Privacy Policy

Effective date: August 31, 2026

Last updated: August 31, 2026

Version: 1.0

1. Introduction

Navinside AI ("Navinside", "we", "us", "our") is a company established in Québec, Canada. We develop and operate iRIS, a software agent that learns to operate the business systems used by transportation and logistics companies, and performs operational work within those systems on behalf of its users.

This Privacy Policy explains what information is collected in connection with iRIS, why it is collected, how it is used, who it is shared with, how long it is kept, how it is protected, and what rights you have in relation to it.

We have written this policy to be read and understood, not only to satisfy a legal requirement. If any part of it is unclear, contact our Privacy Officer using the details in Section 18 and we will explain it.

2. Scope of this Policy

This Policy applies to:

• Visitors to our website and other public web properties;
• Individuals who contact us, request a demonstration, or apply to become a design partner;
• Customers who subscribe to iRIS ("Customers"), and the individual users authorized by those Customers ("Users");
• Individuals whose personal information is processed by iRIS in the course of a Customer's operations ("Operational Data Subjects"), such as drivers, dispatchers, and business contacts.

This Policy does not apply to the privacy practices of any third party, including the operators of the business systems that iRIS is directed to use on a Customer's behalf. Those systems are governed by their own privacy policies and by the Customer's relationship with them.

3. Our Role: Controller and Processor

Privacy law distinguishes between an organization that decides why and how personal information is used, and an organization that handles personal information on someone else's instructions. Our role differs depending on the information in question.

Navinside acts as a controller (in Québec terms, the enterprise that collects the information for its own purposes) with respect to:

• Website visitor information;
• Prospect, lead, and enquiry information;
• Customer account and billing information;
• Information about authorized Users necessary to provide and secure the service;
• Technical, diagnostic, and security information generated by the operation of our own systems.

Navinside acts as a processor (handling information on behalf of and under the instruction of a Customer) with respect to:

• Operational information that iRIS reads from, writes to, or transports between the Customer's business systems and their counterparties;
• Documents that iRIS retrieves at a Customer's request;
• Communications sent or received by iRIS on the Customer's behalf.

Where we act as a processor, the Customer is the controller. That Customer determines the purposes of processing, is responsible for having a lawful basis for it, and is the first point of contact for individuals exercising their rights over that information. Our obligations to the Customer in that capacity are set out in our written agreement with them.

4. Information We Collect

4.1 Information you provide to us directly

4.2 Credentials for connected systems

To perform its function, iRIS must be able to sign in to the business systems a Customer directs it to use. Credential handling is described in detail in Section 8. In summary:

• Credentials are held either in the operating system credential store on the machine where iRIS runs, or encrypted with a key that the Customer controls and we cannot access.
• Credentials are never included in any content transmitted to an artificial intelligence provider, nor in logs or analytics.
• We recommend, and support, the use of a dedicated service account for iRIS rather than an individual employee's personal login.

4.3 Operational information processed on a Customer's behalf

In the course of performing work, iRIS may process information contained in a Customer's business systems and communications. In the transportation sector this can include personal information such as:

• Names, telephone numbers, and email addresses of drivers, dispatchers, warehouse staff, and business contacts;
• Driver licence identifiers, where they appear in the Customer's systems (see Section 8.4 for how these are handled);
• Location and status information relating to shipments and vehicles;
• Correspondence relating to operational matters.

We process this information only to perform the service the Customer has engaged us for. We do not use it for our own commercial purposes, we do not sell it, and we do not use it to build profiles of individuals.

4.4 Documents

iRIS retrieves documents (for example, transportation paperwork and proofs of delivery) from source systems when a Customer or their counterparty requests them, transfers them to the intended recipient, and does not retain them as a permanent record. Documents are held only for the limited period described in Section 10.

Where a document is transferred, we retain a record of the event — that a document of a given type moved, when, at whose request, to whom, and a verification record of the file — without retaining the contents of the file itself. This provides an auditable, tamper-evident record of delivery without accumulating a repository of commercial documents.

4.5 Learned operational knowledge

Central to how iRIS works is that it learns how software behaves. It records:

• Knowledge about the behaviour of the business systems it is taught to operate;
• Measurements of its own performance in operating them;
• A record of the decisions it made and the reasons for them.

This is knowledge about software, not about people or about a Customer's commercial affairs. It is deliberately separated from Customer-identifying and personally-identifying information at the point it is recorded.

4.6 Counterparty and reputation information

iRIS maintains records of the businesses a Customer deals with — for example carriers, shippers, receivers, and brokers — including business identifiers such as regulatory authority numbers, and observations about how those businesses performed on specific transactions.

Where these records concern a business, they are business information. Where an individual is identified within them — for example a named contact at a company — that information is personal information and is treated as such under this Policy.

