Privacy Policy

Nord Paradigm Inc. (“Nord Paradigm,” “we,” “us”) is committed to protecting your personal information. This policy explains what data we collect, why we collect it, how we use it, and your rights under Quebec’s Act respecting the protection of personal information in the private sector (Loi 25) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

Who We Are

Nord Paradigm Inc. is an AI advisory and governance consultancy federally incorporated in Canada and registered in Quebec (NEQ 1181998668). Our principal place of business is at 393, rue Racine E, 4e étage, Chicoutimi, QC G7H 1T2, Canada.

Person Responsible for the Protection of Personal Information

In accordance with Loi 25, Nord Paradigm has designated the following person as responsible for the protection of personal information:

Dominic-André Leclerc, Founder
Nord Paradigm Inc.
Email: dominic@nordparadigm.com

You may contact this person to exercise your rights under Loi 25 or PIPEDA, ask questions about this policy, or file a privacy complaint.

What We Collect and Why

When You Use Breach (Free)

We collect the company URL you submit, your email address (to deliver your report), and information inferred from publicly available sources about the company (such as industry and location). We do not store your company’s name or identifying details in our internal analytics. Reports used for internal research purposes are stripped of all business-identifying information.

When You Use Breach Pro (Paid)

In addition to the above, we collect the information you provide in the intake form: competitor names, business software you use, employee count range, and your description of current challenges. We also process payment and billing information through our payment provider (see Third-Party Services below). Your generated report is stored to allow you to re-access it.

When You Subscribe to Signal (Newsletter)

We collect your email address to send you our newsletter. Newsletter signup is always separate from product consent. You can unsubscribe at any time.

When Breach Pro is used through an agency partner

Certain partners (marketing agencies, consultants, integrators) use Breach Pro to produce analyses on behalf of their own clients. In this flow:

• The agency partner submits their client’s company URL and intake form responses. No end-customer email address is collected by Nord Paradigm.
• The generated report is delivered to the agency partner’s dashboard. The agency partner is responsible for transmitting it to the end customer through their own communication channels.
• The agency partner acts as data controller with respect to the customer relationship; Nord Paradigm acts as data processor for the end-customer data, and as data controller for the agency partner’s account data.
• The end customer’s rights under Quebec’s Law 25 and PIPEDA (access, correction, deletion, portability, complaint) remain fully applicable and can be exercised either through the agency partner or directly with Nord Paradigm at dominic@nordparadigm.com.
• A data processing agreement governs the relationship between Nord Paradigm and each agency partner, in accordance with Section 18.3 of Law 25.

Website Analytics

We do not currently use website analytics or tracking tools. If we add analytics in the future, we will update this policy and, where required by law, request your consent before placing non-essential cookies.

Automated Processing and AI-Generated Analysis

Our products use artificial intelligence to analyze publicly available information about the company URL you submit and generate a written report.

In accordance with Article 12.1 of Loi 25, we inform you that:

• Your report is generated through automated processing involving large language models and structured analysis pipelines.
• The report constitutes informational analysis, not a binding decision affecting your legal rights, employment, credit, insurance, or eligibility for any service.
• You have the right to request the principal factors and parameters used in producing your report and to submit observations to a person responsible at Nord Paradigm.
• To exercise this right, contact dominic@nordparadigm.com.

Third-Party Services

We use the following service providers to operate our products. Each receives only the minimum data necessary to perform its function. Several are located in the United States; we have assessed the privacy implications of these transfers and have contractual safeguards in place as required by Article 17 of Loi 25.

Important privacy commitments:

• Your payment and billing information is handled entirely by our PCI-DSS compliant payment processor. We never see or store your full card number.
• Your name and email address are never sent to the AI provider.
• No personal identifying information is shared with web scraping or search providers; they receive only company URLs and industry-related search queries.
• Email and newsletter providers receive your email address only.

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

How Long We Keep Your Data

Note on retention enforcement: The retention periods listed above are currently enforced through a manual procedure executed monthly by the person responsible for personal information protection. Automated retention enforcement is in development and will be deployed within 60 days following Breach Pro’s initial commercial launch. Any deletion request submitted under Section 28 of Law 25 is processed within 30 days, regardless of the automated enforcement schedule.

Note on generated reports: PDF reports are not stored persistently on our servers. Each PDF is regenerated on demand from the report’s structured data (JSON) held in our database. The structured data constitutes the record of reference; deleting this data deletes the report.

Your Rights

Under Loi 25 and PIPEDA, you have the right to:

• Access a copy of all personal information we hold about you
• Correct any inaccurate or incomplete information
• Delete your personal information (we will complete deletion within 30 days)
• Withdraw consent at any time (your delivered reports remain yours; we delete the source data)
• Data portability: receive your personal information in a structured, commonly used technological format (Loi 25, in force since September 2024)
• Be informed of automated decisions as described above
• Know what data we collect and how we use it (this policy)
• File a complaint with the Commission d’accès à l’information du Québec (CAI) at cai.gouv.qc.ca, or with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise any of these rights, email dominic@nordparadigm.com. We will respond within 30 days. If we cannot accommodate your request, we will explain why and inform you of your right to file a complaint with the CAI.

Data Security

• All data transmitted to and from our services is encrypted (HTTPS/TLS)
• Payment processing is handled entirely by a PCI-DSS compliant provider
• Report download links are time-limited
• Access to customer data is restricted to authorized Nord Paradigm personnel only
• We have data processing agreements with our service providers
• In the event of a confidentiality incident presenting a risk of serious injury, we will notify the CAI and affected individuals as required by Loi 25

Download links: Report download links are cryptographically signed (JWT, HMAC-SHA256) and remain valid for 30 days from issuance. Anyone in possession of a valid link can access the corresponding report during that period; we recommend treating these links with the same care as a confidential file shared by email. A token revocation mechanism (allowing a link to be invalidated before the 30-day expiry, for example in cases of urgent deletion requests) is in development and will be deployed within 60 days following Breach Pro’s initial commercial launch.

Cookies

We use only strictly necessary cookies required for our products to function (such as session management, security, and payment processing). These do not require consent under Loi 25 or PIPEDA.

We do not currently use analytics cookies, marketing cookies, or any other non-essential tracking. If we add such cookies in the future, we will update this policy and request your consent through a cookie banner before placing any non-essential cookie on your device.

Competitor Data

Our Breach and Breach Pro tools analyze publicly available information from competitor websites that you identify. We access only data that any person could view in a web browser. We do not access login-protected content, scrape social media profiles, or collect personal information about individuals at competitor businesses. Competitor data is used solely within your report and is not retained after generation.

Minors

Our products are intended for businesses and adults. We do not knowingly collect personal information from individuals under 14 years of age. If you believe we have collected information from a minor, contact us immediately.

Changes to This Policy

We may update this policy as our products and legal requirements evolve. The “last updated” date at the top reflects the most recent revision. For material changes, we will provide additional notice (such as a notice on our website or, where appropriate, by email).

Contact

For any questions about this policy or your personal information:

Dominic-André Leclerc
Person responsible for the protection of personal information
Nord Paradigm Inc.
393, rue Racine E, 4e étage, Chicoutimi, QC G7H 1T2, Canada
Email: dominic@nordparadigm.com
Website: nordparadigm.com