured for targeted advertising. Exception: the Careers pages embed Growhire, whose Google Ads tag (AW-16712861877) loads independently of this site’s Privacy options and may use advertising cookies and online identifiers. Those options do not control tracking inside Growhire.

1. Information we collect

1.1 Information you give us

• Business contact details — name, business email address, telephone number, employer or organization name, and job title.
• The content of your enquiry — what you write in a contact form, a discovery-call request, a document download request, or an email to us.
• Meeting and scheduling information — the time you select and any context you add when you book a call.
• Subscription preferences — the lists you opt in to and your consent record.
• Recruitment information — if you apply through our Careers page, your résumé, work history, education, and anything else you choose to send.

1.2 Information collected automatically

• Technical and device information — IP address, browser type and version, operating system, device type, language setting, and referring page.
• Usage information — pages viewed, time on page, links and buttons clicked, and the sequence of pages in a visit.
• Cookies and similar technologies — see section 2.

Strictly necessary information is collected on every visit. Cookieless aggregate measurement runs on every visit. Detailed analytics information is collected only if you allow optional analytics. Section 2 explains the difference.

1.3 Information we do not seek

We do not ask for, and ask that you do not send us through this website: government identification numbers, financial account or payment card numbers, health information, biometric information, precise geolocation, or information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life, or sexual orientation.

Under Quebec law, personal information is sensitive where, by its nature or the context of its use, it carries a high level of reasonable expectation of privacy. We do not knowingly collect sensitive personal information through this website, and we do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit its use under United States state law.

2. Cookies, analytics, and similar technologies

We use three tiers, and the difference between them matters.

2.1 The three tiers

Strictly necessary. These make the site work: page delivery, security, load balancing, language selection, and remembering your privacy choice. They run on every visit because the site cannot function without them. They do not profile you.

Always-on aggregate measurement. We use Cloudflare Web Analytics on every visit to count page views and measure page performance. It sets no cookie, stores nothing on your device, does no fingerprinting, and does not track you across sites. It reports in aggregate and cannot single you out. Your IP address and browser user-agent string reach Cloudflare in the course of serving the request, and the IP address is used to derive a country-level location; it is not stored or logged for analytics purposes.

Because this measurement does not identify, locate, or profile you as an individual, and sets nothing on your device, we inform you of it here rather than asking for your consent. There is no cookie to refuse. If you object to it, contact us using the details in section 12.

Optional analytics. These measure how the website is used in more detail, and they do rely on cookies and online identifiers. They are switched off until you turn them on.

2.2 Optional analytics: off until you allow them

No optional analytics cookie is set, and no optional analytics vendor is loaded, unless and until you activate optional analytics. You can activate, review, or switch them off at any time using Privacy options in the site footer. Switching them off stops further measurement and deletes the optional analytics cookies our site set, where your browser permits it.

Accepting part-way through a visit starts measurement from that point. We do not backfill anything you did before you accepted.

Exception: the Careers pages embed Growhire, whose Google Ads tag (AW-16712861877) loads independently of this site’s Privacy options and may use advertising cookies and online identifiers. Those options do not control tracking inside Growhire.

2.3 Who we use, and for what

Always on, no cookie, no consent sought

Cloudflare is also our hosting and content-delivery provider, so it already processes each request in order to serve you this page.

Loaded only when you allow optional analytics

A vendor that is not configured does not load. Allowing optional analytics is necessary for the vendors in this table to load. It is not by itself sufficient: each one also has to be switched on for this website, and where one is not, it is not loaded at all and receives nothing about your visit, even after you allow optional analytics. Ask us using the contact details in section 12 which of them are switched on today.

How these are configured. Google Analytics runs with advertising storage, ad-user-data storage, ad-personalization storage, Google Signals, and ad-personalization signals disabled. We do not send Google Analytics a user identifier, form field content, or scheduling data. We do not call HubSpot's visitor-identification interface and do not pass HubSpot a visitor email address from page code. Where you submit a form and identify yourself, HubSpot may associate that submission with the visit it came from and with your contact record in our customer relationship management system.

Google Tag Manager is a tag container. Where it is loaded before your choice is known, it is loaded in a mode that fires no measurement tag and reads or writes no analytics identifier until consent is recorded.

2.4 Browser and platform signals

We honour the Global Privacy Control signal. If your browser or extension sends a Global Privacy Control signal, we treat it as an instruction to keep optional analytics off, and we do not treat it as consent. It does not switch off the cookieless aggregate measurement in section 2.1, which sets nothing on your device and is not a sale, a share, or targeted advertising.

Because optional analytics are already off by default, a Do Not Track signal does not change our behaviour on this website.

