Privacy Policy

1. Controller

Verdictia Inc. (“Verdictia”, “we”, “us”) is responsible for personal information collected through verdictia.com and related services. For privacy questions, contact contact@verdictia.com.

2. Information collected

We may collect contact information, technical and usage information needed to operate, secure, diagnose and improve the service, and contract-related documents submitted or shared as part of the analysis service. When a public website form is used, technical information may include the IP address, browser type, user-agent, request origin, and the date and time of submission.

3. Purposes

Information is used to respond to demo or pilot requests, provide and improve contract analysis, secure the platform, and comply with applicable legal obligations in Quebec and Canada.

4. Cookies and similar technologies

Verdictia does not use advertising cookies, advertising trackers or tracking technologies for commercial profiling.

The public verdictia.com website may use technologies that are strictly necessary for its operation, such as site display, security, technical availability measurement or preference storage where those functions are present.

The public website may store a timestamp in the browser's local storage to prevent repeated form submissions. This information is not used for advertising or user profiling.

Where analytics, marketing or non-essential third-party cookies are used, they are activated only with your consent where required by law.

The Verdictia application available to authorized users uses technical cookies that are strictly necessary for authentication, session renewal, security and access protection. These cookies may include a short-lived access cookie and a session renewal cookie. They are configured as HttpOnly, which means they cannot be read by JavaScript running in the browser.

These authentication cookies are used only to provide the service, maintain the session, verify access rights and protect the platform. They are not used for advertising or commercial profiling.

The application may keep certain non-secret functional elements in browser local or session storage, such as the user identifier, display name, language, interface state or certain session-related messages. Authentication tokens should not be stored in local or session storage in production.

5. Contracts and AI models

Contract documents submitted to Verdictia are not used to train, fine-tune or improve artificial intelligence models. They are processed only to provide the requested analysis.

Under the terms applicable to Amazon Bedrock, content submitted for inference is not shared with model providers and is not used to train foundation models.

6. Hosting and data location

Persisted application data, including contract documents stored in Verdictia, is hosted in Canada. Certain artificial intelligence features use Amazon Bedrock and may require data processing in AWS Regions located in the United States. Such processing is performed under the security and confidentiality measures applicable to the service.

The current pilot offering does not include an option guaranteeing inference processing exclusively in Canada. Any specific data residency or processing-location requirement must be agreed in writing with Verdictia before use of the service.

7. Recipients

Verdictia does not sell personal information. Personal information may be communicated, only to the extent necessary to provide, secure or support the service, to technology providers acting on Verdictia's behalf, including:

• Amazon Web Services, for hosting, storage, infrastructure services and artificial intelligence inference;
• Microsoft, for receiving and managing electronic communications;
• any other authorized provider whose services are necessary to operate Verdictia and that is subject to appropriate confidentiality and security obligations.

Some processing performed by these providers may take place outside Quebec or Canada. Verdictia governs such processing in accordance with applicable legal requirements.

8. Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, including providing the service, managing the user relationship, securing the platform, complying with legal obligations and resolving disputes.

When information is no longer required, we delete it, securely destroy it or anonymize it in accordance with applicable law.

Contract documents, analyses and associated data are retained for the duration of the client organization's use of the service, unless deletion is requested, the account is closed, or a written agreement provides otherwise.

When a client requests deletion of its workspace, Verdictia deletes from active application systems the associated users, contracts, contract versions, reference files, comments and analysis outputs, product feedback tied to the client, and related semantic index entries. Storage objects linked to documents and reference files are deleted with a bounded retry mechanism for temporary failures.

When a user is deleted, Verdictia deletes that user's own items, including analyses, documents, reference files, product feedback, sessions, private criteria and related semantic index entries. Shared criteria created by that user may be retained without personal attribution where needed to preserve the client's workspace.

Certain technical data, security logs and metadata-only telemetry may be retained for up to twelve (12) months where reasonably necessary for security, diagnostics, operational audit, AI cost tracking, abuse prevention, compliance, protection of Verdictia's rights, backup management, or where permitted or required by law. These logs and telemetry must not include raw contracts, full prompts, full AI responses, secrets or authentication tokens.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, withdrawal of consent or file a complaint with the Commission d’accès à l’information du Québec. To exercise rights: contact@verdictia.com.

10. Security

Verdictia applies safeguards proportionate to the sensitivity of the information processed, including encryption in transit using modern TLS protocols, encryption at rest, access controls, security-event logging and periodic reviews of protective measures.

11. Changes

This policy may be updated. Material changes will be communicated to active users or posted on this page with an updated effective date.

12. Contact

Person responsible for the protection of personal information:
Abdesselam Belkhiri, President, Verdictia Inc.
contact@verdictia.com
Verdictia Inc. · Montreal, Quebec, Canada