Privacy Policy

1. Introduction

This Privacy Policy describes how Gid Solutions, Inc., a Delaware corporation operating as "Gid AI" ("we", "our", or "us"), with its principal place of business at 390 Henri-Bourassa, Papineauville, Quebec, Canada, J0V 1R0, collects, uses, shares, and protects information when you use the Gid platform, our AI-assisted hospitality operations and employee engagement service.

We built Gid with privacy by design and aim to be transparent about every piece of data we touch. This Policy is read alongside our Terms of Service, our Data Processing Agreement, our list of Sub-processors, and our Acceptable Use Policy.

2. Information We Collect

We collect information through three channels, and no others: directly from you, when you create an account, complete your profile, write a message, upload a file or record audio; from your employer or workspace administrator, who may enter your role, schedule, compensation and employment records on your behalf; and automatically from your use of the service, as your device and our servers generate usage, diagnostic and technical data. We do not buy personal information from data brokers, and we do not collect data about you from advertising networks or social platforms. The one exception is the ad click reference that Google or ChatGPT adds to a link when you click one of our ads: we keep it only if you accept ad measurement, as described in Website Analytics and Ad Measurement (Section 3).

Account and Profile Information

• Contact details (name, email, phone number and address)
• Profile details you or your organization provide, such as date of birth, emergency-contact information, role and employment information
• Company information (business name, locations, role and industry)
• Account credentials and authentication data
• Profile preferences and settings

Workforce, Financial and Operational Information

• Scheduling, attendance, time-clock and training records
• Salary, wage, hourly-rate, tip-sharing and other compensation information when your organization uses those features
• Your organization's subscription, billing and transaction records, payment status and processor references. These are held against the organization rather than against an individual user, and Gid does not store raw payment-card numbers
• POS, PMS, reservation, sales and other operational records when the corresponding integrations or features are used

Guest Allergen and Dietary Information

• Allergen and dietary information recorded about menu items, recipes, suppliers and restaurant guests, for reservation, menu, training and operational food-safety workflows
• This information describes dishes and restaurant guests. It is not health information about the people who use Gid, and Gid does not collect health information about its users

User Content and Communications

• Team messages, AI conversations, support requests, feedback and abuse-report notes
• Photos, videos, audio recordings, transcripts, files and documents you upload or create
• Training submissions, task content and other user-generated operational content

Service Usage Data

• Training session participation and progress
• Communication and delivery logs (SMS, email, push, voice and app interactions)
• Performance metrics and feedback
• Feature usage, navigation and other app interactions

Technical Information

• Device and browser information, push tokens and device or other identifiers
• IP addresses, used transiently to rate-limit requests and prevent abuse, and retained only as a one-way hash. Gid does not infer, derive or store any geographic location from them, and the apps request no location permission on either platform
• Usage analytics, app interactions and system performance data
• Crash logs, diagnostics, log files, error reports and security events

3. How We Use Your Information

Service Delivery

• Provide personalized AI coaching and training
• Generate insights and performance analytics
• Facilitate communication between team members
• Optimize scheduling and workforce management

AI Processing (Gid Assistant)

Gid's assistant features are powered by AI models operated by third-party providers. When, and only when, you use an AI feature, the content that feature needs is transmitted to the AI provider selected for that request, for the sole purpose of generating the response returned to you. The providers are named in Section 5.

• What is sent: the text you write in an AI feature; images and documents you submit for analysis; audio you record when you use a voice feature; and the workspace context required for that specific request, which may include schedule, task, training or teammate information relevant to what you asked.
• When it is sent: only at the moment you use an AI feature. Gid does not send your content to an AI provider in the background, on a schedule, or while you are not using the assistant.
• What it is used for: generating the response to that request, and nothing else. The AI providers act solely as our processors. They are contractually prohibited from using your content to train or improve their models, and OpenAI additionally operates under a zero data retention arrangement for our API traffic.
• Your permission comes first: Gid asks for your explicit permission inside the app, on a screen that names the providers and describes the data, before any content is sent to an AI provider. If you decline, AI features remain off and the rest of Gid keeps working. See Section 6 to withdraw permission at any time.

