Privacy Policy

1. Who We Are and Scope

Supervisr Technology AI inc., operating as Supervisr.ai ("Supervisr", "we", "us"), is a Quebec, Canada company that provides an AI-powered supervision and conversation intelligence platform for human and AI voice agents in regulated industries. This Privacy Policy explains how we collect, use, disclose and protect personal information when you visit supervisr.ai, interact with us as a prospect or business contact, or use the Supervisr platform (together, the "Service").

We act in two capacities. For information about website visitors, prospects, and the Authorized Users of our customers, Supervisr is the organization responsible for the information (a controller). For recordings, transcripts and other data from voice and text interactions processed in the platform on behalf of a customer ("Customer Data"), Supervisr is a service provider (processor) acting on that customer's instructions. Individuals whose voice or text interactions are analyzed should direct questions about those recordings and/or transcripts to the organization they interacted with; we will help that organization respond.

This Policy applies to personal information governed by Quebec's Act respecting the protection of personal information in the private sector (Law 25), Canada's PIPEDA, the UK GDPR and EU GDPR, and the California Consumer Privacy Act (CCPA), as applicable to you.

2. Information We Collect

Information you provide — name, business email, phone number, employer, job title and the content of messages when you request a demo, contact us or sign up for communications; account details when a customer provisions you as an Authorized User.

Information collected automatically — IP address, browser and device type, pages viewed, referring URLs and similar log data, collected through cookies and similar technologies described in Section 9; platform activity logs such as sign-in events and actions taken, used for security and support.

Customer Data processed on behalf of customers — voice recordings, chat and text transcripts, metadata (time, duration, channel, agent and queue identifiers), CRM fields a customer chooses to connect, and the Outputs our AI features generate from them. Customer Data may include personal information about a customer's agents and about the individuals participating in recorded or transcribed interactions. Redaction of personal information in transcripts is optional, configured per customer, and applied after the interaction.

We do not knowingly collect information from individuals under 18, and the Service is not directed to them.

3. How We Use Information and Our Legal Bases

We use personal information for which we are responsible to: provide, secure and support the Service; authenticate users and enforce access controls; respond to inquiries and demo requests; send service notices and, with consent where required, marketing communications you can opt out of at any time; analyze and improve the website and the Service using aggregated or de-identified data; detect, investigate and prevent security incidents, fraud and misuse; and comply with legal obligations.

Where the GDPR or UK GDPR applies, we rely on performance of a contract (providing the Service), our legitimate interests (security, product improvement, business communications with professional contacts), consent (marketing cookies and communications) and compliance with legal obligations. Customer Data is processed only on the customer's documented instructions under a Data Processing Agreement.

Supervisr does not use Customer Data to train models made available to other customers, and does not sell personal information or share it for cross-context behavioural advertising.

4. AI Processing

The Service uses artificial intelligence to transcribe, summarize, score and flag voice and text conversations. AI processing is performed within Supervisr's cloud environment and, for speech-to-text and language model services, through contracted subprocessors bound by data processing terms that prohibit use of the data for their own purposes. Outputs support human quality assurance and supervision; customers remain responsible for any decision taken about an agent or a customer. You may ask the customer organization, or us, for an explanation of how an Output that concerns you was produced, and Supervisr will assist the customer in responding in line with applicable law.

5. How We Share Information

We share personal information only as follows:

• Subprocessors — cloud hosting (Google Cloud Platform), speech-to-text and language model providers, telephony and integration providers, email and analytics tools, and customer support systems. Each is bound by a Data Processing Agreement and reviewed at least annually. The current list of subprocessors is available on request at privacy@supervisr.ai and to customers through their Data Processing Agreement.
• Our customers — Authorized User account and activity information is visible to the customer organization that provisioned the account.
• Legal and safety — where required by law, court order or lawful request of a public authority, or where necessary to protect the rights, property or safety of Supervisr, our customers or others. We will notify affected customers of such requests unless legally prohibited.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this Policy or equivalent protections.

6. Where Information Is Stored and International Transfers

Customer Data is stored in the Google Cloud Platform region configured for the customer: United States, United Kingdom or Canada. Data residency is strictly enforced per customer tenant. Website and business-contact information is hosted in Canada and the United States. Where personal information is transferred outside the jurisdiction in which it was collected, including outside Quebec, Canada, the UK or the EEA, we conduct the assessments required by Law 25 and rely on appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses, and contractual commitments from subprocessors.

7. Retention

We keep personal information only as long as necessary for the purposes described in this Policy or as required by law. Customer Data, including AI interaction data, is retained for 12 months by default and for up to 24 months where the customer so configures, after which it is deleted. System and security logs are retained for 12 months and compliance records for 24 months. On termination of a customer agreement, Customer Data is available for export for 30 days and then deleted in accordance with our Data Retention Policy. Business-contact and marketing information is retained until you ask us to delete it or 24 months after our last interaction, whichever is sooner.

8. Security

Supervisr maintains an information security program aligned with SOC 2 and operated by our Chief Technology Officer, including AES-256 encryption at rest, TLS 1.2+ in transit, single sign-on with multi-factor authentication, role-based access, quarterly access reviews, security monitoring and logging, and an incident response plan. We notify affected customers and, where required, regulators and individuals of a confirmed security incident involving personal information without undue delay and within 72 hours of confirmation. No system is perfectly secure; if you believe your information has been compromised, contact infosec@supervisr.ai.

9. Cookies and Similar Technologies

The website uses strictly necessary cookies to operate, and, with your consent where required, analytics cookies (Google Analytics) and marketing cookies to understand how the site is used and to measure campaigns. You can manage preferences through the cookie banner or your browser settings. Disabling cookies may affect site functionality. The platform itself uses only cookies required for authentication and session security.

10. Your Rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to withdraw consent, to object to or restrict certain processing, to receive it in a portable format, to opt out of marketing, and under the CCPA to not be discriminated against for exercising your rights. To exercise a right, write to privacy@supervisr.ai. We will verify your identity and respond within 30 days, extendable where the law allows and we tell you why. There is no fee unless a request is manifestly unfounded or excessive.

Where your information is processed on behalf of one of our customers, we will refer your request to that customer and assist them in responding.

You may also lodge a complaint with a supervisory authority: in Quebec, the Commission d'accès à l'information; in Canada, the Office of the Privacy Commissioner; in the UK, the Information Commissioner's Office; in the EU, the authority of your member state; in California, the California Privacy Protection Agency.

11. Changes to this Policy

We may update this Policy to reflect changes in the Service or the law. The current version is always available at supervisr.ai/privacy with its "Last updated" date. For material changes we will notify customer administrators and, where appropriate, post a prominent notice on the website.

12. Contact and Person in Charge

The person in charge of the protection of personal information under Law 25 is Richard Couture, Chief Technology Officer. Questions, requests and complaints may be addressed to privacy@supervisr.ai or by mail to Supervisr Technology AI inc., 6000, boulevard Rome, suite 410, Brossard, Quebec J4Y 0B6, Canada.

This Policy is published in French and in English. In the event of inconsistency, the French version prevails for individuals in Quebec and the English version prevails elsewhere.

Document Control

Version

2026.01

Effective Date

October 27, 2026

Owner

Chief Technology Officer (CTO)

Review Cycle

Annual or upon significant change

Approved By

Supervisr.ai Executive Leadership Team

Future revisions will be summarized in this section.