Privacy Policy

1. Who we are and the scope of this policy

YourFirstAI Inc. is a Canadian federal corporation based in Kitchener-Waterloo, Ontario. We build AI-powered websites with a working AI agent built in for small businesses (yourfirst.ai).

This policy explains, in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), how we handle the personal information of visitors to our public website yourfirst.ai and of leads who contact us. For services that require a login (client portal and AI tools), the handling of personal information is governed primarily by the service agreement signed with each client — see section 6.

2. Accountability and contact

YourFirstAI Inc. is accountable for the personal information in its custody or control and has designated a Privacy Officer who handles requests and inquiries:

• Privacy Officer: [email protected]
• Mailing address: YourFirstAI Inc., 151 Charles St. W., Suite 100, Kitchener, ON N2G 1H6, Canada

We respond to access and correction requests within a reasonable time and, where required, within 30 days. There is no charge for a routine request.

3. What information we collect on the site

• Contact and lead forms: name, email, phone, company, role and qualification answers (need, estimated budget, decision role and timing).
• Site chat (AssistPro): the chat assistant on this site is our own AssistPro product, embedded as a widget served from yourai-assistpro.pages.dev in an iframe. It stores a session token in your browser's localStorage (yourai_widget_session) so your conversation can continue across pages. The content of your conversation is processed by our platform using the Google Gemini API (see section 5) and stored in our database hosted in the United States (see section 7). You can ask us to delete your conversations at any time.
• Surveys and NPS: your answers and any score you give.
• Meeting booking: name, email and the time slot you choose.
• Payments: when applicable, payments are processed by Stripe; we never store card data.
• Blog search: the terms you search for, to improve our content.
• Lead score: a commercial-priority score calculated automatically from the information you provide (see section 5).
• Free diagnostic — voice notes: if you record a voice note in the free diagnostic, the audio is stored in a private storage bucket, accessible only through expiring links (30 days). It is transcribed by the Google Gemini API and the transcript is attached to your lead record (see section 5).
• Site usage: first-party telemetry we built ourselves (no cookies, no IP addresses stored) and Google Analytics 4 — both only if you accept in the cookie banner (see section 8).

4. Why we use your information and our lawful basis

Under PIPEDA we rely on your consent — express or implied — and on limited exceptions permitted by law. We identify the purpose before or at the time we collect your information:

We do not use your information for purposes incompatible with those identified. If a new purpose arises, we will inform you and, where consent is required, seek it again. You may withdraw consent at any time, subject to legal or contractual restrictions (section 9).

5. Artificial intelligence on the site

Three site features involve AI processing of your information:

• Chat assistant (AssistPro): the messages you send are processed by our AssistPro platform using the Google Gemini API, on infrastructure outside Canada (see section 7). We use the API under terms that prohibit using the content to train the provider's models. We also do not train AI models on your data. The assistant is an AI — do not enter sensitive data (health, biometrics, etc.), third-party documents, passwords or financial data in the chat.
• Voice-note transcription: voice notes submitted in the free diagnostic are transcribed by the Google Gemini API, under the same terms — the content is not used to train the provider's models. The transcript is attached to your lead record.
• Automated outputs: the lead score (a commercial-priority score generated from the qualification details you provide) is produced automatically. It does not use sensitive attributes and does not, on its own, produce any exclusionary or discriminatory effect — commercial contact is always handled by people.

You can ask about the logic behind any automated output, and request human review, by writing to [email protected].

6. Authenticated services (Portal and tools)

Our client portal and AI tools require a login and are provided under agreements with business clients. In those cases, the handling of personal information is governed by the service agreement and data processing terms signed with each client — in many of them YourFirstAI acts as a service provider, on behalf of and under the instructions of the client, who is accountable for the information and for its own privacy policy.

If you use one of these tools as an employee or end user of a client of ours, the applicable privacy policy is generally the client's. Requests we receive in that context are forwarded to the client, whom we assist. To understand which regime applies to your case, write to [email protected].

