Privacy Policy

    Version 1.0. Effective as of September 8, 2026.

    Artomai Inc. ("Artomai," "we," "us," or "our") is an Ontario, Canada company that builds AI assistants and workflow automation for field-services, claims, and lending teams. This Privacy Policy describes how Artomai processes personal information that we collect through our website at www.artomai.com, our blog, our online demos, the API endpoints on our domain that support Artomai products, our marketing activities, and any other activity that links to this Privacy Policy (collectively, the "Service").

    Artomai is subject to the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") and Canada's Anti-Spam Legislation ("CASL"). If you live outside Canada, the section titled "Additional information for residents of other jurisdictions" also applies to you.

    Personal information we collect

    Information you provide to us

    • Contact data. When you use the contact form, we collect your name, your work email address, your company name (optional), your message, and whether you asked for a non-disclosure agreement. When you email us directly, we collect whatever you include in the email.
    • Newsletter data. When you subscribe to our blog newsletter or request a gated download, we collect your email address, your name (optional), and the topics you selected.
    • Demo input data. Our quote-assistant demo lets you type messages to an AI assistant. We collect the messages you type. The demo runs on fictional company data. Do not enter real customer, financial, or confidential information into a demo.
    • Product licence data. Artomai also makes software products, such as Weightedly and Countet, which are sold on their own websites under their own terms. When you buy or claim a licence for one of these products, the product's own system sends a licence record to an endpoint on our domain. That record may include your email address, your Discord user ID, the customer and subscription identifiers assigned by the product's payment processor, the licence key, the licence status, and the expiry date. We never receive your payment card or bank details.
    • Communications data. The content of our exchanges with you by email, video call, or other channel.

    Information from other sources

    • Our products. The product systems described above send us licence records and later update them.
    • Payment processors. When a product bills through Stripe, we may query Stripe for the current status of a subscription to confirm that a licence is still active. We receive only the subscription status.
    • Discord. Our Discord bot tells us the Discord user ID of the person who claims a licence, so we can link the licence to the right Discord account.
    • Business transaction partners. We may receive personal information in connection with an actual or prospective business transaction, such as a merger, acquisition, financing, or sale of assets.

    Automatic data collection

    We and our service providers automatically log information about your device and your use of the Service, such as:

    • Device data, such as your operating system, browser type, screen size, language settings, IP address, and general location (city or region).
    • Online activity data, such as the pages you viewed, how long you spent on a page, the site you came from, and the actions you took on a page. The actions we record include page views, contact-form and newsletter submissions, file downloads, blog searches, clicks on calls to action, email links and outbound links, opening a FAQ entry, expanding a bundle, entering the client-demo password (success or failure only, never the password), and playing or navigating demo media.

    We do not collect precise geolocation. We do not use pixel tags in our emails.

    Tracking and other technologies

    Cookies and similar technologies. Our own code sets no cookies and stores nothing in your browser's local storage. The Service loads Google Tag Manager, which loads Google Analytics 4. Google Analytics sets cookies (for example _ga and _ga_*) to recognise your browser across visits and to measure how visitors use the Service. The Service currently loads these tags without asking for consent first. You can block them as described under "Your choices" below.

    Web fonts. The Service loads fonts from Google Fonts. When your browser requests a font, Google receives your IP address and the page address.

    Chat and other artificial intelligence ("AI") technologies. The quote-assistant demo sends your messages, through a function that runs on our hosting provider, to Anthropic, PBC, which operates the Claude models that generate the assistant's replies. The demo also sends your messages to a demo tool server that we operate, which holds the fictional job data and any draft quotes for the duration of your session. Your browser keeps the running transcript in memory only for as long as the demo page is open. We do not store your demo transcript on our servers after your session, and we do not use your demo inputs to train any AI model. Anthropic's terms for its commercial API prohibit it from training its models on our inputs and outputs.

    How we use your personal information

    We use your personal information for the following purposes:

    • Service delivery and operations. To provide the Service, respond to your contact-form submissions and emails, schedule and run process-mapping sessions and pilots, deliver the newsletter and gated downloads you asked for, run the demos, and issue, verify, renew, expire, and revoke product licences.
    • Communication. To send you service-related messages, and to send you commercial electronic messages where you have given consent under CASL or where CASL otherwise permits. Every newsletter includes an unsubscribe link.
    • Service improvement and analytics. To understand which pages are most and least visited, how visitors move around the Service, and which calls to action are used, and to improve the Service and our business. We use Google Analytics for this purpose. You can learn more about how Google uses data at https://policies.google.com/technologies/partner-sites.
    • Compliance and protection. To comply with applicable laws and lawful requests, protect our rights and the rights of others, enforce the terms that govern the Service, and prevent, investigate, and deter fraudulent, harmful, unauthorized, or illegal activity.
    • Aggregated and de-identified data. To create aggregated or de-identified data that no longer identifies you, which we may use for any lawful business purpose. We do not attempt to re-identify such data.

    We do not use your personal information for interest-based advertising. We do not sell your personal information. We do not use your personal information to make automated decisions that have legal or similarly significant effects on you.

    Retention

    We keep personal information for as long as we need it for the purposes described above, and afterwards for as long as the law, accounting requirements, or the defence of legal claims require. In particular:

    • Contact-form submissions and email correspondence stay in our mailbox for as long as we have, or are pursuing, a business relationship with you.
    • Newsletter data stays in our subscriber list until you unsubscribe or ask us to delete it.
    • Product licence records stay in our licence registry for as long as the licence or its renewal history is needed by the product that issued it.
    • Demo transcripts are not retained by us after your session ends.
    • Google Analytics retains event-level data for at most 14 months. Aggregated reports may be kept longer by Google.