3. How we use personal information

• To answer your enquiry and provide the information, proposal, or document you asked for.
• To arrange, hold, and follow up on meetings and discovery calls.
• To manage our relationship with you and keep our records accurate.
• To send you marketing and business communications where you have consented or where the law otherwise permits it, and to honour your withdrawal of consent.
• To understand how the website is used and improve its content, structure, and performance, where you have allowed optional analytics.
• To operate, secure, and troubleshoot the website, and to detect and prevent fraud, abuse, and security incidents.
• To consider your application if you apply for a role with us.
• To comply with law, respond to lawful requests, and establish, exercise, or defend legal claims.

We determine each purpose before we collect the information for it. If we want to use your personal information for a materially different purpose, we will identify that purpose and obtain your consent unless the law permits otherwise.

3.1 Automated decision-making

We do not make any decision about you on this website exclusively by automated means, and we do not profile you to make such a decision. Website analytics are used to understand aggregate site use, not to evaluate you individually.

If that ever changes, we will tell you at the time, explain the personal information used and the principal factors involved, and give you the opportunity to submit observations to a member of our personnel who can review the decision.

3.2 Artificial intelligence

Where we use artificial intelligence tools to help operate our business, for example to draft or summarize a response to an enquiry, a member of our team reviews the result before it is sent. We do not permit our vendors to use personal information you send us through this website to train their general purpose models.

4. Consent, and the legal authority we rely on

For most website activity we rely on your consent, given by the choice you make in Privacy options or by voluntarily submitting a form.

Where the law permits, we may also collect, use, or disclose personal information without your consent — for example to secure our systems, to establish or manage a business relationship with you at your request, to comply with a legal obligation, or to establish, exercise, or defend a legal claim.

Withdrawing consent. You can withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawal does not affect processing already carried out. If withdrawal prevents us from providing something you asked for, we will tell you.

Commercial electronic messages. Where we send you commercial electronic messages, we do so on the basis of your express or implied consent as permitted by Canada's anti-spam legislation and applicable United States law. Every such message identifies us, gives our contact information, and contains an unsubscribe mechanism that we honour promptly and without charge.

5. How we share personal information

We do not sell personal information. Our own analytics are not configured for targeted advertising. The Growhire exception is described in section 2.2.

We disclose personal information only as follows.

Service providers acting on our instructions. Website hosting and content delivery; the customer relationship management and marketing email platform; meeting scheduling; optional website analytics; business email and file storage; and information security services. They are bound by written agreement to use the information only to provide the service to us, to protect it, to notify us of any confidentiality incident, and to return or delete it.

Professional advisers. Our lawyers, accountants, auditors, and insurers, where they need the information to advise or act for us, subject to their professional duties of confidentiality.

Corporate transactions. A party to a proposed or completed financing, reorganization, merger, or sale of all or part of our business, subject to confidentiality undertakings, where the information is necessary to determine whether to proceed and, if the transaction completes, is used only for the purposes for which it was collected.

Legal and safety. Where required or permitted by law, to respond to a valid legal demand, to enforce our terms, or to protect the rights, property, or safety of any person.

We do not disclose personal information to any other third party for that party's own purposes.

6. Where personal information is processed

We are established in Quebec, Canada. Personal information collected through this website is processed in Canada and in the United States, and may be processed elsewhere by a service provider named in section 5.

Before we entrust personal information to a service provider outside Quebec, we assess the privacy risk of doing so — taking into account the sensitivity of the information, the purpose of its use, the protection it would receive including through contractual measures, and the legal framework of the destination — and we put a written agreement in place that reflects that assessment. We do not entrust personal information outside Quebec unless the assessment shows it would receive adequate protection.

You should be aware that personal information processed in another country may be accessible to the courts, law enforcement, and national security authorities of that country under its law.

You may ask us where a specific category of personal information is processed using the contact details in section 12.

7. How long we keep personal information

We keep personal information only as long as necessary for the purpose for which it was collected, or as required by law. When it is no longer needed, we destroy it or anonymize it.

Where we have used personal information to make a decision about you, we keep it long enough to let you request access to it.

8. Your choices

• Privacy options. Activate, review, or switch off optional analytics at any time using Privacy options in the site footer.
• Marketing. Unsubscribe using the link in any marketing email, or contact us. We will action it promptly.
• Browser controls. Your browser lets you block or delete cookies. Blocking strictly necessary cookies may stop parts of the site from working.
• Forms. You choose what to put in a form. Please do not send us the categories of information listed in section 1.3.

9. Your rights

We respond to every request consistently with the law that applies to you. We do not charge a fee, and we do not treat you differently for exercising a right.