Observations recorded by a Customer, and reputation scores derived from them, are scoped to that Customer. They are not disclosed to other Customers, and are not pooled into a shared reputation database, unless and until a separate feature is introduced for which we obtain specific, informed consent and update this Policy accordingly.

4.7 Technical, usage, and website information

We collect information generated by the ordinary operation of software and websites, including IP address, browser and device characteristics, pages viewed, referring URL, timestamps, application version, error and diagnostic logs, and feature usage. See Section 14 for cookies.

4.8 Information we do not collect

We do not knowingly collect, and iRIS is not designed to process:

• Payment card numbers in full (payments are processed by a specialist payment provider);
• Government identity numbers, other than business regulatory identifiers and the limited licence handling described in Section 8.4;
• Health information;
• Biometric information;
• Information relating to children (see Section 15);
• Special categories of sensitive personal information, unless a Customer places such information into a connected system, in which case it is processed only incidentally and under the Customer's instruction.

5. How We Use Information

We use information for the following purposes:

To provide the service. To operate iRIS, authenticate to connected systems on instruction, perform requested operational work, produce suggestions, and deliver documents and status information.

To improve how the software works. To improve iRIS's ability to operate business systems accurately and reliably. This improvement is based on the knowledge described in Section 4.5, which concerns software behaviour rather than personal or commercial information.

To secure the service. To detect, investigate, and prevent unauthorized access, misuse, fraud, and technical failure, and to maintain an audit trail of actions taken by the software.

To support Customers. To respond to enquiries, provide technical support, and communicate about the service.

To administer our business. To manage accounts, invoicing, and our contractual relationships.

To comply with law. To meet legal, regulatory, tax, and accounting obligations, and to establish, exercise, or defend legal claims.

To communicate with prospects. To respond to enquiries and, where permitted, to send information about the service. Commercial electronic messages are sent in accordance with Canada's Anti-Spam Legislation, and every such message contains a means of unsubscribing.

We do not sell personal information. We do not rent or trade it. We do not use Customer operational information to train general-purpose artificial intelligence models.

6. Legal Bases for Processing

Where Québec and Canadian federal law applies, we process personal information on the basis of consent, or where a recognized exception to consent applies, including that the processing is necessary for the performance of a contract, necessary for our legitimate commercial interests where those interests do not override the individual's interests, or required by law.

Where the European Union General Data Protection Regulation applies, our legal bases are: performance of a contract (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)); our legitimate interests in operating, securing, and improving our service (Article 6(1)(f)); and consent where consent is required (Article 6(1)(a)). Where we rely on legitimate interests, we have assessed that our interests are not overridden by the rights of the individuals concerned, and you may request details of that assessment.

Where we act as a processor, the legal basis for processing operational information is determined by the Customer as controller.

7. Automated Processing and Human Oversight

iRIS is an automated system. It reads information, forms judgments about what action to take, and can take that action within a Customer's business systems. We consider it important to be explicit about this.

What is automated. iRIS can select among possible courses of action, assess its own confidence in a course of action, propose a plan, and carry out routine operational steps such as entering data, updating a status, retrieving a document, or sending a routine notification.

Human oversight. The service is designed so that a human remains in control of consequential actions:

• Actions above a defined level of consequence require human approval before they are executed.
• Where iRIS is not sufficiently confident, it stops and asks a person rather than proceeding.
• Every decision is recorded together with the reason for it, and that record is available to the Customer.
• A Customer may restrict the scope of what iRIS is permitted to do, and may withdraw permissions at any time.

Decisions about individuals. iRIS is designed to perform operational work, not to make decisions that produce legal or similarly significant effects concerning individuals. Where a Customer configures iRIS in a way that contributes to such a decision — for example, using performance observations as an input to a decision about an individual contractor — that Customer is the controller of that decision and is responsible for complying with the requirements that apply to it.

Your rights regarding automated processing. Where you are subject to a decision based exclusively on automated processing that produces legal effects or significantly affects you, you have the right to be informed of that fact, to be informed of the principal information used, to present observations, and to request that the decision be reviewed by a person. Contact our Privacy Officer to exercise these rights. Where the decision was made by a Customer using iRIS, we will direct your request to that Customer and support them in responding.

8. Credentials, Security, and Confidentiality

8.1 Security measures

We maintain administrative, technical, and physical safeguards proportionate to the sensitivity of the information we handle. These include:

• Encryption of information in transit using current transport security standards, and encryption of information at rest;
• Isolation of each Customer's operational environment from every other Customer's;
• Access control on the principle of least privilege, with access to production environments restricted to personnel who require it;
• Authentication controls including multi-factor authentication for personnel with access to production systems;
• Logging of access and of actions taken by the software, retained for audit purposes;
• Separation, enforced in our software, between the components that record system knowledge and the components that handle identifying information;
• Regular review of our security posture, and testing of our software before release.

