Privacy Policy

Privacy Officer

AC95 has designated a Privacy Officer who is responsible for our compliance with this policy and with applicable privacy laws. If you have a question, a complaint or a request about your personal information, contact:

Information we collect

We collect only what we need to run the Service:

• Account information: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Brand and project information: brand names, logos, colours, descriptions, industry and target audience, project details, and the files you upload.
• Messages: the messages you exchange with our team inside your projects (encrypted at rest) and your conversations with the AI assistant in the dashboard.
• Enterprise requests: company name, contact name and role, email address, phone number, website and the project details you send when you request a quote.
• Billing information: your plan, credit balance, credit transactions, invoices and payment status. You enter your card details directly with Stripe; AC95 never receives or stores your full card number.
• Support requests: the tickets and messages you send us.
• Technical information: your IP address, which we use for rate limiting and security, and error and server logs that help us keep the Service working.

How we use your information

• To create and manage your account and provide the services you request.
• To process payments, subscriptions, credits and invoices.
• To send you service emails, such as email verification, password resets, billing notices, renewal reminders and project updates.
• To answer your support and quote requests.
• To keep the Service secure, prevent abuse and fix errors.
• To meet our legal, tax and accounting obligations.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for third-party advertising.

Service providers we use

We share personal information only with the providers that help us run the Service, and only what each one needs for its task:

• Stripe: payment processing, subscriptions and the billing portal.
• Amazon Web Services (Amazon S3): storage of the files you upload.
• MongoDB Atlas: our database.
• Railway: hosting of our application server.
• Vercel: hosting of our website.
• Redis: short-lived request counters used for rate limiting.
• Resend: delivery of service emails.
• Sentry: error monitoring. We configure it not to send personal data by default and to remove sensitive fields before an error report leaves our systems.
• Anthropic: the AI assistant and AI-generated documents. What you send to the assistant is processed by Anthropic to produce a response.
• Google: Google sign-in, if you choose to use it, and the map on our Contact page.

These providers act on our behalf and are not allowed to use your information for their own marketing.

Where your information is processed

Some of these providers store or process information outside Canada, including in the United States. When they do, your information may be subject to the laws of those countries, including laws that allow courts and authorities to access it. We use contracts and provider security commitments to protect it while it is there.

Cookies, local storage and browser signals

We use cookies to keep you signed in and to protect sign-in forms. We store your language preference and a few display preferences in your browser's local storage. We do not use advertising or analytics cookies.

Stripe may set its own cookies on payment pages to help prevent fraud, and the map on our Contact page is provided by Google. Their use of cookies is covered by their own privacy policies.

Because we do not sell or share personal information for advertising and do not track you across other websites, we treat Global Privacy Control (GPC) and "Do Not Track" signals the same way for everyone: no advertising or cross-site tracking happens either way.

How we protect your information

We use encrypted connections (HTTPS), store passwords only as secure hashes, encrypt project messages at rest and limit access to personal information to what is needed to provide the Service. No system is completely secure. If a breach creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires, and we will notify affected residents of U.S. states as those states' laws require.

How long we keep your information

We keep your information while your account is open and for as long as we need it to provide the Service and meet our legal, tax and accounting obligations. You can delete your account from your account settings. If you have a subscription, cancel it first from the billing section of your dashboard: cancelling stops renewal at the end of your current billing period, and you can delete your account once it is cancelled. While a subscription payment is overdue, the account cannot be deleted until the payment is resolved or the subscription ends. To have the rest of your data (such as brands, projects, files and messages) deleted too, email us at hello@ac95.ca. We will delete it within a reasonable time, except records the law requires us to keep, such as invoices and payment records.

Your rights

You can see and update your profile information in your account settings. You can also ask us to give you access to, correct or delete the personal information we hold about you, or withdraw your consent to its use (which may mean we can no longer provide the Service). Send your request to hello@ac95.ca. We will answer within 30 days.

If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

If you live in Quebec

Under Quebec's private sector privacy law (Law 25), you can also ask us to tell you what personal information we hold about you, to correct it, to stop using or delete it, and to receive your information in a commonly used technological format. Our AI assistant does not make decisions about you based solely on automated processing. Personal information may be transferred outside Quebec, including to the United States, to the providers listed above. Before any such transfer we consider the sensitivity of the information and the protection it would receive. You can also contact the Commission d'accès à l'information du Québec. A French version of this policy is available on request at hello@ac95.ca.

If you live in the United States

If you live in a U.S. state with a comprehensive privacy law (such as California, Colorado, Connecticut, Virginia, Texas and others), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate personal information;
• delete your personal information;
• opt out of the sale or sharing of your personal information and of targeted advertising. We do neither, so there is nothing to opt out of;
• not be treated differently for using these rights.

Categories of personal information we collected in the last 12 months: identifiers (name, email, IP address), commercial information (plan, credits, invoices), internet activity (server and error logs), and content you provide (files, messages, brand information). We collect these from you and from the sign-in provider you choose. We disclose them only to the service providers listed above for the purposes described in this policy.

How to make a request: email hello@ac95.ca with "Privacy" in the subject line. We may need to verify your identity before acting on a request. You may use an authorized agent to make a request for you. We will respond within 45 days (we may extend this once by another 45 days if we tell you why). If we deny your request, you may appeal by replying to our answer with the word "Appeal," and we will review it and reply within 60 days. If your state's law allows, you may then contact your state Attorney General.

Children

The Service is intended for businesses and adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18.

Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date and, for significant changes, let you know by email or in the dashboard.

Contact us

AC95, Kitchener, Ontario, Canada. For any question or request about your personal information, email hello@ac95.ca.