9.1 Everyone

• Access — obtain confirmation that we hold personal information about you and receive a copy, together with information about its use and disclosure.
• Correction — have inaccurate, incomplete, or ambiguous personal information corrected, completed, or removed.
• Withdraw consent — as described in section 4.
• Complain — as described in section 11.

9.2 If you are in Quebec

In addition to the rights above:

• Portability — receive the computerized personal information you gave us in a structured, commonly used technological format.
• De-indexing and cessation of dissemination — require us to stop disseminating your personal information, or to de-index a hyperlink giving access to it, where the dissemination contravenes the law or a court order, or where the conditions set out in Quebec law are met.
• Information about an automated decision — as described in section 3.1.
• Reasons for a refusal — if we refuse a request, we will tell you in writing, give our reasons and the legal provision we rely on, tell you how to contest the decision, and tell you the time limit for doing so.

9.3 If you are in the United States

Depending on your state of residence, you may have the right to:

• Know and access the categories and specific pieces of personal information we collected, the categories of source, the purposes, and the categories of third party to which we disclosed it.
• Delete the personal information we collected from you.
• Correct inaccurate personal information.
• Obtain a portable copy of the personal information you provided.
• Opt out of the sale of personal information, of targeted advertising or sharing for cross-context behavioural advertising, and of profiling in furtherance of decisions producing legal or similarly significant effects. Our own analytics are not configured for these purposes. The embedded Growhire board is a separate exception described in section 2.2. We honour the Global Privacy Control as described in section 2.4.
• Limit the use of sensitive personal information. We do not collect sensitive personal information through this website for any purpose that gives rise to this right.
• Not be discriminated or retaliated against for exercising a right.
• Appeal. If we refuse your request, you may appeal by replying to our decision. We will respond within the period your state's law allows and, if we again refuse, tell you how to complain to your state Attorney General.
• Use an authorized agent. You may authorize someone to make a request for you. We may ask you to verify that you gave the authorization, and we may ask the agent for proof of authority.

Verification. We will take reasonable steps to verify your identity before acting on a request, and we may ask you for information that lets us match you to our records. We will not use that information for any other purpose.

Timing. We respond to a Quebec or Canadian access or correction request within 30 days. We respond to a United States state-law request within the period that state's law allows, generally 45 days, extendable once where permitted.

9.4 How to make a request

Email privacy@weareinto.consulting, or write to the address in section 12. Please tell us what right you want to exercise and enough about yourself that we can find your records.

10. Security and confidentiality incidents

We maintain administrative, technical, and physical safeguards proportionate to the sensitivity of the personal information we hold. These include access control on a need-to-know basis, encryption of personal information in transit, multi-factor authentication on our business systems, logging, vendor security review, and staff confidentiality obligations and training.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

We maintain a register of confidentiality incidents. If a confidentiality incident involving your personal information occurs and presents a risk of serious injury to you, we will notify you and the Commission d'accès à l'information du Québec promptly, and any other regulator or person the law requires, and we will take reasonable measures to reduce the risk of injury and prevent recurrence.

11. Complaints and how to escalate

If you have a privacy concern, contact us first at privacy@weareinto.consulting. We will acknowledge your complaint, investigate it, and tell you the outcome and our reasons in writing.

If you are not satisfied, you may complain to:

• Commission d'accès à l'information du Québec — cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada — priv.gc.ca
• your provincial or territorial privacy commissioner, where applicable
• your state Attorney General if you are in the United States, or the California Privacy Protection Agency if you are in California

12. Who is responsible, and how to reach us

The person in charge of the protection of personal information at INTO AI Inc. is responsible for our compliance with this policy and for handling your requests and complaints.

We have adopted internal policies and practices governing the governance of personal information, covering the roles and responsibilities of our personnel across the life cycle of the information, our retention and destruction process, our complaint process, and our response to confidentiality incidents. A description is available on request.

13. Children

This website is directed to businesses and business professionals. It is not directed to children, and we do not knowingly collect personal information from a child. If you believe a child has given us personal information, contact us and we will delete it.

14. Links to other sites

Our website links to sites and services we do not control, including social media platforms. Their privacy practices apply to their sites, not this policy. Review their policies before giving them information.

15. Changes to this policy

We may update this policy. When we make a material change, we will update the effective date at the top of this page and, where appropriate, post a notice on the website. If a change materially affects how we use personal information we already hold about you and we rely on your consent, we will obtain your consent before the change applies to that information.

The French and English versions of this policy have the same meaning. If you notice a discrepancy, tell us at privacy@weareinto.consulting.