Privacy Policy — Ethic8.com

This Privacy Policy applies to all services offered through ethic8.com and its associated tools.

1. Introduction

Ethic AI Inc. ("Ethic AI," "Ethic8," "we," "our," or "us") is a Canada-based company committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website, applications, and related tools (collectively, the "Service").

We operate in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws, and Tri-Council Policy Statement 2 (TCPS 2) ethics principles for research involving humans, as well as additional Canadian and international compliance frameworks that we may adopt or align with in the future.

By using the Service, you consent to the practices described here. If you disagree, please discontinue use.

2. Information We Collect

We collect only the information necessary to deliver and support the Service:

• Account Information: Name, email, password, and optional institutional affiliation — used to create your account, verify access, and offer relevant services.
• Billing Information: Payment details processed securely by Stripe; we never store card numbers.
• Uploaded Content: When you use the Service (e.g., transcription, anonymization, summarization), you may upload audio, video, text, or document files for processing. These files are used solely to provide the requested service. We store them only to deliver the Service and keep them available in your account; we never use your content for any other purpose and never use it to train AI models. You can permanently delete your files at any time through your account.
• Usage Data: Limited service-performance data (e.g., timestamps, feature usage, session activity) used to maintain reliability and prevent abuse.
• Analytics Data (with consent): If you accept our cookie-consent banner, we collect limited, privacy-protective usage analytics as described in Section 6.

We do not collect or store any sensitive data beyond what is required for secure and lawful service delivery.

3. How We Use Your Information

We use your information solely to:

• Deliver the user-requested service effectively
• Process payments and manage subscriptions
• Ensure compliance with applicable privacy laws and institutional ethics policies
• Respond to inquiries or support requests
• Communicate necessary updates or policy changes

We never sell, rent, or market your data. We never use your files or content to train AI models — internally or with third parties.

4. Data Retention and User Control

Ethic8 follows a data-minimization approach:

• Uploaded files are temporarily stored for the duration of processing and remain accessible through your account. Files are permanently deleted upon user-initiated deletion.
• Processed outputs (e.g., transcripts or summaries) are accessible only through your user account and are not stored beyond your access needs.
• Essential metadata (e.g., plan usage) may be retained solely for billing, support, and audit purposes.
• We reserve the right to remove inactive accounts and associated data after a defined retention period (12 months), unless otherwise required by law.
• You may delete your account at any time, which will also remove any associated metadata and processed outputs from all tools under your control.

5. Data Residency & Transfers

All core Ethic8 infrastructure — including storage, GPU processing, and application hosting — is located in Canada. We use Amazon Web Services, Microsoft Azure, and FullHost for storage and hosting. AI processing such as transcription and translation runs on dedicated GPU providers operating in Canadian regions only — RunPod and Denvr Dataworks. Supabase services are provisioned in Canada. We pin all providers to Canadian regions with no cross-region replication. GPU processing is transient and performed in memory; no uploaded content is retained on GPU nodes after your task completes. This ensures compliance with institutional data-sovereignty and research-ethics requirements.

If you access the Service from outside Canada, your personal data and uploaded content are still processed and stored in Canada as described above. Where local laws (such as the EU/UK GDPR) grant you additional privacy rights, we will honour reasonable requests to exercise them.

For customer support messaging, we use Chatwoot, which processes limited personal data (name, email). No uploaded content or transcripts are shared with this service. We apply least-privilege access controls.

6. Cookies and Analytics Transparency

Ethic8 uses essential cookies to keep the Service working (for example, authentication and security). For product analytics we use PostHog. Your analytics data is processed and stored by us and is never sent to PostHog Inc. or any third-party analytics or advertising provider.

You control analytics through our cookie banner, and we honour your browser's "Do Not Track" signal in all cases:

• Only essential: we collect limited, anonymous, aggregate measurements (such as approximate region, referring site, and pages viewed). No cookies or persistent identifiers are used, and we do not use these measurements to identify you or track you across visits.
• Accept all: in addition to the above, we use a first-party cookie and a pseudonymous identifier to recognise repeat visits, and we capture interaction analytics such as which links or buttons are clicked.

You can change your choice at any time through the cookie banner or by clearing the cookies in your browser. Depending on your choice, we may collect:

• Pages viewed
• Referring website and campaign (UTM) parameters
• Browser, operating system, device type, screen size, and web-performance metrics
• Approximate location (country, region, and city) derived from your IP address — the IP address itself is not stored
• Links or buttons clicked (Accept all only)
• A randomly generated, pseudonymous identifier used to recognise repeat visits (Accept all only)

We do not store your IP address — we derive only an approximate location (country, region, and city) from it and then discard it. We strip raw URL query strings and all text and attributes from page elements before any event is sent (standard campaign/UTM parameters are retained for attribution), so we never receive your uploaded content through analytics. Session replay and screen recording are disabled, form-field values are never captured, and we do not build profiles for anonymous visitors. We do not use external analytics tools such as Google Analytics, and we never sell your data.

We also store your cookie choice in your browser's local storage so we can remember it on future visits.

7. Data Sharing & Third Parties

We do not sell or share your data with third parties. We engage the following vendors under strict contractual privacy controls and least-privilege access:

Each provider is contractually required to protect your data, limit access, and comply with Canadian privacy law. We may disclose limited information if required by applicable law, court order, or lawful request from a regulatory authority. In such cases, we will only release the minimum information necessary and, where legally permissible, will notify affected users before disclosure.

8. Compliance and Ethical Standards

Ethic8 is built to align with Canadian privacy and research-ethics frameworks, including PIPEDA, TCPS 2. We apply privacy-by-design principles, Canadian data residency for our core infrastructure and all uploaded content, encryption in transit and at rest, and consent-based data processing. Limited account data (such as your name and email) may be processed by our payment and email providers in the United States, as shown in Section 7.

However, while we design our systems to help you meet institutional or legal privacy obligations, we cannot guarantee that your specific use automatically satisfies every requirement of your organization's ethics board, privacy policy, or applicable law. Users and organizations remain responsible for ensuring their own compliance. Ethic8 provides transparency and tools to support that goal but does not assume liability for user conduct or institutional compliance.

9. Children's Privacy

Our services are intended for users aged 18 or older, or those with the legal capacity to enter into contracts. We do not knowingly collect personal data from minors. If we become aware that a user under 18 has submitted personal information without appropriate consent, we will delete it promptly.

10. Your Rights

You have the right to:

• Access your personal data
• Request correction or permanent deletion
• Withdraw consent at any time (without affecting prior lawful processing)
• Request details on third-party processors

Contact us at privacy@ethicai.ca to exercise these rights. We may verify identity before processing requests.

11. Data Security

We implement industry-standard technical and organizational safeguards, including encryption at rest & in transit, least-privilege access controls, and ongoing security monitoring. If a data breach occurs that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law. Despite these measures, no internet service is 100% secure; use of the Service is at your own risk.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect technical, legal, or operational changes. Material updates will be announced on our website or by email. Continued use of the Service after updates constitutes acceptance of the revised Policy.

13. Contact

If you have any questions, concerns, or complaints about this Privacy Policy or how your information is handled, please contact us directly:

Ethic AI Inc.
privacy@ethicai.ca

We will review and respond to all inquiries as promptly as possible. If you believe that your privacy rights have been violated or that your personal information has been mishandled and you are not satisfied with our response, you may also contact the appropriate privacy authority:

Office of the Privacy Commissioner of Canada (OPC)
https://www.priv.gc.ca/en/

You may also reach out to your provincial or territorial privacy commissioner for further assistance.