We do not sell your personal information, and we do not monetize it. Your content (messages, files, recordings, AI conversations and workplace records) is never shared with any third party for advertising or profiling, and is never used to train Gid's own models or the models of any provider. The only advertising use of personal information is the ad measurement described just below, and it runs only if you accept it.

Website Analytics and Ad Measurement (only if you accept)

When we advertise on Google or on ChatGPT, we want to know which ads lead to a Gid workspace and to a paid subscription, so that we only pay for ads that work. We measure this only if you choose Accept analytics in the cookie banner on gidai.ca. If you choose Decline, or if your browser sends a Do Not Track or Global Privacy Control signal, none of what follows happens.

• Where: on our website (www.gidai.ca and gidai.ca) and in the sign-up flow of the Gid web app (app-gidai-ca.web.app). Never in the Android or iOS apps, which share no data with advertising platforms, and never on test or preview sites.
• What we measure: the pages you view and the sign-up buttons you click on our website; that you started and finished creating a Gid workspace in the web app; and that a first paid Founders subscription started, with its plan, amount, currency and number of locations.
• Which platforms: Google (Google Analytics 4, and Google Ads, which imports our conversions, a workspace created and a paid subscription, from Google Analytics) and OpenAI (ChatGPT Ads, through the OpenAI measurement pixel on gidai.ca and the OpenAI Conversions API).
• What your browser sends, after you accept: Google Analytics and the OpenAI pixel load in your browser and report the pages you view and your interactions with them, together with their own cookies (listed below). Like any web request, this lets Google and OpenAI see your IP address and browser type. The OpenAI pixel runs only on our product and guide pages, the pages our ads link to. It never runs on our home page, our Founders page, our legal and privacy pages, our contact or account pages, or any page with a form, in English or Hindi, and it stops as soon as a form field appears on a page. It also loads only if its own configuration confirms that automatic matching is switched off, so it never reads what you type into forms.
• What our servers send, after you accept: a conversion when a workspace is created, or a first paid subscription starts, after a visit you accepted. To OpenAI, only if you arrived from a ChatGPT ad: the ad click reference that ChatGPT added to the link you clicked, the type and time of the event, a one-way event reference that does not reveal Gid's internal references, and, for a paid subscription, the plan, amount and currency. To Google, for a paid subscription only: its time, the Google Analytics identifier of your browser, the plan, amount, currency and number of locations, a transaction reference (the Stripe payment session reference), the campaign labels (utm values) of the ad that brought you, and the name of the sign-up button you clicked. For a visit you did not accept, our servers send nothing to any advertising platform.
• What is never sent: your name, email address, phone number, postal address, payment card details, or any workspace content (messages, files, schedules, training records or AI conversations). Our servers never send your IP address or your browser's user agent to an advertising platform.
• Cookies and browser storage: Google Analytics sets its _ga cookies. The OpenAI pixel sets __oppref (the ad click reference, kept 30 days) and __obref (a random browser reference, kept 365 days). Our site keeps your choice in your browser for 12 months (gid_consent_v1). If you accept, the same record holds a random consent reference: it identifies nothing but that choice, travels with your sign-up so that a later withdrawal can find the records it produced, and is never sent to Google or OpenAI. If you accept, the site also keeps the details of your first visit from an ad (its campaign labels, ad click reference, landing page and time) for 90 days (gid_first_touch_v1), so that a sign-up a few days later can still be matched to that ad. If you later decline, gid_consent_withdrawal_v1 holds that withdrawal until our server confirms it.
• How long we keep it: see Section 7.
• How to withdraw: open Cookie preferences at any time (it is also in the footer of every page) and choose Decline. Measurement stops at once, the Google Analytics and OpenAI cookies on gidai.ca are deleted, the stored first ad visit is forgotten, the Gid web app is told on your next sign-up click, and your browser sends your consent reference to Gid's servers. From then on, no later conversion is sent for that visit or for a workspace it created: its records stay on our servers marked as withdrawn and are deleted with the workspace. A Do Not Track or Global Privacy Control signal over an earlier Accept does the same. What was already sent before you withdrew stays with Google or OpenAI under their own policies. If your browser's storage was cleared after you accepted, it can no longer send that reference: email privacy@gidai.ca and we will withdraw it for your workspace.
• Your consent is the legal basis: in Canada, your express consent under PIPEDA; in the EU and the UK, your consent under the GDPR and the ePrivacy rules; in India, your consent under the Digital Personal Data Protection Act, 2023, which you can withdraw as easily as you gave it. The rules for U.S. states are in Section 9.B.

