Privacy Policy
Effective Date: October 30, 2026 · Last Updated: October 30, 2026
AOIA (“we,” “us,” or “our”) operates the website at aoia.ca and provides the AOIA platform (the “Service”). This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our Service. We are committed to complying with applicable Canadian and Quebec privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (Quebec Privacy Act, as amended by Law 25 / Bill 64), and the Canadian Anti-Spam Legislation (CASL).
1. Definitions
- Personal Information means any information about an identifiable individual, as defined under PIPEDA and the Quebec Privacy Act.
- Company Profile means the structured business data you provide during onboarding (company name, city, categories, capabilities, etc.).
- Tender Data means public procurement notices sourced from the SEAO (Système Électronique d’Appels d’Offres) and other government open-data portals.
- Score means the algorithmically generated compatibility rating between your Company Profile and a given Tender.
- AI Processing means any data sent to or processed by third-party artificial intelligence services (specifically Anthropic’s Claude API).
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Password (stored as a salted hash — we never store plaintext passwords)
- Account creation date and last sign-in timestamp
2.2 Company Profile Data
During onboarding and profile configuration, you may voluntarily provide:
- Company name, city, and postal code
- Company website URL
- Number of employees
- Product and service descriptions
- Key products and brand names
- SEAO category preferences (from the 58 official categories)
- Capability types and weights (supply, installation, service)
- Government buyer type preferences and affinity scores
- Geographic constraints (maximum travel distance)
- Contract value range preferences (minimum and maximum)
- Minimum preparation time requirements
- Bonding limit
- Certifications held (AMP, RBQ, ISO, and others)
- Whether you can ship nationally
- Revenu Québec attestation status
- RENA (Registre des entreprises non admissibles) clearance status
- Working languages (French, English)
- Negative keywords (terms that should disqualify tenders from matching)
2.3 Website Analysis Data
If you provide your company website URL during onboarding, we may fetch and analyze the publicly accessible content of that website to help pre-populate your profile. The analysis summary is stored with your profile. We do not store the full HTML content of your website.
2.4 Conversation Data
During the AI-assisted onboarding process, your chat messages are sent to our server and forwarded to Anthropic’s Claude API for processing. We retain the conversation messages for the duration of the onboarding session only. Conversations are not stored permanently in our database after onboarding is complete.
2.5 Geolocation Data
We derive approximate latitude and longitude coordinates from the postal code you provide, using the OpenStreetMap Nominatim geocoding service. This data is used solely to calculate geographic proximity for tender scoring. We do not track your real-time location.
2.6 Usage and Analytics Data
We may collect technical information including:
- Browser type and version
- Device type (desktop, mobile, tablet)
- Pages visited and features used within the Service
- Date and time of access
- Referring URL
- IP address (anonymized for analytics)
2.7 Locally Stored Data
Certain features store data in your browser’s local storage (localStorage). This data never leaves your device unless you explicitly export it. Locally stored data includes:
- KPI entries and project tracking data
- Invoice and financial records
- Saved leads and tender pipeline state
- Notification preferences and history
- Application settings (theme, language, branding)
- Team member information
- Sync health and pipeline status history
Important: Locally stored data is not backed up to our servers. Clearing your browser data or switching devices will result in the loss of this information. Use the Export feature in Settings to back up your local data.
2.8 Cookies
We use the following cookies:
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
aoia_lang | Stores your language preference (French or English) | 1 year | Functional (essential) |
sb-*-auth-token | Supabase authentication session token | Session / 1 hour | Authentication (essential) |
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not participate in any advertising networks or cross-site tracking programs.
3. How We Use Your Information
We use your information for the following purposes:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide account authentication | Email, password hash | Contract performance |
| Score tenders against your profile | Company Profile, Tender Data | Contract performance |
| AI-assisted onboarding | Chat messages, Company Profile | Consent |
| Website analysis for profile pre-population | Website URL, public website content | Consent |
| Geographic scoring | Postal code, derived coordinates | Contract performance |
| Service improvement | Aggregated, anonymized usage patterns | Legitimate interest |
| Security and fraud prevention | IP address, authentication logs | Legitimate interest |
4. Third-Party Services and Data Sharing
4.1 Supabase (Database and Authentication)
We use Supabase as our database and authentication provider. Your account information and Company Profile are stored in Supabase’s cloud infrastructure. Supabase processes data in accordance with their privacy policy and uses secure, encrypted connections. Data may be stored on servers located outside of Canada.
4.2 Anthropic (AI Processing)
During the onboarding process, your chat messages and Company Profile data are sent to Anthropic’s Claude API for natural language processing. Anthropic’s data usage policy states that API inputs and outputs are not used to train their models. We send only the minimum data necessary for the onboarding conversation. Anthropic may process data on servers located in the United States.
4.3 OpenStreetMap Nominatim (Geocoding)
We send your postal code to the OpenStreetMap Nominatim service to obtain geographic coordinates for tender scoring. No other personal information is transmitted. Our requests include a User-Agent header identifying our service (“AOIA/1.0”) as required by Nominatim’s usage policy.
