Privacy Policy

1. Who we are and the scope of this policy

YourFirstAI Inc. is a Canadian federal corporation based in Kitchener-Waterloo, Ontario. We build AI-powered websites with a working AI agent built in for small businesses (yourfirst.ai).

This policy explains, in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), how we handle the personal information of visitors to our public website yourfirst.ai and of leads who contact us. For services that require a login (client portal and AI tools), the handling of personal information is governed primarily by the service agreement signed with each client — see sections 6 and 7.

2. Accountability and contact

YourFirstAI Inc. is accountable for the personal information in its custody or control. Requests and questions about your personal information go to our Privacy Officer:

• Privacy Officer: [email protected]
• Mailing address: YourFirstAI Inc., 151 Charles St. W., Suite 100, Kitchener, ON N2G 1H6, Canada

We respond to access and correction requests within a reasonable time and, where required, within 30 days. There is no charge for a routine request.

3. What information we collect on the site

• Quote requests (the /express page): your business name, type, city and current website; what you need, in your own words; your name, email and, if you give it, your phone number; the step or creative project you chose and any coupon code; how you reached us (campaign tags and channel); the page language; whether you typed or used your voice; and your choices on the form, with the version of the wording you saw and the time. Tips and offers by email are a separate box, unticked until you tick it.
• Coupons: each coupon can be used once per person. To check that, we keep your email address in lowercase and compare a simplified form of it (without a "+tag" and, for Gmail addresses, also without dots). We use it only to prevent repeated use.
• Voice brief on the quote page: if you choose to speak instead of typing, up to about two minutes of audio is sent to Google's Gemini service, outside Canada, to turn it into text that fills in the form. We don't keep the recording. You review every field before sending.
• Contact, demo and diagnostic forms: your name, email and, if you give it, your company; your message (contact form); your answers to the diagnostic (type of operation, how many customer questions a day, what customers ask most and where your team loses time); and a record that you saw our privacy notice (the version of the wording and the time).
• Site chat (AssistPro): the chat assistant on this site is our own AssistPro product, embedded as a widget served from yourai-assistpro.pages.dev in an iframe. It stores a session token in your browser's localStorage (yourai_widget_session) so your conversation can continue across pages. The content of your conversation is processed by our platform using the Google Gemini API (see section 5) and stored in our database hosted in Canada (see section 8). You can ask us to delete your conversations at any time. Any AI assistant on this site, including one on the quote page, works the same way.
• Surveys and NPS: your answers and any score you give.
• Meeting booking: name, email and the time slot you choose.
• Payments: when applicable, payments are processed by Stripe; we never store card data.
• Newsletter: the email address you sign up with and the language of the page.
• Blog search: the terms you search for, with your browser type, the page you came from and a random session identifier, to improve our content.
• Free diagnostic, voice notes: if you record a voice note in the free diagnostic, the audio is sent to Google's Gemini service, outside Canada, to be transcribed, and the transcript is attached to your lead record (see section 5). We keep the audio in a private storage bucket for 90 days, then delete it. Our team reaches it only through links that expire after 30 days.
• Site usage: first-party telemetry we built ourselves (no cookies, and events are stored without your IP address) and Google Analytics 4. Both run only if you select "Accept" in the cookie banner (see section 9).
• Security records: to stop abuse of our forms, chat and telemetry, we count requests per IP address and browser connection. The anti-bot check on our forms (Cloudflare Turnstile) also receives your IP address and browser details. The IP addresses we keep for this are deleted within 3 days of your last request.

4. Why we use your information and our lawful basis

Under PIPEDA we rely on your consent — express or implied — and on limited exceptions permitted by law. We identify the purpose before or at the time we collect your information:

We do not use your information for purposes incompatible with those identified. If a new purpose arises, we will inform you and, where consent is required, seek it again. You may withdraw consent at any time, subject to legal or contractual restrictions (section 10).

5. Artificial intelligence on the site

Three site features involve AI processing of your information:

• Chat assistant (AssistPro): responses come from an AI assistant. The messages you send are processed by our AssistPro platform using the Google Gemini API, on infrastructure outside Canada (see section 8). We do not train AI models on your data. The assistant is an AI, so do not enter sensitive data (health, biometrics and the like), third-party documents, passwords or financial data in the chat.
• Voice brief on the quote page: your recording is sent to the Google Gemini API, outside Canada, to turn it into text. We don't keep it. You review every field before sending, and the price you see is calculated from our published catalogue, never by AI.
• Voice-note transcription: voice notes submitted in the free diagnostic are transcribed by the Google Gemini API, outside Canada. The transcript is attached to your lead record.