No method of transmission or storage is completely secure. We do not represent that our safeguards are impenetrable. We commit to maintaining safeguards appropriate to the risk and to notifying affected parties in accordance with Section 12 if an incident occurs.

8.2 Credential custody

Credentials for a Customer's connected systems are held in one of two ways:

1. On a machine the Customer controls, in the operating system's protected credential store; or
2. Under encryption that only the Customer can unlock. In this arrangement we cannot read the credential. Each use of the Customer's key is recorded in the Customer's own audit log, and if the Customer disables the key, we are permanently unable to access the credential, including if we were legally compelled to attempt it.

We recommend the use of a dedicated service account, with permissions limited to what iRIS requires, rather than an individual's personal login. This produces a distinct audit trail and allows access to be revoked without affecting any employee.

8.3 Credentials and language models

Credentials are used mechanically by the software to authenticate. They are never placed in any content, log, analytics event, or other payload sent to an artificial intelligence provider.

We acknowledge openly that during authentication a credential exists in memory on the machine performing the sign-in. This is inherent to any system that signs in on a user's behalf. The controls above are designed to limit the consequences of that exposure rather than to claim it does not exist.

8.4 Driver licence identifiers

Where a driver licence identifier appears in a Customer's systems, iRIS stores only an irreversible coded form of it, for the sole purpose of recognizing that two records refer to the same individual. The licence number itself is discarded at the point of processing. It is not stored, not displayed anywhere in the product, and cannot be reconstructed from that form.

9. Disclosure and Service Providers

We disclose personal information only in the following circumstances.

To service providers. We use a limited number of third-party providers to deliver the service, in the following categories:

Each provider is bound by contract to process information only on our instructions, to protect it appropriately, and not to use it for their own purposes. A current list of our service providers, naming each one, is available to Customers and to any individual on request from our Privacy Officer.

Artificial intelligence providers. Operational text may be sent to an artificial intelligence provider so that iRIS can reason about it. Where such text contains personal information, it is minimized before transmission. We contract for terms under which such content is not retained beyond the period necessary to return a response and is not used to train the provider's models.

To a Customer. Where we act as a processor, information is disclosed to and accessible by the Customer who is the controller of it.

To counterparties on instruction. iRIS transmits operational information — for example a status update or a document — to a counterparty when directed to do so by a Customer or by the Customer's configuration. Nothing is transmitted to a counterparty that the Customer has not authorized.

In a business transaction. If Navinside is involved in a merger, acquisition, financing, or sale of assets, information may be disclosed to the parties involved, subject to confidentiality obligations, and any acquirer will remain bound by the commitments in this Policy or will notify you of any change.

Where required by law. We may disclose information where required by valid legal process, to protect our rights, to protect the safety of any person, or to investigate suspected illegal activity. We will assess the validity of any such demand, will disclose only what is required, and will notify the affected Customer unless legally prohibited from doing so.

We do not sell personal information, and we do not disclose it to advertisers or data brokers.

10. Retention

We retain information only as long as necessary for the purpose for which it was collected, or as required by law.

On termination of a Customer relationship, operational and personal information is deleted or returned in accordance with our agreement with that Customer. Where credentials were held encrypted under a Customer-controlled key, the Customer may render all such information permanently inaccessible by disabling the key.

11. Location of Information and Cross-Border Transfers

Primary storage. Information is stored on cloud infrastructure located in Canada.

Transfers outside Canada. Certain processing necessarily takes place outside Canada. In particular, operational text is transmitted to artificial intelligence providers whose processing infrastructure may be located in the United States. Some of our business operations tooling may also process limited information outside Canada.

Assessment. Before transferring personal information outside Québec, we conduct a privacy impact assessment considering the sensitivity of the information, the purpose of its use, the protections it would receive, and the legal framework of the destination jurisdiction, as required by Québec law. Transfers proceed only where the information will receive adequate protection, and are governed by written agreement.

Legal effect of foreign jurisdiction. Information located in another country is subject to the laws of that country and may be accessible to its courts and public authorities. We minimize personal information in any content transmitted outside Canada, and we contract for non-retention.

European transfers. Where personal information subject to the GDPR is transferred outside the European Economic Area, we rely on the European Commission's adequacy decision in respect of Canada or, where applicable, on Standard Contractual Clauses together with supplementary measures.

12. Confidentiality Incidents and Breach Notification

We maintain a register of confidentiality incidents as required by Québec law.