4.4 Vercel (Hosting)
Our Service is hosted on Vercel’s infrastructure. Vercel processes HTTP requests and may log access data (IP addresses, request timestamps) as part of their hosting service. Vercel’s servers may be located outside of Canada.
4.5 SEAO and Government Open Data
We retrieve publicly available tender data from the SEAO API and Données Québec open data portal. This is public government data and does not contain personal information.
4.6 No Sale of Personal Information
We do not sell, rent, lease, or trade your personal information to any third party. We do not share your Company Profile, scoring data, or any other personal information with other users, companies, or data brokers. Each user’s data is isolated and accessible only to that user.
5. Cross-Border Data Transfers
Some of our third-party service providers (Supabase, Anthropic, Vercel) may process or store data on servers located outside of Canada, including in the United States. When your data is transferred outside of Canada or Quebec, it may be subject to the laws of those jurisdictions. We take reasonable steps to ensure that our service providers maintain adequate data protection standards, including through contractual obligations.
In accordance with Quebec’s Privacy Act (as amended by Law 25), we have conducted a privacy impact assessment regarding these cross-border transfers and have determined that the receiving jurisdictions provide an adequate level of protection for personal information.
6. Data Security
We implement the following security measures to protect your information:
- Encryption in transit: All data transmitted between your browser and our servers uses TLS 1.2 or higher (HTTPS).
- Encryption at rest: Database records are encrypted at rest using AES-256 encryption via our database provider.
- Password hashing: Passwords are hashed using bcrypt with salt before storage — we never store plaintext passwords.
- Row-Level Security (RLS): Database policies ensure that each user can only access their own data. Users cannot view, modify, or delete other users’ profiles, scores, or analyses.
- API authentication: Protected endpoints require valid authentication tokens. Automated pipeline operations use separate service credentials.
- Environment variable protection: All API keys and secrets are stored as environment variables and are never exposed in client-side code or version control.
- Input validation: All user inputs are validated and sanitized to prevent injection attacks (SQL injection, XSS, etc.).
7. Data Retention
| Data Type | Retention Period | Deletion Method |
|---|---|---|
| Account information | Until account deletion | Permanent deletion upon request |
| Company Profile | Until account deletion | Permanent deletion upon request |
| Tender match scores | Until account deletion or tender closure | Cascade deletion with account or tender |
| Onboarding chat messages | Duration of onboarding session only | Not persisted to database |
| Tender listings (public data) | Indefinitely (public government data) | N/A — public data |
| Browser local storage | Until you clear browser data | Browser-controlled |
| Authentication logs | 90 days | Automatic purge |
8. Your Rights
Under PIPEDA and Quebec’s Privacy Act (as amended by Law 25), you have the following rights:
- Right of Access: You may request a copy of all personal information we hold about you. We will respond within 30 days.
- Right of Rectification: You may correct or update your personal information at any time through your profile settings, or by contacting us.
- Right to Deletion: You may delete your account and all associated data at any time through the Settings page. Upon deletion, your Company Profile, match scores, and analyses are permanently removed from our database. This action cannot be undone.
- Right to Data Portability: You may export all your data (profile, settings, KPIs, invoices, leads, and pipeline data) as a JSON file using the Export feature in Settings.
- Right to Withdraw Consent: Where processing is based on consent (e.g., AI-assisted onboarding), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing performed before withdrawal.
- Right to Deindexation: You may request that we cease disseminating your personal information or that hyperlinks to it be deindexed, in accordance with Law 25.
- Right to Be Informed of Automated Decisions: Our tender scoring is performed by an algorithm. You have the right to be informed of the factors and parameters used in automated decisions that affect you, and to have such decisions reviewed by a person upon request.
To exercise any of these rights, contact us at the address provided in Section 13.
9. Automated Decision-Making
Our Service uses automated scoring algorithms to evaluate tenders against your Company Profile. The scoring system considers the following factors:
- Category match (SEAO category alignment)
- Text relevance (keyword matching between your profile and tender descriptions)
- Scope fit (capability type and weight alignment)
- Buyer affinity (your preference for different government buyer types)
- Geographic proximity (distance between your location and the buyer’s location)
- Contract value (whether the tender value falls within your preferred range)
- Timeline (whether you have sufficient preparation time)
- Competition level (number of competing bidders, when available)
- Signal analysis (multi-year contracts, brand specificity, addenda count)
These scores are advisory only and are intended to help you prioritize which tenders to review. They do not constitute recommendations to bid or not bid on any specific tender. You are solely responsible for all bidding decisions.
10. Children’s Privacy
Our Service is designed for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
- Update the “Last Updated” date at the top of this page
- Provide notice through the Service (e.g., a notification in the dashboard)
- For significant changes that affect your rights, provide at least 30 days’ notice before the changes take effect
Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
12. Privacy Officer
In accordance with Law 25, we have designated a person responsible for the protection of personal information. Questions, concerns, or complaints about our privacy practices should be directed to our Privacy Officer.
13. Contact Us
For privacy-related inquiries, requests, or complaints:
- Email: privacy@aoia.ca
- Website: aoia.ca
If you are not satisfied with our response to a privacy complaint, you may file a complaint with the Commission d’accès à l’information du Québec (CAI) at www.cai.gouv.qc.ca or the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.