Data Processing Agreement

1. Definitions

"Personal Information" means information about an identifiable individual as defined in PIPEDA, Quebec Law 25, and other applicable Canadian privacy laws.

"Processing" means any operation performed on Personal Information, including collection, use, disclosure, retention, and disposal.

2. Scope and Purpose

Canada Compliance AI will process Personal Information solely for the purpose of providing the Services as described in the Terms of Service, including CASL compliance assessment and guidance, PIPEDA privacy management, and Quebec Law 25 readiness scoring.

3. Data Residency and Sub-Processors

Primary Data Storage: Customer compliance records, account data and authentication are stored in Canadian data centers (Montreal region) via Supabase Canada. Certain sub-processors listed below process limited Personal Information outside Canada under contractual safeguards.

Sub-Processors: Canada Compliance AI engages the following sub-processors to deliver the Services. A current list is maintained at canadacomplianceai.ca/subprocessors:

• Supabase Inc. (database, authentication, storage) — Canada (Montreal)
• Stripe Inc. (payment processing) — US/EU, PCI DSS Level 1, PIPEDA-compliant DPA
• Resend Corp. (transactional email) — US, GDPR/PIPEDA-compliant DPA
• Vercel Inc. (hosting, CDN) — Global edge caching, Canada-preferred routing
• Google LLC (analytics, opt-in only) — US, Standard Contractual Clauses
• Anthropic PBC (AI-assisted compliance features, only when an AI feature is used) — US, does not train on API inputs or outputs

4. Controller Obligations

Controller warrants that it has obtained all necessary consents and legal bases to provide Personal Information to Canada Compliance AI for processing under this DPA.

5. Processor Obligations

Canada Compliance AI will:

• Process Personal Information only on documented instructions from Controller
• Implement appropriate technical and organizational security measures (encryption at rest and in transit, role-based access control, audit logging)
• Assist Controller in responding to data subject access requests (DSAR) under PIPEDA and Quebec Law 25
• Notify Controller of any Personal Information breach within 72 hours of discovery
• Return or delete Personal Information upon termination, as instructed by Controller

6. Data Subject Rights

Canada Compliance AI will assist Controller in fulfilling data subject requests for access, correction, deletion, and portability under PIPEDA, Quebec Law 25, Alberta PIPA, and BC PIPA.

7. Security Incident Notification

In the event of a security incident affecting Personal Information, Canada Compliance AI will notify Controller within 72 hours via email to the Controller's registered email address and provide reasonable assistance in breach investigation and notification to affected individuals or regulators as required by law.

8. Audits and Compliance

Canada Compliance AI will make available to Controller information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits by Controller or an auditor mandated by Controller, subject to reasonable advance notice and confidentiality obligations.

9. Data Retention and Deletion

Upon termination of the Services, Canada Compliance AI will delete or return all Personal Information within 30 days, except where retention is required by law. Controller may request earlier deletion by contacting contact@canadacomplianceai.ca.

10. Governing Law

This DPA is governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein. Any disputes will be subject to the exclusive jurisdiction of the courts of Alberta.

11. Contact Information

For questions about this DPA or to exercise data protection rights, contact:
Email: contact@canadacomplianceai.ca
Mail: Canada Compliance AI Inc., c/o Brainfy AI Inc., Edmonton, AB, Canada