Privacy Policy

HSECai Software Inc. ("HSECai", "we", "us", or "our") respects your privacy. This Privacy Policy explains what personal information we collect through our website at hsecai.com (the "Site"), how we use and protect it, and the rights you have over it.

1. Who we are

HSECai Software Inc. is a company incorporated in Ontario, Canada, providing an AI-native risk and compliance management platform. For the purposes of applicable privacy law, HSECai is the data controller responsible for the personal information collected through this Site.

Contact: contact@hsecai.com · Toronto, Ontario, Canada.

2. Information we collect

Information you give us

When you submit a demo request through our Site, we collect the information you provide in the form:

• First name and last name
• Work email address
• Company name
• Job title (optional)
• Phone number (optional)

If you email us directly (for example, at contact@hsecai.com), we receive your email address and any information you choose to include in your message.

Information collected automatically

Our Site is intentionally lightweight. We do not run third-party advertising, analytics, or behavioural-tracking scripts. Our hosting provider may automatically log standard technical data (such as IP address, browser type, and pages requested) for security and reliability purposes. See Cookies and tracking below.

3. How we use your information

We use the personal information we collect to:

• Respond to your demo request and contact you to schedule a demonstration;
• Reply to your enquiries and provide customer support;
• Communicate with you about our products and services that are relevant to your request;
• Operate, maintain, and secure our Site; and
• Comply with our legal and regulatory obligations.

We do not sell your personal information. We will only send you marketing communications where we have a lawful basis to do so, and every such communication will include an easy way to unsubscribe, consistent with Canada's Anti-Spam Legislation (CASL).

4. Legal bases for processing

Where the EU/UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

• Consent — when you submit a demo request or opt in to marketing communications;
• Legitimate interests — to respond to your enquiries, operate and secure our Site, and grow our business in ways that do not override your rights; and
• Legal obligation — where we must process information to comply with the law.

5. How we share information

We share personal information only as necessary to operate our Site and respond to you. Our service providers act on our instructions and are bound to protect your data:

• Form processing — Web3Forms. Demo-request submissions are transmitted through Web3Forms, a third-party form-handling service, which delivers the submission to us by email. Your form data passes through Web3Forms' systems in the course of this delivery. See the Web3Forms Privacy Policy.
• Hosting — Netlify. Our Site is hosted on Netlify, which may process technical log data as described above.
• Email. Demo requests and direct emails are received and stored in our business email systems.

We may also disclose information where required by law, to enforce our agreements, or to protect the rights, property, or safety of HSECai, our users, or others. If HSECai is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction.

6. Cookies and tracking

Any cookies or local storage used are strictly necessary for the Site to function or to remember basic preferences (such as light/dark theme). Because we do not use non-essential cookies, no cookie-consent banner is presented. If we introduce analytics or other non-essential cookies in the future, we will update this policy and request consent where required.

7. Data retention

We keep personal information only for as long as necessary for the purposes described in this policy — for example, to follow up on your demo request and maintain our business relationship — and to meet our legal, accounting, or reporting obligations. When information is no longer needed, we securely delete or anonymise it. You may ask us to delete your information at any time (see Your rights).

8. How we protect your information

We use technical and organisational measures appropriate to the sensitivity of the information, including encryption in transit (HTTPS/TLS), access controls, and reliance on reputable service providers. No method of transmission or storage is completely secure, but we work to protect your information and to address any incident promptly and responsibly. In the event of a data breach affecting your personal information, we will notify you and the relevant supervisory authorities without undue delay where required by applicable law.

9. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Request deletion of your information;
• Withdraw consent (including unsubscribing from marketing at any time);
• Object to or restrict certain processing; and
• Request a portable copy of information you provided to us.

To exercise any of these rights, email us at contact@hsecai.com. We will respond within the timeframe required by applicable law. Canadian residents who are not satisfied with our response may contact the Office of the Privacy Commissioner of Canada; EU/UK residents may lodge a complaint with their local supervisory authority.

10. California privacy rights

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, to request access to or deletion of that information, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information.

You will not be discriminated against for exercising any of these rights. To make a request, email contact@hsecai.com; we may need to verify your identity before responding.

11. International data transfers

HSECai is based in Canada, and our service providers may process data in Canada, the United States, or other countries. Where personal information is transferred across borders, we take steps to ensure it remains protected in accordance with this policy and applicable law.

12. Children's privacy

Our Site and services are intended for businesses and are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be highlighted on this page. Your continued use of the Site after changes take effect constitutes acceptance of the revised policy.

14. How to contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

HSECai Software Inc.
Toronto, Ontario, Canada
Email: contact@hsecai.com