Skip to content
Academic Intelligence
Request a policy health check

Privacy

Privacy Policy

At Academic Intelligence, we build policy management software for Canadian post-secondary institutions. We recognize that trust depends on transparency, strict data governance, and compliance with federal and provincial access and privacy standards.

Last updated: November 2026

This policy outlines our privacy practices for both our public marketing website and the Academic Intelligence Application.

1. Public Marketing Website

Data Collection & Use

When you interact with our website (academicintelligence.ca), we collect limited information to provide requested services:

  • Form Submissions: When you request a Policy Health Check or book a demonstration, we collect your name, work email address, job title, and institution.
  • Newsletter Subscriptions: Marketing updates and newsletters operate on a strict double opt-in basis under CASL (Canadian Anti-Spam Legislation). You will only receive newsletter communications after confirming your subscription via email.

Zero-Cookie & Analytics Stance

  • No Tracking Cookies: We do not deploy tracking cookies, persistent identifiers, or cross-site advertising scripts.
  • Privacy-Preserving Analytics: We use PostHog to see how the public website is used. It records which pages are viewed, which sites send visitors to us, and the general type of browser and device. PostHog runs in its EU Cloud in Frankfurt, Germany. It is set to cookieless mode, so it sets no cookies and stores nothing in your browser. To count visitors, PostHog's servers turn your IP address and browser details into a one-way code, using a salt that changes every day and is deleted once that day's events are processed. The code cannot be reversed, and it cannot follow you from one day to the next. Your IP address is not stored with analytics events. We do not build visitor profiles, record sessions or clicks, or use analytics for advertising. Analytics are used on this public website only, never inside the Academic Intelligence Application.
  • Server Logs: Standard web server routing logs (such as IP address, browser type, and requested pages) are processed temporarily by our hosting environment solely for performance, rate limiting, and security monitoring, and are routinely discarded.

Infrastructure & Residency

Public website assets, form processing API endpoints, and static content are hosted using Google Cloud Platform (GCP) infrastructure located strictly within the Montréal region (northamerica-northeast1). Website analytics are the one exception. They are processed by PostHog in the EU (Frankfurt, Germany), as listed on our Data Residency & Sub-processors page.

2. Academic Intelligence Platform

For our SaaS platform, Academic Intelligence, acts as a Data Processor (Service Provider) handling institutional records on behalf of post-secondary institutions, who act as the Data Controller.

Data Ownership & Tenancy

  • 100% Institutional Ownership: Your institution retains exclusive ownership over all uploaded policies, procedures, draft documents, metadata, and user account records.
  • No Secondary Commercial Use: Customer data is never sold, leased, or used for secondary commercial purposes.
  • Logical Data Isolation: Customer databases are hosted via Supabase in the AWS Canada (Central / Québec) region. Strict database-level Row Level Security (RLS) guarantees complete multi-tenant isolation between institutional accounts.
  • Canadian Identity & Authentication: Account authentication and identity sessions are managed through Kinde utilizing their dedicated Canadian data cluster.

AI & Data Processing Boundaries

  • AI Training: Institutional data and document texts are never used to train AI models.
  • Task-Specific AI Usage: AI functionality runs exclusively via Google Gemini under enterprise API terms. For a complete task-by-task breakdown of AI usage, parameters, and human-in-the-loop controls, visit our AI Transparency page.

3. Data Retention, Export & Deletion

Contract Termination & Grace Period

Upon contract expiration or termination, your account enters a 30-day Grace Period:

  • Self-Service Export: Designated account administrators retain read-only access to export all institutional policy text, metadata, and audit logs in standard self-service formats (JSON/CSV) at no charge.
  • Custom Offboarding Services: If your institution requires non-standard data formatting, custom database dumps, or dedicated engineering extraction, services are available under a separate Statement of Work at our standard Professional Services hourly rate.
  • Secure Destruction: On the 31st day following termination, production data is permanently purged from active databases. Automated database backup snapshots are permanently overwritten according to our standard 30-day backup retention cycle.

4. Security Incident & Breach Protocol

In the event of a confirmed security incident or unauthorized access involving customer institutional data:

  • Notification Window: Academic Intelligence will notify the designated institutional contact and Privacy Officer in writing without undue delay, and no later than 24 hours after confirming a breach.
  • Incident Reporting: Initial communications will detail the nature and scope of the event, affected data types, immediate mitigation steps, and an ongoing technical point of contact.
  • Statutory Support: We assist institutions in fulfilling statutory obligations required under applicable provincial privacy legislation (such as FOIP, FIPPA, or POPA).

5. Contact Information

For privacy inquiries, FOIP/FIPPA compliance coordination, or data subject access requests, please contact us:

privacy@academicintelligence.ca