How Google handles the content sent to the Gemini API (prompts, recordings and responses) is governed by Google's Gemini API terms. Google's usage policies for the API say it keeps this content for 55 days to detect and prevent misuse of its service and for any legally required disclosures. We do not use AI to make decisions about you: the price of a quote comes from our published catalogue, and our team handles the follow-up.

6. Authenticated services (Portal and tools)

Our client portal and AI tools require a login and are provided under agreements with business clients. In those cases, the handling of personal information is governed by the service agreement and data processing terms signed with each client — in many of them YourFirstAI acts as a service provider, on behalf of and under the instructions of the client, who is accountable for the information and for its own privacy policy.

If you use one of these tools as an employee or end user of a client of ours, the applicable privacy policy is generally the client's. Requests we receive in that context are forwarded to the client, whom we assist. To understand which regime applies to your case, write to [email protected].

7. WhatsApp Business Platform — conversation data we process for our clients

Some of our business clients use our platform to talk to their own customers through the WhatsApp Business Platform. In that service YourFirstAI is a Meta Tech Provider: the client owns its own WhatsApp Business Account (WABA), grants us access to it through Meta's Embedded Signup, and can withdraw that access at any time.

For the conversations that flow through it, the business client is the organization accountable for the personal information — it decides why and how those conversations are used — and YourFirstAI acts on its behalf and under its instructions, as a service provider under PIPEDA and as an operador under Brazil's LGPD where the client is Brazilian. This is the arrangement described in section 6.

On the client's instructions, we process:

• Message content — text, media and interactive elements exchanged between the end user and the client's WhatsApp number.
• The end user's phone number, in E.164 format, when the platform provides it.
• The business-scoped user ID (BSUID) — an identifier Meta assigns to an end user for that one client's business. Since 2026, an end user who writes to a business using a WhatsApp username may have their phone number withheld from what the platform sends us; in that case the BSUID is the only identifier of the end user we receive. A BSUID cannot be used to recognize the same person in another business's account.
• Message metadata — timestamps, delivery and read status, and the name and variables of any message template used.
• Account identifiers — the client's WABA ID and phone number ID.

We use this data only to provide the service the client asked for. We do not sell it, we do not use it for advertising, and we do not use it to train our own AI models. Where the client turns on AI features, message content is sent to AI model providers under their API terms (see section 5).

Where it is processed. Conversation data is stored at rest on cloud infrastructure in a Canadian region. Message delivery necessarily runs through Meta's WhatsApp Business Platform, and AI processing runs on providers outside Canada — both are cross-border transfers, set out in section 8.

How long we keep it. Retention is set in the service agreement with the client. Where that agreement is silent, we keep conversation data only as long as needed to provide the service and delete it on the client's instruction. When the service ends we delete or return the data and disconnect from the WABA, which stays with the client.

If you are an end user who messaged a business. The privacy policy that applies to your conversation is that business's, not ours, and that business is also responsible for obtaining your consent to be contacted and for honouring your opt-out. Send access, correction and deletion requests to it. If you write to us instead, we forward your request to the client, assist the client, and tell you we have done so — except where Canadian or Brazilian law gives you a right directly against us.

8. Who we share information with — and cross-border processing

We do not sell personal information. We share information only with suppliers necessary to deliver the service. Our database is hosted by Supabase in Canada (ca-central-1 region), and that is also where WhatsApp conversation data described in section 7 is stored. Some processing nevertheless takes place outside Canada: Google processes AI requests on infrastructure outside Canada and hosts our team's mailboxes, and Cloudflare serves the site and runs the anti-bot check on our forms through its global network. Those flows are cross-border transfers for processing, which we disclose here in line with PIPEDA's transparency requirements. While information is being processed in another country, it may be accessible to the courts, law-enforcement and national security authorities of that jurisdiction. We choose suppliers that offer data processing terms. Google's use of the content sent to the Gemini API is governed by its Gemini API terms (section 5).

The site chat widget is served from yourai-assistpro.pages.dev — that is our own AssistPro platform, hosted on Cloudflare Pages, not a third party. Conversations are stored in our database listed above.

The table above describes our public website and its chat assistant. Conversation data processed for a business client under the WhatsApp Business Platform service (section 7) is held in our cloud provider's Canadian region; Meta and the AI model providers listed above stay in that flow, as described there.

Information may also be disclosed where required by law or by a competent authority, to the extent of the requirement.

Where your data is processed

YourFirstAI Inc. is based in Kitchener, Ontario. The information you give us on this website (quote requests, contact and booking forms, chat conversations and your consent choices) is stored in our database in Canada, in the Canada (Central) region of our cloud provider in Montréal. The emails we send you about your request go out through Amazon Simple Email Service in the same Canadian region.

