Privacy Policy

1. Personal information covered by this Policy

“Personal information” means information about an identifiable individual, subject to exclusions and definitions under applicable law. Depending on how ALTAM is configured and used, we may collect the following categories:

• Account and contact information. Name, organization, job title, email address, telephone number, username, authentication information and account preferences.
• Customer and transaction information. Orders, subscription status, billing contact details, invoices, payment status and service history. Payment-card details may be handled directly by a payment processor rather than stored by Pecaro.
• Customer Data. Prompts, messages, documents, knowledge sources, form submissions, contact records, calendar details, workflow data, communications and other information submitted or connected by a customer.
• AI inputs and outputs. Prompts, instructions, retrieved context, generated responses, classifications, proposed actions, human approvals, corrections and feedback.
• Integration data. Identifiers, permissions, tokens and information exchanged with customer-authorized email, calendar, CRM, communications or other systems.
• Technical and usage information. IP address, device and browser information, timestamps, authentication events, pages and features used, diagnostic data, logs, error reports and security events.
• Sales support and communications. Inquiries, consultation information, support requests, call or meeting notes, preferences and correspondence.
• Cookies and similar technologies. Information used for authentication, preferences, security, analytics and website operation, as described in Section 8.

Please do not provide highly sensitive personal information unless it is necessary for an approved, documented use case and Pecaro has confirmed that the configuration and contractual safeguards are appropriate.

2. How we collect information

We collect personal information directly from individuals; from our business customers and their authorized users; from systems and integrations that a customer chooses to connect; from website, application and service activity; from service providers; and from public or commercial sources where collection and use are lawful.

A customer may provide information about its personnel, prospects, clients, tenants, patients, vendors or other individuals. The customer is responsible for providing appropriate notices and obtaining required authority for that disclosure and processing.

3. Why we use personal information

We may use personal information for the following purposes, where permitted by law:

• provide, configure, personalize, operate and support ALTAM and AVA;
• authenticate users, administer accounts and manage permissions;
• execute customer-authorized workflows, integrations and communications;
• process transactions, invoices and subscription administration;
• respond to inquiries, provide training and customer support, and manage the customer relationship;
• monitor performance, troubleshoot errors, maintain service continuity and improve usability;
• protect the Services, customers and individuals; detect fraud, abuse, unauthorized access and security incidents;
• evaluate AI and workflow performance, including accuracy, human corrections, latency and cost, using personal information only where permitted and reasonably necessary;
• develop and improve products using aggregated or de-identified information where reasonably possible;
• send service notices and, with required consent or other lawful authority, marketing communications;
• comply with law, enforce agreements, establish or defend legal claims and respond to lawful requests; and
• complete a merger, financing, reorganization or sale subject to appropriate confidentiality and legal safeguards.

We will not use personal information for a materially new purpose without additional notice and any consent required by law.

4. Artificial intelligence processing

ALTAM may send relevant inputs, instructions and contextual information to approved AI model providers or other subprocessors to generate an Output, classification, summary or proposed action. Pecaro seeks to limit information to what is reasonably necessary for the configured task. The specific providers and processing locations may vary by configuration, availability, customer requirements and contractual arrangements.

AI Output may be inaccurate or incomplete. ALTAM is designed to support defined workflows and human oversight; it is not intended to make unsupervised high-impact decisions about individuals. Customers determine the workflow, approved data, instructions, permissions, escalation rules and human-review requirements. Individuals should contact the relevant customer if they wish to question a decision or interaction initiated through that customer’s use of ALTAM.

Pecaro does not authorize third-party model providers to use identifiable Customer Data to train their general-purpose models unless this is clearly disclosed and agreed with the customer. Pecaro may use aggregated or de-identified information, evaluation results and customer-authorized feedback to improve ALTAM.

5. Consent and other authority

Depending on the circumstances, we process personal information with consent, to provide requested services, to perform a contract, to comply with law, or for another purpose permitted by applicable privacy law. Consent may be express or implied where legally appropriate, considering the sensitivity of the information and reasonable expectations. An individual may withdraw consent subject to legal or contractual restrictions and reasonable notice; withdrawal may limit our ability to provide a feature or service.

6. When we disclose personal information

We may disclose personal information to:

• Business customers and authorized users. Information may be visible to the organization that controls the account and to its authorized administrators or users.
• Service providers and subprocessors. Cloud hosting, database, security, monitoring, communications, payment, analytics, support, integration and AI model providers may process information for us under contractual restrictions.
• Customer-authorized integrations. We exchange information with systems that the customer chooses to connect, according to the customer’s instructions and permissions.
• Professional advisers. Lawyers, accountants, insurers, auditors and other advisers may receive information where reasonably necessary and subject to confidentiality obligations.
• Corporate transaction participants. Information may be disclosed in connection with due diligence, financing, reorganization, merger or sale, subject to legal and confidentiality safeguards.
• Authorities and affected parties. We may disclose information where required or permitted by law, to respond to lawful process, protect rights or safety, investigate misconduct or address security incidents.

Pecaro does not sell personal information for money. If our practices change in a way that legally constitutes a sale or sharing requiring a choice, we will provide the notice and controls required by applicable law.

7. Processing outside Canada

Pecaro and its service providers may process or store personal information outside the individual’s province or outside Canada. Information in another jurisdiction may be accessible to courts, law-enforcement or national-security authorities under that jurisdiction’s laws. Pecaro uses contractual and other measures appropriate to the circumstances when engaging service providers. Customers with specific data-residency requirements must document them in an Order or data processing agreement before using the applicable feature.

8. Cookies, analytics and communications

Our websites and applications may use essential cookies for authentication, security, session management and preferences. We may also use analytics technologies to understand service use and improve performance. Where required, non-essential technologies will be subject to notice or consent. Browser settings may block some cookies, but essential functions may not work properly.

We may send account, security, transaction and service communications that are necessary to administer the relationship. Promotional electronic messages will be sent only with consent or other authority permitted by Canada’s Anti-Spam Legislation and will include required identification and an unsubscribe mechanism. Unsubscribing from marketing does not stop essential service communications.

9. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, customer instructions, contractual commitments, security, dispute resolution and legal obligations. Retention varies by information type, sensitivity, account status, configuration and backup cycle. When information is no longer required, we delete, de-identify or securely dispose of it, subject to lawful exceptions and technical limitations. Customer-controlled data may follow the retention and deletion terms in the applicable Order or data processing agreement.

10. Safeguards

Pecaro uses administrative, technical and physical safeguards appropriate to the sensitivity, volume and use of personal information. Measures may include access controls, authentication, least-privilege permissions, encryption in transit and where appropriate at rest, logging, backups, vulnerability management, vendor assessment, personnel controls and incident procedures. Safeguards evolve as the Services and risks change. No method of electronic transmission or storage is completely secure.

11. Privacy incidents

Pecaro maintains processes to identify, contain, investigate and remediate suspected privacy and security incidents. Where required by law or contract, we will notify affected customers, individuals or regulators and maintain required records. Customers must promptly report suspected unauthorized access or disclosure affecting ALTAM and cooperate with reasonable investigation and remediation steps.

12. Accuracy, access and correction

Subject to applicable law, an individual may request access to personal information that Pecaro controls, request correction, ask about its use or disclosure, or withdraw consent. We may need to verify identity and may refuse or limit a request where law permits or requires. If ALTAM processes information on behalf of a customer, we may direct the request to that customer or assist the customer in responding.

To submit a privacy request, contact the Privacy Officer at info@pecaroconsulting.com. Describe the request and the ALTAM customer or account involved, if known. Do not send passwords, payment-card information, government identifiers or other unnecessary sensitive information by email.

13. Choices and account controls

Authorized users may be able to update profile information, permissions and integration settings through the Services or through their organization’s administrator. Individuals may unsubscribe from marketing using the link in a message or by contacting us. Customers may request export, correction or deletion of Customer Data as provided by their agreement and subject to legal and technical limitations.

14. Children

ALTAM is a business service and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13 through general account registration. A customer that intends to use ALTAM to process information about minors must notify Pecaro in advance, establish a lawful basis, obtain required parental or guardian consent, and implement appropriate safeguards. Pecaro may decline or restrict such a use case.

15. Third party websites and services

ALTAM may link to or integrate with third-party websites and services. Their privacy practices are governed by their own policies. Pecaro is not responsible for a third party’s independent practices. Customers should review third-party terms before enabling an integration.

16. Changes to this Policy

We may update this Policy to reflect changes in ALTAM, legal requirements or our practices. The current version will state its effective date. We will provide additional notice of material changes where appropriate or required and obtain consent if the law requires it for a new use of personal information.

17. Contact and complaints

Questions, requests or complaints may be directed to the Privacy Officer, Pecaro Consulting Inc., Email: info@pecaroconsulting.com, Telephone: 1-877-331-8445. We will investigate privacy complaints and respond within a reasonable time. Individuals may also contact the appropriate federal or provincial privacy regulator if they are not satisfied with our response.