Google and OpenAI receive this data under their advertiser terms and may also use it for their own purposes, as their privacy policies describe (see how Google uses information from sites that use its services and the OpenAI privacy policy). OpenAI, for example, says it uses information it receives from advertisers to measure and improve the ads shown in ChatGPT. Sections 5 and 9.B explain what that means for your rights.

Platform Improvement

• Analyze usage patterns to improve our services
• Develop new features and capabilities
• Ensure system reliability and performance
• Conduct security monitoring and threat detection

Communication

• Send service updates and important notices
• Provide customer support and technical assistance
• Share product updates and new features

4. Data Infrastructure and Security

Cloud Infrastructure

We utilize enterprise-grade cloud infrastructure to ensure data security and availability:

• Google Cloud Platform: Primary hosting and data processing
• Firebase: Real-time database and authentication services

Security Measures

• Encryption in transit and provider-managed encryption at rest; this is not a claim of end-to-end encryption
• Role-based access controls and multi-factor authentication where configured
• Code review, automated checks, monitoring, and incident-response procedures; Gid does not claim an independently certified security program
• Google Cloud and Firebase provider certifications apply only to services included in the providers' published scope; they do not certify Gid
• Provider-managed resilience plus backup and recovery controls where configured

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data only in these limited circumstances:

Service Providers

• Trusted third-party services that process data on our behalf to operate the platform, subject to their function and our contractual arrangements
• Cloud infrastructure providers (Google Cloud, including Firebase)
• Third-party AI providers, named individually below
• Analytics, diagnostics and monitoring services
• Email, SMS, push-notification and customer-support services
• Payment processors and billing services

Our current provider inventory and processing purposes are listed on the Sub-processors page. We do not treat a service-provider transfer as a sale of personal information.

Text messages about reservations are described in our Terms, section Text messages (SMS).

Third-Party AI Providers

When you use an AI feature, the content described in Section 3 is transmitted to one of the following providers, each of which acts solely as our processor and handles that content only on our documented instructions:

• OpenAI, L.L.C. — prompt content, conversation context and system instructions. Contracted under a zero data retention arrangement, with no training on customer data.
• Anthropic, PBC — prompt content, conversation context and system instructions. No training on customer data.
• Google LLC (Vertex AI / Gemini API) — prompt content, conversation context and system instructions. No training on customer data, under Google Cloud enterprise terms.

These providers receive your content to generate a response and for no other purpose. They do not receive it for their own commercial use, they do not use it to train or improve their models, and none of these transfers is a sale of personal information. Per-vendor terms, data locations and safeguards are itemized on the Sub-processors page.

Advertising Platforms (only if you accept)

If you accept ad measurement, the limited data described in Section 3 goes to Google LLC (Google Analytics 4 and Google Ads) and to OpenAI (ChatGPT Ads). Unlike our service providers, these platforms are not limited to acting on our instructions: they receive the data under their advertiser terms and may also use it for their own purposes, as their own privacy policies describe. That is why this measurement never runs without your consent, and why we treat it as "sharing" under California law (Section 9.B). The Android and iOS apps share no data with advertising platforms.

