Privacy Notice

Accountability

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private-sector organizations in Ontario handle personal information, and Canada's Anti-Spam Legislation (CASL). Our designated privacy officer is Aliakbar Mohsenipour, PhD, who is accountable for our compliance with this notice.

Information we collect

When you submit the contact form or ask our website assistant for follow-up, we collect information you choose to give us. Through the contact form, we collect your name, business email address, optional company name, the service you are interested in, your project description, optional timeframe, how you would like us to reply and, if you ask for a call, your phone number. We also record that you acknowledged this notice and whether you chose to receive updates, with the time. We ask you not to include passwords, customer records, health information, financial identifiers or other sensitive data.

Our hosting provider records standard technical information (such as IP address, browser type and pages requested) in server logs to operate and secure the website. This website does not currently use advertising cookies or third-party analytics.

Website assistant (Nia)

Nia is an automated assistant on our website. It answers from a fixed set of approved information about Northstat that runs on our own website server in Canada; your messages are not sent to an outside AI provider. Messages are processed only to produce a reply and are not stored or logged by us. Nia can make mistakes and does not give legal, financial, medical or other professional advice. Please do not share passwords, payment details, health information or other confidential data in the chat.

If you close the assistant invitation, your browser keeps a note of that in its session storage so the invitation is not shown again; it is removed when you close the browser tab and is not used for tracking.

If you ask Nia for follow-up, you see and can edit the details before anything is sent, and nothing is sent unless you confirm. We then send your name and organization (if given), email address and/or phone number, area of interest, industry (if given), your summary, preferred language and reply channel, the page you were on, a conversation reference, the time and version of your consent, and whether you chose to receive updates, to our business inbox. It is handled like a contact form inquiry. If you choose WhatsApp as the reply channel, we may reply through WhatsApp, which Meta operates under its own terms and privacy policy.

How we use it

We use inquiry information only to respond to your inquiry and to discuss a potential engagement. We do not sell personal information and do not add you to marketing lists unless you separately and expressly agree.

The option to receive occasional updates, on the contact form and in the assistant, is unticked by default and is separate from your inquiry. If you choose it, we record when and how you agreed. Every update will identify us, include our mailing address and a simple way to unsubscribe, and we act on unsubscribe requests within 10 business days, as required by CASL.

Service providers

The website is hosted on Amazon Web Services (AWS) in the Canada (Central) region, and inquiry emails are sent through Amazon Simple Email Service in the same region. Pages are delivered through the AWS global content delivery network, and inquiries are received in a Google Workspace mailbox on the northstatai.com domain, held in a Google Workspace account administered by Webbeon on our behalf. These providers process information on our behalf, and some of their services and support functions may process information outside Canada, where it may be accessible to authorities under the laws of those countries. We use contractual and technical safeguards with these providers.

Retention

We keep personal information only as long as needed for the purposes described above or as required by law:

• Inquiries that do not lead to an engagement: 24 months after our last contact.
• Correspondence with clients: up to 7 years after the engagement ends, to meet tax and record-keeping obligations.
• Records of consent to receive updates: while we send you updates and for 3 years after you unsubscribe.
• Server logs (which do not contain your messages): up to 90 days, for security and operations.

When information is no longer needed, we securely delete it or make it anonymous.

Safeguards

We use reasonable technical and organizational safeguards appropriate to the sensitivity of the information, including encrypted connections (HTTPS), access controls and minimal logging.

Your choices and rights

Subject to applicable law, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you may request access to or correction of the personal information we hold about you, or withdraw consent. Please use our contact page or email info@northstatai.com to make a request to our privacy officer, Aliakbar Mohsenipour, PhD. We will respond within 30 days. You can withdraw consent to updates at any time, and we will then stop sending them.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Privacy breaches

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada and keep a record of the breach, as PIPEDA requires.

Changes

We will update this notice when our practices change and show the revised date below.

Last updated: October 28, 2026.