If a confidentiality incident occurs that presents a risk of serious injury, we will promptly notify the *Commission d'accès à l'information du Québec*, the Office of the Privacy Commissioner of Canada where federal law applies, and any relevant supervisory authority under the GDPR, within the timeframes those laws require. We will notify affected individuals, and any affected Customer, without undue delay, and will describe what occurred, what information was involved, what we are doing about it, and what steps the recipient may wish to take.

Where we act as a processor, we will notify the affected Customer without undue delay so that they may fulfil their own notification obligations.

13. Your Rights

Subject to the conditions and exceptions in applicable law, you have the following rights in respect of your personal information.

• Access. To be informed whether we hold personal information about you and to obtain a copy of it.
• Rectification. To have inaccurate, incomplete, or ambiguous information corrected.
• Deletion. To request deletion of information that is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other basis applies.
• Withdrawal of consent. To withdraw consent at any time, where processing is based on consent. Withdrawal does not affect processing that occurred before withdrawal, and may mean we can no longer provide part of the service.
• Portability. To receive the computerized personal information you provided to us in a structured, commonly used technological format, and to have it transmitted to another organization where technically feasible.
• Cessation of dissemination and de-indexing. To require that information about you cease to be disseminated, or that a hyperlink giving access to it be de-indexed, where dissemination contravenes law or a court order.
• Objection and restriction. Where the GDPR applies, to object to processing based on legitimate interests, and to request restriction of processing in defined circumstances.
• Automated decision-making. The rights described in Section 7.
• Complaint. To lodge a complaint with a supervisory authority, as described in Section 17.

How to exercise your rights. Write to our Privacy Officer using the details in Section 18. We will respond within thirty (30) days of receiving your request. We may need to verify your identity before acting. We do not charge a fee, although we may charge a reasonable fee for transcription, reproduction, or transmission where the law permits, and we will inform you of any such fee in advance. If we refuse a request, we will explain why, identify the legal provision relied on, and inform you of your right to seek review.

If your information was processed on behalf of a Customer. Where we hold your information as a processor — for example if you are a driver or a contact whose details appear in a Customer's systems — the Customer is the controller of that information. Contact them directly where possible. If you contact us, we will forward your request to the relevant Customer and assist them in responding.

14. Cookies and Website Analytics

Our website uses cookies and similar technologies. We distinguish:

• Strictly necessary cookies, required for the site to function and to keep it secure. These are set without consent because the site cannot operate without them.
• Analytics cookies, which help us understand how the site is used so we can improve it. These are set only with your consent.
• Preference cookies, which remember choices such as language.

We do not use advertising cookies and we do not permit third-party advertising networks to track visitors on our site.

Where consent is required, you will be asked on your first visit and may change your choice at any time through the cookie settings link on the site. You may also configure your browser to refuse cookies, though parts of the site may not function correctly if you do.

We honour Global Privacy Control and similar automated opt-out signals where our systems receive them.

15. Children

iRIS is a business tool. It is not directed at children, and we do not knowingly collect personal information from anyone under the age of majority. If we become aware that we have collected such information without appropriate authorization, we will delete it. If you believe a child has provided us with personal information, contact our Privacy Officer.

16. Changes to This Policy

We may update this Policy to reflect changes in our practices, our technology, or the law. When we do, we will revise the "Last updated" date at the top and, where the change is material, notify Customers by email and place a notice on our website in advance of the change taking effect. Previous versions are available on request.

We will not materially reduce your rights under this Policy without providing you with notice and, where required, obtaining your consent.

17. Complaints and Supervisory Authorities

If you are not satisfied with how we have handled your personal information or your request, contact our Privacy Officer first. We take complaints seriously and will investigate.

If you remain dissatisfied, you may complain to:

Commission d'accès à l'information du Québec Website: cai.gouv.qc.ca

Office of the Privacy Commissioner of Canada Website: priv.gc.ca

Your local supervisory authority in the European Economic Area or the United Kingdom, if the GDPR or UK GDPR applies to your information.

18. Contact and Privacy Officer

In accordance with Québec law, we have designated a Privacy Officer responsible for the protection of personal information.

Privacy Officer Sam Ouhsaine, Chief Executive Officer Navinside AI

Email: support@navinside.ai

Requests to exercise the rights in Section 13 should be sent to the Privacy Officer at the address above.

19. Scope Notice

This Privacy Policy applies to iRIS only.

It governs the iRIS product, the navinside.ai website, and the enquiries, accounts, and Customer relationships associated with them. It does not govern any other product, service, brand, or offering that Navinside AI may operate or introduce, now or in the future. Any other product will be governed by its own privacy policy, published separately.

If you are unsure whether this Policy applies to a particular interaction with us, contact our Privacy Officer and we will tell you.

*© Navinside AI. All rights reserved.*