Protection Required of Every Third Party

We confirm that every third party with whom we share user data, other than the two advertising platforms described just above, is bound by a written agreement requiring it to provide the same or equal protection of user data as is stated in this Privacy Policy and as required by applicable app store guidelines and data protection law. This includes the AI providers named above, cloud infrastructure providers, communication services and any parent, subsidiary or related entity that may access user data. Those agreements impose confidentiality, security safeguards, use limited to the purpose we specify, restrictions on onward transfer, and deletion or return of the data at the end of the engagement. Where a service provider cannot meet that standard, we do not share user data with it.

Legal Requirements

• When required by law, regulation, or legal process
• To protect our rights, property, or safety
• To prevent fraud or security threats

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

6. Your Rights and Choices

Access and Control

• Access: Request copies of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Request eligible personal data in a structured, commonly used format
• Restriction: Limit how we process your information

Withdrawing Your Permission for AI Processing

You can withdraw your permission for AI processing at any time, from inside the app, without deleting your account. Open Settings › Gid Assistant & Data Sharing and choose Withdraw Gid assistant permission.

• The withdrawal applies to your account immediately. Any AI session in progress ends, and no further content from your account is sent to an AI provider.
• Gid keeps working without AI: schedules, tasks, training records and human team chat all remain available. AI-powered features become unavailable or fall back to a limited non-AI behaviour.
• The choice is yours alone and applies only to your account. It does not change your teammates' accounts, and it does not delete workplace records your employer keeps.
• You can grant permission again at any time from the same screen. The same screen also shows your current status and repeats the disclosure of what is sent and to whom.

Permission is requested before any content is sent to an AI provider — during workspace signup, when an invited employee joins, and again at first use of an AI feature if no choice has been recorded. Declining is always available and never blocks access to the rest of the service.

Account Deletion

Account deletion is available to all users in all regions, regardless of whether GDPR, CCPA, PIPEDA, or DPDP applies to you. You can request deletion of your account and in-scope personal data using any of these methods:

• In the app (primary path): Account Settings → Delete My Account. This is the primary in-app control for the account-deletion functionality required by Apple App Store Guideline 5.1.1(v) and Google Play's account-deletion policy.
• Online, no login required: Visit www.gidai.ca/delete-account. The web form is publicly reachable so users who have uninstalled the app can still request deletion.
• By email: Send a request to privacy@gidai.ca with the subject line "Account Deletion Request".

The first-party deletion process targets account credentials, personal profile information, training records, scheduling data, and user-generated content attributable to you within the request scope, including:

• Chat messages and channel posts you authored;
• Voice-agent transcripts and call recordings tied to your account;
• Training submissions and capsule responses;
• Uploaded media (avatars, files, images, documents);
• Any custom configurations or preferences attached to your profile.

There is one 30-day grace window, which starts only after an authenticated in-app request or after you open the one-time link requested from the public web form. During that window, cancel using the link in the grace-start email. After the window, the next scheduled daily purge attempts first-party deletion; failed required steps remain open for retry. An applicable legal hold or an active, unresolved content-safety or security report concerning the deletion subject can pause destructive processing so required evidence is not destroyed. Provider and analytics erasure or lawful-retention verification can remain open after first-party deletion.

• Restricted billing, POS transaction and cash-reconciliation records, tip-sharing/payroll allocations, policies, ledgers, source-integrity evidence, and related audit records for up to 7 years where required for tax, accounting, payroll, compliance, fraud, or legal purposes;
• A restricted deletion-control record that temporarily retains the account identifier, email, and membership proof only while external erasure or retention is being completed and evidenced;
• After that verification, a minimized seven-year deletion lifecycle record containing a hashed email and timestamps;
• Hashed email on our suppression list, so we never re-contact you after deletion.

Retained records are restricted to the stated operational, evidentiary, security, or legal purpose and are not used to continue providing the deleted account. Full retention details are in Section 7.