    When we no longer need personal information, we delete it, anonymise it, or isolate it from further processing.

    How we share your personal information

    We share personal information with the following parties:

    • Service providers. Third parties that provide services on our behalf or help us operate the Service:
      • Cloudflare, Inc. hosts the Service and runs the server-side functions that power the demos and the licence endpoints.
      • Google LLC provides Tag Manager, Analytics, and web fonts.
      • EmailJS (Shakuro Ltd.) delivers contact-form submissions to our mailbox.
      • Supabase, Inc. hosts the database that holds our blog content, our newsletter subscriber list, and our product licence registry.
      • Anthropic, PBC generates the AI replies in the quote-assistant demo.
      • Stripe, Inc. answers our subscription-status queries for licences that were billed through Stripe. Stripe handles your payment details under its own privacy policy, https://stripe.com/privacy, on the product's website, not on ours.
      • Discord Inc. operates the platform through which our licence bot runs.
    • Professional advisors. Lawyers, accountants, bankers, and insurers, in the course of the professional services they render to us.
    • Authorities and others. Law enforcement, government authorities, and private parties, where we believe in good faith that disclosure is necessary for the compliance and protection purposes described above.
    • Business transferees. An acquirer, successor, or assignee, or a prospective counterparty and its advisers, in connection with an actual or prospective merger, acquisition, financing, sale of assets, or similar transaction, or an insolvency, bankruptcy, or receivership.

    We do not share personal information with advertising partners. Nothing you submit through the Service is published or made visible to other users.

    Your choices

    • Opt out of marketing. Use the unsubscribe link at the bottom of any newsletter, or email us at [email protected]. You may continue to receive service-related messages.
    • Cookies and analytics. You can set your browser to refuse cookies or to delete them. You can also install the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. Blocking Google Tag Manager with a content blocker prevents the analytics tags from loading at all.
    • Do Not Track and Global Privacy Control. The Service does not currently respond to "Do Not Track" or Global Privacy Control browser signals.
    • Declining to provide information. You can browse the Service without giving us any personal information. If you do not provide the information a form marks as required, we cannot respond to that request.
    • Withdraw consent. You may withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us. Withdrawing consent may mean we can no longer provide part of the Service to you.

    Your rights

    Under PIPEDA you have the right to ask us what personal information we hold about you, to access it, to challenge its accuracy and completeness, and to have it corrected. To make a request, email [email protected] with enough detail for us to find your information. We may ask you to verify your identity before we respond. We aim to respond within 30 days.

    You may also complain to us about our handling of your personal information. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca or 1-800-282-1376.

    Other sites and services

    The Service contains links to websites and services operated by third parties, including our product websites, LinkedIn, and the sites we link to from blog posts. These links are not an endorsement of, or a representation that we are affiliated with, any third party. We do not control third-party websites and are not responsible for their privacy practices. We encourage you to read their privacy policies.

    Security

    We use technical, organisational, and physical safeguards designed to protect the personal information we collect. The Service is served over HTTPS, server-side secrets are held by our hosting provider and never shipped to the browser, and the licence endpoints require a bearer credential. Security risk is inherent in all internet technologies, however, and we cannot guarantee the security of your personal information.

    International data transfer

    We are located in Ontario, Canada. The service providers named above operate in the United States and elsewhere, so your personal information may be stored or processed outside Canada, in locations where privacy laws may not be as protective as those of your province or country. While your information is outside Canada, it is subject to the laws of the country where it is held and may be accessible to that country's courts, law enforcement, and national security authorities.

    Children

    The Service is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected personal information from a child, contact us and we will delete it.

    Additional information for residents of other jurisdictions

    European Economic Area, United Kingdom, and Switzerland. We do not target our services to these regions. If data protection law there applies to you regardless, our legal bases for processing are your consent (for the newsletter and analytics cookies), the performance of a contract or steps at your request before a contract (for contact requests and licences), and our legitimate interests in operating, securing, and improving the Service. You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority. Transfers to Canada rely on the European Commission's adequacy decision for Canada's commercial organisations, and transfers onward to the United States rely on the providers' standard contractual clauses or their Data Privacy Framework certification.

    United States. If a U.S. state privacy law applies to you, you may have the right to know what personal information we collect, to access, correct, and delete it, to obtain a copy of it, and to appeal a denied request. We do not sell your personal information, do not share it for targeted advertising, and do not profile you in a way that produces legal or similarly significant effects, so there is nothing to opt out of under those laws. To exercise any right, email [email protected]. We may need to verify your identity, and an authorised agent must show that they are authorised to act for you. We will not discriminate against you for exercising your rights. Nevada residents may direct us not to sell their covered information by emailing the same address; we do not sell covered information.

    Changes to this Privacy Policy

    We may modify this Privacy Policy at any time. If we make material changes, we will update the version number and effective date at the top of this page and post the new version on the Service. Your use of the Service after the effective date of a modified Privacy Policy means the modified Privacy Policy applies to you.

    How to contact us

    • Email: [email protected]
    • Mail: Artomai Inc., 301-755 Omega Dr., Pickering, ON L1V 0H1, Canada

    This document was adapted from a template prepared and made publicly available by General Legal, PC ("General Legal"). The template is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of the template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.