Some of the services we rely on process information outside Canada, mainly in the United States:

• AI processing. When you chat with our assistant, record a voice brief on the quote page or send a voice note with the free diagnostic, the content is sent to Google's Gemini API to be understood or transcribed. Google's Gemini API terms apply, including keeping it for 55 days to detect misuse of its service. We do not keep the voice recordings from the quote page, and we delete diagnostic voice notes after 90 days. The price you see is calculated from our published catalogue, never by AI.
• Our team's email. Notifications about your request reach our team's mailboxes, which are hosted by Google Workspace.
• Website delivery and protection. Cloudflare serves this website through its global network and runs the anti-bot check (Turnstile) on our forms.
• Analytics, only if you select "Accept" in the cookie banner: Google Analytics 4.
• Payments, only if you pay us: Stripe. We never see or store your card number.

While your information is in another country, it is subject to that country's laws and may be accessed by its courts, law enforcement and national security authorities. Each supplier is bound by contract to protect your information; how Google may use the content sent to the Gemini API is governed by its Gemini API terms (section 5). The table above lists each supplier, its purpose and its location. For questions about this section, or to ask what we hold about you, write to our Privacy Officer at the address in section 2.

9. Cookies and tracking technologies

• Essential: session, security and site operation — including recording your cookie choice and the chat widget's session token (yourai_widget_session, kept in your browser's localStorage). These do not require consent.
• First-party analytics (our own telemetry): if you accept in the banner, our own telemetry records anonymous usage events, with no cookies and without storing your IP address in the events, using only an anonymous visitor hash (a SHA-256 of your session and the day, which changes every day). Raw events are kept for 60 days; after that only aggregated daily counts remain. If you decline, nothing is recorded. We also respect your browser's Do Not Track signal.
• Google Analytics 4: if you select "Accept" in the banner, we also use Google Analytics 4 to measure site audience (pages visited, traffic sources). It uses cookies. Until you accept, the Google Analytics script is not loaded and nothing is sent to Google; if you decline, it is never loaded. We do not use advertising features.

The banner lets you accept and decline with equal ease, with no pre-ticked boxes, and records your choice in the browser. To change your choice, clear this site's data in your browser (the banner will appear again) or write to [email protected].

10. Your rights

Under PIPEDA you may, at any time, request to:

• Know whether we hold personal information about you and access it;
• Know how your information is used and to whom it has been disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw consent, subject to legal or contractual restrictions;
• Unsubscribe from marketing communications at any time;

Send requests to [email protected]; we respond within the time frame in section 2. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (OPC).

11. How long we keep your information

We retain personal information only as long as necessary for the purposes identified and for applicable legal retention periods. When the purpose is fulfilled — or on your request for deletion — the information is deleted or anonymized, except where retention is required by law or to establish, exercise or defend legal claims.

Backups are kept by the infrastructure on their own cycle and expire within a limited window after the original data is deleted.

12. Safeguards

We apply technical and organizational safeguards proportionate to the sensitivity of the information, by design:

• Encryption in transit (HTTPS/TLS) across the site and APIs;
• Encryption at rest on the database provider's infrastructure;
• Data isolation through row-level access policies (Row Level Security);
• First-party analytics with no cookies and no stored IP addresses — only an anonymous, daily-rotating visitor hash (SHA-256);
• Diagnostic audio kept in a private storage bucket, accessible only through expiring links, and deleted after 90 days;
• IP addresses used against abuse kept for no more than 3 days;
• Least-privilege credentials, with API keys kept out of the code and the browser.

13. Security incidents

We maintain records of security incidents involving personal information. Where a breach creates a real risk of significant harm, we notify affected individuals and report to the Office of the Privacy Commissioner of Canada as soon as feasible, in line with PIPEDA's breach-reporting requirements. Where we act as a service provider, we notify the client without delay so it can meet its own obligations.

14. Children

Our services are B2B and not directed at anyone under 18. We do not knowingly collect information from minors. If we learn that a minor's information was collected, it will be deleted. If you believe this has happened, contact [email protected].

15. Changes to this policy

We may update this policy to reflect changes in our services or the law. The date of the last update appears at the top of the page. Material changes — new purposes, new disclosures or changes to cross-border safeguards — will be highlighted on the site or sent by email and, where consent is required, sought again.

16. Governing law

This policy is governed by PIPEDA and the applicable laws of the Province of Ontario and Canada. The Office of the Privacy Commissioner of Canada is the competent authority.