Privacy Policy

1. Introduction

NeuralFlux Inc. ("NeuralFlux," "we," "us," or "our") is committed to protecting the privacy of individuals whose personal information we collect. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal information when you visit neuralflux.life, contact us, enrol in NFX programmes, or use our neural workflow automation platform and related professional services.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Act respecting the protection of personal information in the private sector (Law 25) and substantially similar provincial privacy legislation. By using our website or services, you acknowledge that you have read and understood this policy.

NeuralFlux is the organisation accountable for personal information collected through our website and direct client relationships. When we process data on behalf of enterprise clients under a services agreement, we act as a service provider and the client's privacy policy and data processing addendum govern that processing.

2. Information we collect

2.1 Information you provide directly

We collect personal information that you voluntarily submit through contact forms, programme enrolment, service agreements, studio visits, email correspondence, and platform account registration. This may include:

• Full name, job title, and organisation name
• Email address, telephone number, and mailing address
• Messages and enquiry details submitted via our contact form
• Billing and payment information for programme and service fees
• Consent records, including PIPEDA consent checkboxes on contact forms
• Credentials and authentication data for platform accounts
• Feedback, survey responses, and support tickets

2.2 Information collected automatically

When you visit our website, we automatically collect certain technical information through cookies, server logs, and similar technologies. This may include IP address, browser type and version, operating system, referring URL, pages viewed, time and date of visits, and device identifiers. See our Cookie Policy for details on cookie categories and management options.

2.3 Information from third parties

We may receive personal information from referral partners, event organisers, publicly available professional directories, and enterprise clients who invite team members to flux sandboxes. We require third parties to have lawful authority to share such information and we use it only for the purposes described in this policy or as otherwise disclosed at collection.

2.4 Client data processed on the platform

When enterprise clients deploy NeuralFlux pipelines, we process event streams, model inputs, inference outputs and operational telemetry on their behalf. This client data is governed by the applicable services agreement and data processing addendum. This Privacy Policy focuses on personal information relating to website visitors, prospects, and direct NeuralFlux account holders.

3. How we use personal information

We use personal information for the following purposes, relying on consent, contractual necessity, or legitimate interests as appropriate under PIPEDA:

• Responding to enquiries and providing requested information about programmes and services
• Processing programme enrolment, service contracts, and billing
• Delivering platform access, NFX training, and professional services
• Communicating service updates, security notices, and administrative messages
• Improving our website, platform, and user experience through analytics
• Complying with legal obligations, including tax reporting and regulatory requests
• Protecting against fraud, abuse, and security threats
• Conducting research and development on platform features using anonymised or aggregated data

We do not use personal information for automated decision-making that produces legal or similarly significant effects without human review. Inference pipelines operate on client-controlled data under client-configured policies.

4. Legal basis and consent

Under PIPEDA, we obtain meaningful consent before collecting, using, or disclosing personal information, except where permitted or required by law. Implied consent may suffice for obvious purposes such as responding to a direct enquiry. Express consent is required for sensitive uses, marketing communications, and cross-border transfers where risk warrants additional transparency.

Our contact form requires explicit consent via the consent_pipeda checkbox before submission. You may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal does not affect the lawfulness of processing prior to withdrawal. Contact us using the details in Section 12 to manage consent preferences.

5. Disclosure of personal information

We do not sell personal information. We may disclose personal information to:

• Service providers — Cloud hosting on Canadian and North American infrastructure, email delivery, payment processing, analytics, and customer-relationship management vendors bound by confidentiality and data-protection obligations
• Professional advisers — Lawyers, accountants, and auditors under professional privilege
• Regulatory authorities — When required by applicable law, court order, or lawful government request
• Business transfers — In connection with a merger, acquisition, or sale of assets, with notice to affected individuals where required
• Enterprise clients — Where you participate in a client's flux sandbox or programme as their employee or contractor

6. Cross-border transfers

NeuralFlux hosts primary website and platform infrastructure in Canada and the United States. When personal information is transferred outside Canada, we ensure appropriate safeguards including contractual clauses requiring comparable protection, vendor security assessments, and residency routing options at the pipeline transform layer for client data. We assess transfer risks and provide additional notice where PIPEDA or Quebec law requires.

7. Retention

We retain personal information only as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Contact form submissions are retained for twenty-four months unless a business relationship continues. Programme and service records are retained for seven years for tax and contractual purposes. Analytics data is aggregated and anonymised after thirteen months. You may request earlier deletion subject to legal retention requirements.

8. Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of personal information, including encryption in transit, access controls, security monitoring, employee training, and incident response procedures. No method of transmission or storage is completely secure; we cannot guarantee absolute security but we commit to notifying affected individuals and regulators of breaches as required by law.

9. Your rights

Under PIPEDA and applicable provincial law, you have the right to:

• Access personal information we hold about you
• Request correction of inaccurate or incomplete information
• Withdraw consent where processing is consent-based
• Challenge our compliance with applicable privacy principles
• File a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec

We respond to verified requests within thirty days unless an extension is permitted. We may require identity verification before disclosing information.

10. Children's privacy

Our website and services are not directed to individuals under eighteen years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be posted on this page with an updated "Last updated" date. Continued use of our website after changes constitutes acceptance of the revised policy where permitted by law.

12. International transfers

NeuralFlux primarily processes personal information in Canada. Some service providers including email delivery, analytics and cloud hosting may process data in the United States or other jurisdictions. When information crosses borders, we ensure contractual protections including standard contractual clauses where appropriate and assess risks in accordance with PIPEDA accountability requirements. Enterprise clients may request Canadian-only processing for sensitive programme data under separate agreements.

13. Automated decision-making

We do not use personal information collected through this website to make solely automated decisions that produce legal or similarly significant effects on individuals. Platform services involving machine learning operate on client-provided data under separate agreements that require human oversight and exception handling for high-stakes outcomes.

14. Security incident response

In the event of a security breach involving personal information that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA breach notification provisions. We maintain documented incident response procedures, conduct periodic security reviews and restrict employee access to personal information on a need-to-know basis.

15. Programme and service data

When you enrol in NFX programmes or engage platform services, additional personal and technical information may be collected including organisation name, job title, infrastructure details and use case descriptions. This information is governed by programme enrolment agreements and statements of work in addition to this policy. Client data processed in sandbox and production environments remains the property of the client and is handled according to contractual data processing terms.

16. Contact us

Privacy Officer
NeuralFlux Inc.
1450 McGill College Avenue, Suite 820
Montreal, QC H3A 2M8, Canada
Email: [email protected]
Phone: +1 (438) 555-2936
Business Number: BN 841059283QC0001