Privacy Policy

Privacy Policy

This Privacy Policy explains how SUSTYC collects, uses, discloses, stores, and protects personal information and uploaded content when you use PerforaScan.

1. Who We Are

PerforaScan is operated by SUSTYC. For privacy questions, requests, or complaints, contact: privacy@sustyc.ca.

2. Information We Collect

We may collect:

• account information, such as name, email address, phone number, password credentials handled through authentication providers, language preference, and account settings;
• company information, such as company name, industry, size, address, site information, revenue band, and operational profile;
• uploaded files, including videos, images, PDFs, documents, file names, metadata, and related notes;
• questionnaire and diagnostic responses;
• generated outputs, including reports, recommendations, scores, action plans, proofs, and progress records;
• technical information, such as IP address, user agent, device/browser information, login activity, audit logs, cookies, and security events;
• billing information processed through payment providers.

3. Uploaded Files

Uploaded files may contain confidential business information or personal information, including people visible in videos or images. You are responsible for ensuring that you have the authority, notices, and consents required to upload and process those files.

4. How We Use Information

We use information to:

• create and manage your account;
• provide operational diagnostics and reports;
• analyze uploaded files and questionnaire responses;
• generate recommendations, action plans, and progress tracking;
• provide support, security, audit logs, and fraud prevention;
• manage billing and subscriptions;
• improve and maintain the platform;
• comply with legal obligations.

5. AI Processing

Uploaded files and related information may be processed by AI systems and service providers to generate diagnostics, summaries, findings, recommendations, and reports. AI outputs may be incomplete or inaccurate and must be reviewed by the user before any decision or action is taken.

6. Service Providers and Subprocessors

We may use service providers for hosting, storage, authentication, payment processing, email delivery, analytics, and AI processing. These providers may process information only as needed to provide their services to us.

7. International Transfers

Although SUSTYC aims to use secure infrastructure appropriate for Canadian businesses, some service providers may process or store information outside Quebec or Canada. When this happens, information may be subject to the laws of the jurisdiction where it is processed.

8. Legal Bases and Consent

Where required by law, we rely on your consent to collect, use, or disclose personal information. In other cases, we may rely on contractual necessity, legitimate business interests, legal obligations, or other lawful bases.

9. Retention

We retain information only as long as necessary for the purposes described in this Policy, to provide the service, comply with legal obligations, resolve disputes, enforce agreements, maintain audit records, and protect security. Legal acceptance records, billing records, and security logs may be retained longer where required.

10. Security

We use reasonable administrative, technical, and organizational safeguards to protect information. No system is completely secure, and we cannot guarantee absolute security.

11. Privacy Rights

Depending on where you are located, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of your personal information. You may also withdraw consent where processing is based on consent. To exercise these rights, contact privacy@sustyc.ca.

12. Quebec and Canadian Privacy

For Quebec and Canadian users, SUSTYC will handle requests for access, correction, withdrawal of consent, and deletion in accordance with applicable privacy laws. If a confidentiality incident involving personal information creates a risk of serious injury, SUSTYC will take reasonable measures and provide required notices.

13. California Privacy Notice

We do not sell personal information. We do not knowingly share personal information for cross-context behavioural advertising unless clearly disclosed and consented where required. California residents may have rights to know, delete, correct, opt out of certain sharing, limit use of sensitive personal information, and not be discriminated against for exercising privacy rights.

14. European Users

If EU, EEA, UK, or Swiss data protection laws apply, you may have rights to access, rectify, erase, restrict, object, portability, and lodge a complaint with a supervisory authority. If we process data on behalf of your organization, additional data processing terms may apply.

15. Cookies

We use essential cookies to provide the platform. Analytics and marketing cookies are used only where enabled or consented through cookie preferences.

16. Children

PerforaScan is not intended for children or minors. Do not upload information about minors unless you are legally authorized to do so and it is necessary for a legitimate business purpose.

17. Changes

We may update this Privacy Policy from time to time. If material changes are made, users may be asked to review or accept the updated version.

This document may be updated from time to time. If material changes are made, users may be asked to accept the updated version.