Communication Preferences

• Opt out of marketing communications
• Control notification settings
• Manage data sharing preferences

7. Data Retention

We retain your information only as long as necessary to:

• Provide our services and support your account
• Comply with legal obligations
• Resolve disputes and enforce our agreements
• Improve our services and security

Typically, we retain:

• Account data: While your account is active and during the single 30-day deletion grace window; first-party deletion is then attempted by the scheduled daily purge, subject to required retries and lawful holds
• Usage analytics: 24 months
• Communication logs: 12 months
• Ad measurement, only if you accept it: in your browser, the details of your first visit from an ad for 90 days, the OpenAI pixel cookies for 30 days (ad click reference) and 365 days (browser reference), and the Google Analytics cookies for up to 2 years. On our servers, a workspace's ad reference and its conversion records are kept while the workspace exists (marked as withdrawn if you withdraw), are included when we answer a data access request for it, and are deleted with it; a withdrawal also leaves an anonymous note (the random consent reference, a label and a time) so that the reference can never be used again. Google and OpenAI keep what they received under their own retention policies.
• Restricted financial and payroll evidence: up to 7 years where required. This can include billing, closed POS checks and payments, cash sessions and end-of-day reports, tip-sharing allocations, policies, ledgers, source manifests, and related compliance or audit evidence. These records are not used to continue the deleted account; the deletion workflow stores a count-only inventory and Privacy Operations must evidence a necessity review at least annually.

8. International Data Transfers

We primarily operate in Canada, the United States, and India. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard contractual clauses approved by data protection authorities
• Adequacy decisions from relevant regulatory bodies
• Certification schemes and codes of conduct

9. Compliance and Regulations

We comply with applicable data protection laws, including:

• GDPR: European General Data Protection Regulation (EU and UK)
• CCPA: California Consumer Privacy Act
• PIPEDA: Personal Information Protection and Electronic Documents Act (Canada, federal)
• DPDP: Digital Personal Data Protection Act, 2023 (India)
• Industry standards: Restaurant and hospitality data protection requirements

9.A Your data subject rights and how to exercise them

Wherever you live, you have the same operational toolkit to control your personal data. We acknowledge rights requests within 72 hours and provide the formal response within 30 days. Account deletions include a separate 30-day grace window in case you change your mind.

Right of access and portability (Quebec Law 25, GDPR Art 20 where applicable, PIPEDA Principle 9, DPDP Section 11)

You may submit a verified request for access to your personal data or, where the applicable portability right applies, receive eligible personal data in a structured, commonly used, machine-readable format.

• Request instructions: Visit gidai.ca/data-export or email privacy@gidai.ca from the address associated with your account using the subject "Personal Data Access Request".
• Identity and scope review: Our privacy team verifies the requester and determines the personal data in scope without disclosing another person's confidential information or unrestricted company-wide records.
• Response time: We acknowledge requests within 72 hours and provide the formal response within 30 days.
• Security exclusions: Password hashes, access tokens, API keys, security credentials, and other secrets are never included.

Right to erasure (GDPR Art 17, PIPEDA Principle 9, DPDP Section 12)

Request permanent deletion of your account and in-scope personal data. We use one 30-day grace window so a verified request can be cancelled before destructive processing begins.

• Inside the Gid app: Account Settings, then "Delete my account". You confirm by typing your email and acknowledging the consequences.
• From the web: gidai.ca/delete-account. Submitting the form requests a one-time secure link; opening a valid link starts the grace period.
• Cancel within the 30-day grace period using the link Gid attempts to send in the separate grace-start email. After the grace period, the scheduled daily purge attempts first-party deletion. Failed steps are retried, and applicable legal holds suspend destructive processing.
• Request scope: an employee or non-Founder request is user-only. A Founder request defaults to the selected company workspace and company-scoped content, as explained on the deletion page.
• Stripe subscription: for a recognized Founder account, the service attempts cancellation when the grace period starts. Cancelling deletion does not automatically restore the subscription.
• External verification and audit: after first-party deletion, limited identifiers are temporarily retained in a restricted control record solely to complete and evidence provider and analytics erasure or lawful retention. They are removed when that work is evidenced; a minimized lifecycle record with a hashed email and timestamps is retained for seven years.

Right of access, correction, restriction, and objection

Email privacy@gidai.ca with the right you want to exercise. We acknowledge requests within 72 hours and provide the formal response within 30 days, in line with GDPR Art 12, PIPEDA's Openness principle, and DPDP Section 13. Account deletion follows the separate grace, purge, hold, and external-verification lifecycle described above.

India Grievance Officer (DPDP Section 13)

Our designated Grievance Officer is Alexandre Verville, founder, reachable at privacy@gidai.ca. Response time: 72 hours. If your concern is not resolved, you may contact the Data Protection Board of India.

Cookie consent

We do not load any analytics or ad-measurement technology (Google Analytics or the OpenAI pixel) until you accept it in the consent banner shown on your first visit. Your choice, Accept or Decline, is kept for 12 months, and then we ask again. We also decline automatically, without showing the banner, when your browser sends a Do Not Track or Global Privacy Control signal, and that signal wins over an earlier Accept. You can change your choice anytime by clicking Cookie preferences; choosing Decline also deletes the Google Analytics and OpenAI cookies set on gidai.ca and tells our servers, so that nothing more is sent for that visit. What each choice covers is described in Section 3.

Suppression list

If you exercise your right to erasure or unsubscribe from our cold-email outreach, your email address (hashed) is added to a global suppression list. We will never contact you again unless you explicitly subscribe back. This protects you from accidental re-engagement after deletion.

9.B U.S. state privacy rights

If you are a resident of a U.S. state with a comprehensive privacy law — including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or Montana — you have specific rights regarding your personal information. We honor these rights for all U.S. residents, regardless of state of residence, to simplify the experience.

Your rights

• Right to know. Request a list of the categories of personal information we collect, the sources, the purposes, and the categories of third parties we share with.
• Right of access. Request a copy of the specific pieces of personal information we have collected about you in the preceding 12 months (24 months for California requests from January 2024 onward).
• Right to delete. Request that we delete personal information we have collected from you.
• Right to correct. Request that we correct inaccurate personal information.
• Right to opt out of sale, sharing, and targeted advertising. We do not sell personal information. We do share limited data with Google and OpenAI to measure our own ads, only if you accept it (Section 3). We treat that as "sharing" for cross-context behavioral advertising under California law, and we honor the same opt-out wherever another state's law could call it a "sale" or "targeted advertising" (see "How we read these laws for ad measurement" below). It is off unless you accept it, and you can opt out at any time: choose Decline in Cookie preferences, turn on Global Privacy Control in your browser, or email privacy@gidai.ca with the subject line "Do Not Sell or Share".
• Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes that require an opt-out under California, Connecticut, or Colorado law.
• Right to opt out of profiling that produces legal or similarly significant effects. We do not engage in such profiling. Some features may inform managerial decisions; final decisions are made by a human, and AI outputs are advisory only (see Terms Section 5).
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights (such as by denying service, charging different prices, or providing a lesser quality of service).
• Right to appeal. If we deny your request, you may appeal the decision by replying to our response with "Appeal" in the subject line. We will respond within 45 days. Required appeal mechanism under Virginia, Colorado, and Connecticut law; we honor it for all U.S. residents.

How to exercise your rights

• In the Gid app: Account Settings → "Delete my account" for account deletion.
• From the web: gidai.ca/data-export for access and portability request instructions, or gidai.ca/delete-account for account deletion.
• By email: privacy@gidai.ca with the right you want to exercise in the subject line.
• Why there is no phone line: Gid operates exclusively online and has a direct relationship with the consumers from whom it collects personal information, so under the CCPA regulations at 11 CCR § 7020(c) an email address is the required method for submitting requests. Use privacy@gidai.ca.

Identity verification

To protect you, we verify the identity of the requester before disclosing or deleting personal information. For account-holders, we begin with the email associated with the account and may use authenticated account records or request the minimum additional information needed. If we cannot reasonably verify identity, we will inform you and explain why.

