Your data is stored in Canada.
At Inquisitive Flow Learning, we believe your privacy is not optional. Your personal information and learning data are stored in Canada, with strict contractual safeguards on every service we use.
Table of Contents
- Information We Collect
- How We Use Your Information
- AI and Your Data
- How We Protect Your Information
- Third-Party Service Providers
- Privacy Impact Assessment
- Data Retention
- Your Privacy Rights
- Children's Privacy
- Data Residency & Protection
- Cookies and Tracking
- Data Breach Notification
- Changes to This Policy
- Summary
- Contact & Complaints
1. Information We Collect
We collect only the information necessary to provide our learning services. Here is exactly what we collect and why:
| Information | Purpose | Retention |
|---|---|---|
| First name, Last name | Account identification, personalization | Until account deletion |
| Email address | Account login, communications, password reset | Until account deletion |
| Password (encrypted) | Account security (bcrypt hashed, never stored in plain text) | Until account deletion |
| Learning preferences | Personalize educational content and AI responses | Until account deletion |
| Subscription information | Manage your plan (Explorer, Scholar, or Sage) and billing | Until account deletion + legal retention |
| Learning session data | Provide AI tutoring, mind maps, and progress tracking | Until account deletion |
2. How We Use Your Information
We use your information for the following purposes, with the corresponding legal basis under PIPEDA and Quebec Law 25:
| Purpose | Legal Basis |
|---|---|
| Provide personalized AI tutoring sessions | Performance of contract (your subscription) |
| Generate mind maps showing concept connections | Performance of contract |
| Process subscription payments | Performance of contract |
| Send account notifications (password reset, subscription updates) | Performance of contract |
| Improve service quality and fix bugs | Legitimate interest |
| Comply with legal requirements | Legal obligation |
We NEVER:
- Sell your personal information to third parties
- Use your data for advertising or marketing profiling
- Use your conversations to train AI models
- Share your learning data with other users
- Track your browsing activity across other websites
3. AI and Your Data
Cohere (Canada's leading AI company)
Your conversations with Mnemosyne are processed by Cohere Inc., Canada's leading AI company, headquartered in Toronto. Processing takes place on Cohere's secure cloud infrastructure in the United States under a data protection agreement. Your conversations are never used to train Cohere's models and are automatically deleted from Cohere's systems within 30 days. Your account identity is never sent with your conversations.
When you use Mnemosyne, your conversations are processed by our AI to provide personalized tutoring. This educational content:
- Is used solely to provide your personalized learning assistance
- Is stored to enable your mind map feature showing concept connections
- Is not used to train AI models
- Is not shared with other users or third parties for their purposes
- Contains educational topics only (e.g., "photosynthesis", "algebra") — not personal information
Perplexity AI (Sage Tier — Research Mode)
If you are on the Sage plan, the research mode feature sends your research queries to Perplexity AI (US-based) to retrieve cited, up-to-date sources. Only the research query is sent — no personal information or account data is transmitted.
Google Cloud Vision (Scholar & Sage Tiers — Handwriting OCR)
If you are on the Scholar or Sage plan, you can upload handwriting images for text recognition. These images are sent to Google Cloud Vision (US-based) for optical character recognition. Only the image data is sent — no personal information or account data is transmitted. Google does not retain your images after processing.
4. How We Protect Your Information
We implement industry-leading security measures to protect your information:
- Encryption in transit: All data is encrypted using TLS 1.3 between your browser and our servers
- Encryption at rest: All stored data is encrypted using AES-256
- Password hashing: Passwords are hashed using bcrypt with strong salting — we never store your password in plain text
- CSRF protection: Cross-site request forgery tokens protect all state-changing requests
- Multi-factor authentication: MFA is available for all accounts for an additional layer of security
- Regular security audits: Continuous monitoring and periodic security assessments
- Access controls: Strict limits on employee access to personal data, following the principle of least privilege
5. Third-Party Service Providers
We work with trusted third-party providers to deliver our service. All providers are bound by data processing agreements.
| Provider | Purpose | Location | Data Shared |
|---|---|---|---|
| Cohere Inc. | AI language processing | Canada (HQ); processing in the United States — DPA: no training, 30-day deletion | Learning queries (not used for training) |
| AWS | Application server, database, secrets | Canada | All application data (encrypted) |
| Stripe | Payment processing | United States | Payment card data (we never store card details) |
| SendGrid (Twilio) | Transactional email delivery | United States | Email address, email content |
| Cloudflare | CDN, DDoS protection, DNS | Global | IP address, request metadata |
| Perplexity AI | Research mode (Sage tier only) | United States | Research queries only |
| Google Cloud Vision | Handwriting OCR (Scholar & Sage tiers) | United States | Uploaded handwriting images only |
Your data is stored in Canada. Your application data lives on AWS Canada (Montréal region). AI language processing is performed by Cohere, a Canadian company, on secure infrastructure in the United States under contractual safeguards (no training on your data; 30-day deletion). Auxiliary services (Stripe billing, SendGrid email, Cloudflare CDN, and optional features like research and handwriting OCR) also process limited data in the US or globally.
6. Privacy Impact Assessment
In accordance with Quebec Law 25, a Privacy Impact Assessment (PIA) is currently in progress for Mnemosyne. This assessment evaluates the privacy risks associated with our collection, use, and storage of personal information, and identifies measures to mitigate those risks.
The PIA covers all aspects of our data processing, including AI interactions, third-party integrations, and cross-border data transfers. Results will inform any necessary adjustments to our privacy practices.
7. Data Retention
We retain your information only as long as necessary for the purposes described in this policy.
| Scenario | Retention Period | Details |
|---|---|---|
| Active account | While account is active | All data retained to provide the service |
| Account deletion | 30 days | Personal information is permanently deleted within 30 days of your request |
| Legal requirements | As required by law | Some financial records may be retained longer to comply with tax and accounting laws |
8. Your Privacy Rights
Under PIPEDA and Quebec Law 25, you have the following rights regarding your personal information:
- Right of access: Request a copy of all personal information we hold about you
- Right of rectification: Correct any inaccurate or incomplete information
- Right of deletion: Request the deletion of your account and all associated personal information
- Right of portability: Receive your data in a structured, commonly used, machine-readable format
- Right to withdraw consent: Withdraw your consent at any time (note: this may affect your ability to use the service)
- Right to be informed: Know what information we collect and how it is used
To exercise any of these rights, contact our Privacy Officer at support@inquisitiveflow.ca. We will respond within 30 days.
9. