Privacy Policy

1. Who we are and what this Policy covers

1.1 This Privacy Policy describes how Agilio IT Consulting Inc., a corporation incorporated under the Business Corporations Act (Ontario) with its registered office at 133-290 King Street East, Kitchener, Ontario N2G 2L3 (“Agilio”, “PaperVault”, “we”, “us”), collects, uses, discloses, and protects personal information. “PaperVault” is a brand and trade name of Agilio, under which we operate the PaperVault document management and compliance workflow platform available at papervault.ca (the “Service”).

1.2 Two roles. We handle personal information in two distinct capacities, and this Policy addresses both:

• For our own purposes (as the organization with control): information about our customers and their personnel, website visitors, and prospective customers — for example account, billing, compliance-screening, and support information. Sections 2 through 12 describe this.
• On behalf of our customers (as a service provider): personal information contained in the documents, case records, and data that our customers upload to and process through the Service. Section 3 describes this, and our Data Processing Agreement (DPA) governs it.

1.3 This Policy is incorporated by reference into the PaperVault Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

2. Personal information we collect for our own purposes

2.1 Account and identity information. Name, business email address, phone number, job title, organization name, authentication data (password hashes, multi-factor authentication enrolment, passkey and SSO identifiers), and account preferences.

2.2 Compliance and verification information. As described in Section 3.6 of the Terms of Service, we operate a financial-crime and sanctions compliance program. To meet it, we may collect identity, ownership, and control information about our customers and their directors, officers, beneficial owners, and Authorized Users — including names, dates of birth, government identifiers, and corporate ownership records — and we may screen that information against sanctions, anti-money-laundering, and watch lists administered by Canadian, United States, and international authorities. We collect this information directly from the customer and from public and governmental sources.

2.3 Billing information. Billing contact details, subscription plan, invoices, and tax information. Payment card data is collected directly by our payment processor through its hosted payment interface and does not transit or reside on our systems; we receive only limited information such as card type, last four digits, and transaction status.

2.4 Usage and technical information. Log data, IP address, browser and device information, pages viewed, features used, and diagnostic and error information, collected when you use the Service or visit our websites.

2.5 Communications. Support requests, correspondence with us, and, where you consent, marketing communications preferences.

2.6 Cookies and similar technologies. We use cookies and similar technologies that are strictly necessary to operate the Service and our websites: session and authentication cookies, security cookies, the record of your own cookie choice, and Cloudflare Turnstile bot-protection challenges on public forms and signing pages. These are always active and cannot be switched off.

We also make two optional categories available — analytics (aggregate measurement of how the site is used) and marketing (measurement of which campaigns lead to trials). Both are off by default and are set only if you turn them on. We do not currently set any analytics or marketing cookies on papervault.ca; if and when we do, they will be governed by the choice you have recorded. We do not use cross-site tracking cookies, and we do not respond to third-party tracking signals.

You can review or change your choice at any time through the Cookie preferences link in our website footer, or through your browser settings. Blocking essential cookies may prevent the Service from functioning.

3. Personal information we process on behalf of our customers

3.1 PaperVault provides tools that professional organizations — law firms, accounting firms, immigration consultancies, financial services businesses, and other regulated organizations — use to manage documents and run compliance workflows concerning their own clients, employees, applicants, and other individuals. The documents and data those customers upload may contain personal information about you if you are a client, employee, applicant, or contact of one of our customers, or an individual they have screened.

3.2 Our role. For this information, our customer — not PaperVault — decides what is collected and why. We process it only as a service provider, on the customer's instructions, to deliver the Service. We do not use it for our own purposes, we do not sell it, and we do not use it to train artificial-intelligence models.

3.3 If your information is in PaperVault. If you believe a PaperVault customer has uploaded or processed your personal information through the Service and you wish to access, correct, or delete it, or have questions about why it was collected, please contact that organization directly — it is responsible for responding to you under applicable privacy laws. If you contact us, we will not respond substantively except to direct you to the responsible organization or as required by law, and we will notify that organization of your request where lawful.

3.4 Our handling of this information — including security measures, subprocessors, international transfers, breach notification, and deletion — is governed by our Data Processing Agreement with the customer.

4. How we use personal information

We use the personal information described in Section 2 to:

• provide, operate, secure, and support the Service, including authentication and account administration;
• process subscriptions, billing, and payments, and maintain financial records;
• operate our compliance program, including sanctions and AML screening, identity and business verification, and related record-keeping, and to meet our legal and regulatory obligations;
• detect, investigate, and prevent security incidents, fraud, and misuse of the Service, and enforce our Terms of Service;
• communicate with you about the Service, including transactional notices, security alerts, and support;
• send commercial electronic messages in compliance with Canada's Anti-Spam Legislation (CASL), only with your consent or as otherwise permitted, and always with the ability to unsubscribe;
• analyze usage in aggregated or de-identified form to improve the Service; and
• comply with applicable law, respond to lawful requests, and establish, exercise, or defend legal claims.

Where we rely on consent, you may withdraw it at any time, subject to legal or contractual restrictions and reasonable notice; withdrawal may affect our ability to provide the Service.

5. Artificial intelligence features

The Service includes AI-powered features such as document classification, data extraction, and compliance analysis. Content processed by these features is used solely to deliver the requested functionality. We do not use customer content or personal information to train, fine-tune, or improve AI or machine-learning models, whether our own or third parties', and we contractually require our AI service providers to honour the same restriction. AI outputs are generated by probabilistic systems and are reviewed and relied upon by our customers under their own professional responsibility, as described in our Terms of Service.

6. When we disclose personal information

6.1 Service providers. We disclose personal information to service providers that support the operation of the Service — including cloud infrastructure (hosted in Toronto, Canada), content delivery and security, AI processing, email delivery, error monitoring, and accounting — under contracts that restrict their use of the information to providing services to us and require protection comparable to this Policy. Our current subprocessors for customer content are listed on our Subprocessors page.

6.2 Payment processing. Payments are processed by Helcim Inc. (Calgary, Canada), which acts as an independent organization in respect of payment information it collects through its hosted payment interface. Its handling of your information is described in its own privacy policy.

6.3 Screening sources. In operating our compliance program (Section 2.2), we may submit names and identifiers to screening data sources and public registries, including sanctions-list providers and government registries in Canada and abroad, to perform the checks described.

6.4 Legal requirements. We may disclose personal information where required or permitted by law, including in response to a judicial decision, court order, subpoena, warrant, production order, or other legally binding demand from a court or competent authority, as described in Section 10.5 of the Terms of Service, and to protect our rights, safety, or property or those of others.

6.5 Business transactions. If Agilio is involved in a merger, amalgamation, financing, reorganization, or sale of all or part of its business or assets, personal information may be disclosed to the parties involved and transferred as part of the transaction, subject to confidentiality obligations and continued protection under applicable privacy law.

6.6 No sale. We do not sell personal information, and we do not disclose it to third parties for their own marketing purposes.

7. Where personal information is stored and processed

7.1 Our primary infrastructure — compute, databases, and document storage — is hosted in a data centre in Toronto, Ontario, Canada. Personal information persisted at rest by the Service remains in Canada.

7.2 Some of our service providers process specific categories of information outside Canada, principally in the United States (including AI processing, email delivery, and error monitoring) and, for compliance-screening lookups, in the European Union, United Kingdom, United States, and Switzerland. When personal information is processed in a foreign jurisdiction, it may be subject to lawful access by the courts, law enforcement, and national security authorities of that jurisdiction. We use contractual and organizational measures designed to ensure a comparable level of protection wherever the information is processed, consistent with PIPEDA's accountability principle.

8. How long we keep personal information

We retain personal information collected for our own purposes only as long as necessary for the purposes described in this Policy and to meet our legal, regulatory, tax, accounting, and compliance-program record-keeping obligations, after which it is deleted or de-identified. Compliance-screening records may be retained for the period required by applicable financial-crime legislation. Customer content is retained and deleted in accordance with the Terms of Service (Section 12.5) and the DPA: customers may export their content for thirty (30) days after termination, after which it is deleted within ninety (90) days, subject to routine backup cycles and legal preservation obligations.

9. How we protect personal information

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including: encryption of customer content in transit and at rest; a key-custody model under which decryption keys for customer documents are held exclusively by a limited number of designated executive officers and used only in the narrow circumstances described in our Terms of Service; least-privilege access controls with logging; strong authentication options for accounts (multi-factor authentication, passkeys, single sign-on, and magic-link sign-in); personnel confidentiality obligations and training; and incident response procedures. No system is perfectly secure, and you are responsible for safeguarding your own credentials as described in the Terms of Service. If a breach of security safeguards creates a real risk of significant harm, we will report and notify as required by PIPEDA and other applicable laws.

10. Your rights

10.1 Access and correction. Subject to limited exceptions under applicable law, you may request access to the personal information we hold about you for our own purposes, information about how it has been used and disclosed, and correction of inaccuracies. We will respond within the timelines required by applicable law.

10.2 Withdrawal of consent. You may withdraw consent to our collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions and reasonable notice.

10.3 Quebec residents. If Quebec's Act respecting the protection of personal information in the private sector applies to you, you may also have rights to data portability and to request the cessation of dissemination of your personal information, and our Privacy Officer (Section 12) serves as the person in charge of the protection of personal information.

10.4 Complaints. If you are not satisfied with our response to a privacy concern, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the privacy regulator in your province.

10.5 If your request concerns information a PaperVault customer processed about you through the Service, Section 3.3 applies: please contact that organization, which is responsible for responding to you.

11. Children

The Service is a business tool intended for use by organizations and their adult personnel. We do not knowingly collect personal information directly from individuals under 18 for our own purposes. Documents processed by our customers may contain information about minors (for example, in immigration or family files); our customers are responsible for the lawful basis of that processing, as described in Section 3.

12. Privacy Officer and contact

Our Privacy Officer is responsible for our compliance with this Policy and applicable privacy law. Questions, requests, and complaints may be directed to: Privacy Officer, Agilio IT Consulting Inc., 133-290 King Street East, Kitchener, Ontario N2G 2L3, or by email to privacy@agilio.ca.

13. Changes to this Policy

We may update this Policy from time to time. The effective date shows the current version. For material changes, we will provide notice through the Service or by email before the changes take effect, and prior versions are archived and available on request.