Privacy Policy

1. Who we are and what this policy covers

1.1 This Privacy Policy is issued by BlueImpact RiskIntelligence Ltd., doing business as nank.ai (“nank.ai“, “we“, “us” or “our“). It explains how we handle personal information, meaning information about an identifiable individual.

1.2 This policy covers personal information we handle in connection with our website at nank.ai, our marketing and sales activities, our compliance platform (the “Platform“) and our Compliance-as-a-Service and professional services (together, the “Services“).

1.3 Use of the Platform is also governed by our Terms of Service, or by the signed agreement between us and your organization. If that agreement contains different privacy terms for Customer Data, the agreement governs.

2. Our two roles

2.1 When we decide how information is used. We are responsible for personal information about our website visitors, people who contact us, prospective customers, the contacts at our customers, and Platform account holders. Sections 3 to 5 describe how we handle it.

2.2 When we act for our customers. Our customers upload documents, evidence and other content to the Platform, and connect systems from which the Platform collects data (“Customer Data“). Customer Data may include personal information, such as employee names in an access review. We process Customer Data as a service provider, only to provide the Services, on our customer’s instructions, or as the law requires. Our customer is responsible for having the notices and consents needed to share it with us. If your personal information is in Customer Data, please contact the organization that uses our Platform. We will help them respond to your request. Section 6 describes the commitments we make for Customer Data.

3. Information we collect

3.1 Cookies. Our website uses cookies and similar technologies, including Google Analytics, to understand how visitors use the site. You can manage non-essential cookies, including analytics cookies, at any time through the cookie preferences on our website. See our Cookie Policy.

3.2 We do not knowingly collect personal information from anyone under the age of majority. Our Services are for businesses.

4. How we use personal information

4.1 We use personal information that we are responsible for to:

• respond to your inquiries and schedule consultations and demos;
• create and manage Platform accounts, authenticate users and provide support;
• deliver, maintain and improve the Services;
• secure our systems, detect and prevent fraud and unauthorized access, and diagnose technical problems;
• send service, security and administrative notices, including notice of changes to our terms;
• send compliance news and product updates, where you have agreed to receive them;
• invoice, collect payment and keep business records; and
• meet our legal obligations and enforce our agreements.

4.2 Consent. We collect, use and disclose personal information with your consent, or as the law otherwise permits. You may withdraw consent at any time, subject to legal and contractual limits, by contacting us. Every marketing email includes a link to unsubscribe. Withdrawing consent may mean we cannot provide some Services.

4.3 No sale. We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

4.4 Aggregated data. We may use de-identified, aggregated data about how the Platform is used, which does not identify any organization or individual, to operate, secure and improve our services.

5. How we share personal information

5.1 We share personal information only as follows:

• Service providers. Vendors that help us run our business and the Services, such as cloud hosting, AI model providers, email, customer support, analytics and accounting providers. They may use the information only to provide services to us, under written terms that protect it.
• Your organization. Administrators of your organization’s Platform account can see account and activity information about its users.
• Auditors and advisors. Our own auditors, lawyers and advisors, under duties of confidentiality. Our customers may also choose to share Platform reports with their auditors.
• Legal requirements. Where the law requires it, such as a court order, subpoena or lawful request from a regulator, or to protect the rights, property or safety of nank.ai, our customers or others.
• Business transfers. A buyer or successor in a merger, financing, reorganization or sale of all or part of our business, under confidentiality obligations and only for purposes related to the transaction.

6. Customer Data in the Platform

6.1 For Customer Data, we make the commitments set out in our Terms of Service, or in our customer’s signed agreement. In summary:

• we process Customer Data only to provide the Services, on our customer’s instructions, or as the law requires;
• we do not use Customer Data, or AI output that contains it, to train or fine-tune AI models that are made available to other customers or the public, and we use only third-party AI providers whose terms prohibit them from training their models on Customer Data;
• we notify our customer without undue delay, and in any case within 72 hours, after we become aware of a breach of security safeguards involving their Customer Data; and
• our customer can export Customer Data during their subscription and for 30 days after it ends. After that, we delete it from our active systems within 60 days, and from backups in the normal backup cycle, unless the law requires us to keep it.

6.2 Our customers should not upload personal health information, payment card data or government identification numbers to the Platform unless their agreement with us expressly allows it and any additional terms the law requires are in place.

7. Where we store and process information

7.1 We use third-party service providers, such as cloud hosting and AI model providers, to deliver the Services. Personal information, including Customer Data, may be stored and processed in Canada, the United States or another country where we or our service providers operate. Our customers can ask us for a current list of service providers, which shows where each one processes data.

7.2 Information processed outside your country is subject to the laws of that country, and may be accessible to its courts, law enforcement and national security authorities. We protect information transferred outside Canada with written contractual safeguards.

8. How we protect personal information

8.1 We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the information. Our controls are designed with reference to ISO/IEC 27001 and the SOC 2 Trust Services Criteria, and include:

• encryption of data in transit and at rest;
• role-based, least-privilege access, with multi-factor authentication for administrative access;
• logging and monitoring;
• vulnerability management and secure development practices;
• backup and recovery; and
• confidentiality obligations and privacy and security training for our personnel.

8.2 No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires.

9. How long we keep information

9.1 We keep personal information only as long as needed for the purposes in this policy, to meet our contractual commitments, or to comply with legal, tax and accounting requirements. For example, we keep account information for the life of the account, business and billing records for the period tax law requires, and marketing contact information until you unsubscribe or it is no longer needed. Customer Data is kept and deleted as described in Section 6.

9.2 When we no longer need personal information, we delete it or make it anonymous.

10. Your rights and choices

10.1 Subject to the law that applies to you, you may ask us to:

• tell you whether we hold personal information about you, and give you access to it;
• correct information that is inaccurate or incomplete;
• delete information we no longer need, or stop using it for marketing;
• provide information you gave us in a structured, commonly used format, where the law provides for it; and
• explain how we handle your personal information, including our use of service providers outside your country.

10.2 By location. In Canada, these rights come from the Personal Information Protection and Electronic Documents Act and applicable provincial laws, including Quebec’s Act respecting the protection of personal information in the private sector. In the United States, residents of some states have similar rights under state privacy laws. We honour these requests as those laws require.

10.3 Making a request. Write to our Privacy Officer at the address in Section 12. We will verify your identity before we act, and respond within 30 days, or within the time the applicable law sets. If your information is in Customer Data, we will refer your request to the organization that controls it and help them respond.

10.4 Complaints. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or the privacy regulator where you live.

11. Changes to this policy

11.1 We may update this policy from time to time. We will post the updated policy on this page and change the “Last updated” date. If a change is material, we will give notice by email or in the Platform before it takes effect.

12. Contact us and our Privacy Officer

12.1 Our Privacy Officer is accountable for our compliance with this policy and with privacy law. You can reach the Privacy Officer at:

Privacy Officer, BlueImpact RiskIntelligence Ltd., doing business as nank.ai
Toronto, Ontario, Canada
Email: [email protected]

For general questions, write to [email protected].