This policy explains what personal information Veille Technologies Inc. collects, why we collect it, where it lives, how long we keep it, and the rights you can exercise at any time, as required by Québec's Law 25.
Veille Technologies Inc. ("Veille", "we") is a Québec company headquartered in Montréal, Canada. We provide an AI compliance platform that helps Canadian enterprises discover, monitor, and document their AI systems against regulatory frameworks.
As required by Law 25, we have designated a person in charge of the protection of personal information (responsable de la protection des renseignements personnels): Serge Anthony Maa, Founder, reachable at [email protected].
We collect personal information for specific, declared purposes only:
We do not use your personal information for purposes you have not consented to, and we do not sell it to anyone.
Client platform data is hosted in AWS ca-central-1 (Montréal, Canada) and does not leave Canada in the ordinary course of operating the service. One exception: LLM inference currently runs on Anthropic's API (US) over compliance metadata only (obligation text and system metadata, never your vault documents), and is migrating to AWS Bedrock ca-central-1 for full Canadian residency.
Where a transfer of personal information outside Québec is ever required, we first conduct the privacy impact assessment required by Law 25 (s. 17) and ensure the information receives adequate protection.
Data residency is not a feature tier at Veille. Canadian hosting is the default for all clients, at every plan level.
Compliance records created in the Veille platform, system inventories, assessments, evidence, audit trails, are the property of the client organization. We process them only to provide the service, under the instructions defined in our client agreements.
We never use client compliance data to train models, benchmark other clients, or for any purpose other than operating the service for you.
When personal information is no longer required for its declared purpose, it is destroyed or anonymized.
Under Law 25 and applicable Canadian privacy law, you can at any time:
Write to [email protected]. We respond within 30 days. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
We rely on a small number of service providers (cloud hosting, email delivery) bound by written agreements that meet Law 25 requirements. Each provider is limited to the processing necessary to deliver its function. The current list of subprocessors for platform clients is available on request.
Personal information is protected by encryption in transit and at rest, role-based access controls, and audit logging. Our full security practices are documented on the Security page. In the event of a confidentiality incident presenting a risk of serious injury, we notify the Commission d'accès à l'information and affected individuals as required by Law 25.
When we change this policy, we update the date at the top of this page and, for material changes affecting platform clients, we notify account administrators directly. Earlier versions are available on request.
Privacy officer, Serge Anthony Maa
[email protected]
Veille Technologies Inc., Montréal, Québec, Canada
Last updated June 10, 2026, This policy is provided in English and French. In case of discrepancy, the French version prevails for Québec residents. Version française disponible sur demande à [email protected].