Authorized agents

You may use an authorized agent to submit a request on your behalf. We require the agent to provide a signed written authorization from you (or, in California, a power of attorney). We will still verify your identity directly before fulfilling the request.

Universal opt-out signals

We honor Global Privacy Control (GPC) as a valid request to opt out of sale, sharing and targeted advertising, for every visitor, wherever you live. On our website and in the Gid web app, a browser that sends GPC or Do Not Track never loads Google Analytics or the OpenAI pixel and never sees the consent banner, and the signal wins over an earlier Accept, which is then withdrawn on our servers as well.

How we read these laws for ad measurement

We do not sell personal information: no one pays us for it. California law, however, defines "sharing" broadly: giving an advertising platform data about your activity on our website, when the platform may also use that data for its own purposes, can count as "sharing" for cross-context behavioral advertising, even when our only goal is to measure our own ads. So we take the cautious reading and treat our ad measurement as sharing. Some regulators have also called this kind of exchange a "sale", and some state laws could call it "targeted advertising". We do not see it that way, but we give you the same opt-out whichever reading applies, and we give it to every U.S. resident. In practice, you are opted out unless you accept, and a Global Privacy Control signal always opts you out.

The personal information we share for ad measurement, only if you accept it, is: identifiers (the Google Analytics identifier of your browser, the ad click reference, the OpenAI pixel's browser reference and a one-way event reference); internet activity on our website (pages viewed and sign-up clicks); and commercial information (the plan, amount, currency and number of locations of a first paid subscription). We share it with advertising platforms (Google and OpenAI) to measure our ads. We do not sell or share the personal information of anyone we know to be under 16.

Categories of personal information we collect (CCPA §1798.110)

• Identifiers: name, email, phone, account identifier, and IP addresses retained only as a one-way hash; and, only if you accept ad measurement, the online identifiers listed in "How we read these laws for ad measurement" above.
• Customer records (Civil Code § 1798.80(e)): employment role, work address, work phone.
• Protected classifications: only where the Customer chooses to record them for compliance purposes (such as EEO categories).
• Commercial information: billing and subscription records, held against the subscribing organization rather than against an individual user.
• Internet or other network activity: log files, request metadata, feature usage; and, only if you accept analytics, the pages you view and the sign-up buttons you click on our website.
• Geolocation: none. We collect neither precise nor approximate geolocation, we derive no location from IP addresses, and the apps request no location permission.
• Audio, electronic information: chat messages, voice transcripts (when Customer enables voice features).
• Professional or employment information: schedules, training records, performance metrics.
• Inferences: generated from the above for the purposes of providing the Service (such as suggested training topics).

We do not collect "sensitive personal information" categories beyond what is strictly necessary for the Service (such as account credentials, which CCPA classifies as sensitive). We do not use sensitive personal information to infer characteristics about you.

Retention

See Section 7 (Data Retention) above. For California consumers, the retention periods listed there constitute the disclosure required by CCPA § 1798.130(a)(5)(D).

Notice at collection

This Policy serves as our "notice at collection" under CCPA § 1798.100(b). We collect categories of personal information only for the purposes described in Section 3 (How We Use Your Information), including the ad measurement you can accept or decline.

Quebec Law 25 specific rights

For Quebec residents, in addition to the rights above, we provide:

• Privacy Officer / Person in charge of personal information: Alexandre Verville, privacy@gidai.ca;
• Privacy Impact Assessment obligations for new technologies, automated decisions, and confidential disclosures, conducted as required by Law 25;
• Right to be informed of automated decisions that produce legal effects. Where Gid uses AI features that materially influence a decision about you, we will inform you and explain the principal factors and parameters on request;
• Right to data portability in a structured, commonly used technological format (see § 9.A "Right to portability");
• Complaints may be filed with the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.

10. Children's Privacy

Our services are designed for business use and are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it promptly.

11. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will:

• Notify you of material changes via email or platform notification
• Post the updated policy on our website
• Update the "Last Updated" date at the top of this policy

Your continued use of our services after such changes constitutes acceptance of the updated policy.

12. Contact Us