7. Who we share information with — and cross-border processing

We do not sell personal information and no supplier has any secondary-use right over it. We share information only with suppliers necessary to deliver the service. Our database and processing run on infrastructure located in the United States and other jurisdictions outside Canada: Supabase hosts our database in the United States (us-east-2 region), Google processes AI requests on infrastructure outside Canada, and Cloudflare serves the site through its global network. Each flow is therefore a cross-border transfer for processing, which we disclose here in line with PIPEDA's transparency requirements. While information is being processed in another country, it may be accessible to the courts, law-enforcement and national security authorities of that jurisdiction. We choose suppliers that provide data processing agreements and contractual protections comparable to Canadian standards.

The site chat widget is served from yourai-assistpro.pages.dev — that is our own AssistPro platform, hosted on Cloudflare Pages, not a third party. Conversations are stored in our database listed above.

Information may also be disclosed where required by law or by a competent authority, to the extent of the requirement.

8. Cookies and tracking technologies

• Essential: session, security and site operation — including recording your cookie choice and the chat widget's session token (yourai_widget_session, kept in your browser's localStorage). These do not require consent.
• First-party analytics (our own telemetry): if you accept in the banner, our own telemetry records anonymous usage events — no cookies, no IP addresses stored — using only an anonymous visitor hash (a SHA-256 of your session and the day, which changes every day). Raw events are kept for 60 days; after that only aggregated daily counts remain. If you decline, nothing is recorded. We also respect your browser's Do Not Track signal.
• Google Analytics 4: if you accept in the banner, we also use Google Analytics 4 to measure site audience (pages visited, traffic sources). It uses cookies and is configured with Consent Mode — until you accept, analytics storage stays denied and no analytics cookies are set — and with IP anonymization. We do not use advertising features. If you decline, GA4 does not collect anything.

The banner lets you accept and decline with equal ease, with no pre-ticked boxes, and records your choice in the browser. To change your choice, clear this site's data in your browser (the banner will appear again) or write to [email protected].

9. Your rights

Under PIPEDA you may, at any time, request to:

• Know whether we hold personal information about you and access it;
• Know how your information is used and to whom it has been disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw consent, subject to legal or contractual restrictions;
• Unsubscribe from marketing communications at any time;
• Ask about the logic of any automated output and request human review.

Send requests to [email protected]; we respond within the time frame in section 2. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (OPC).

10. How long we keep your information

We retain personal information only as long as necessary for the purposes identified and for applicable legal retention periods. When the purpose is fulfilled — or on your request for deletion — the information is deleted or anonymized, except where retention is required by law or to establish, exercise or defend legal claims.

Backups are kept by the infrastructure on their own cycle and expire within a limited window after the original data is deleted.

11. Safeguards

We apply technical and organizational safeguards proportionate to the sensitivity of the information, by design:

• Encryption in transit (HTTPS/TLS) across the site and APIs;
• Encryption at rest on the database provider's infrastructure;
• Data isolation through row-level access policies (Row Level Security);
• First-party analytics with no cookies and no stored IP addresses — only an anonymous, daily-rotating visitor hash (SHA-256);
• Diagnostic audio kept in a private storage bucket, accessible only through expiring links;
• Least-privilege credentials, with API keys kept out of the code and the browser.

12. Security incidents

We maintain records of security incidents involving personal information. Where a breach creates a real risk of significant harm, we notify affected individuals and report to the Office of the Privacy Commissioner of Canada as soon as feasible, in line with PIPEDA's breach-reporting requirements. Where we act as a service provider, we notify the client without delay so it can meet its own obligations.

13. Children

Our services are B2B and not directed at anyone under 18. We do not knowingly collect information from minors. If we learn that a minor's information was collected, it will be deleted. If you believe this has happened, contact [email protected].

14. Changes to this policy

We may update this policy to reflect changes in our services or the law. The date of the last update appears at the top of the page. Material changes — new purposes, new disclosures or changes to cross-border safeguards — will be highlighted on the site or sent by email and, where consent is required, sought again.

15. Governing law

This policy is governed by PIPEDA and the applicable laws of the Province of Ontario and Canada. The Office of the Privacy Commissioner of Canada is the competent authority.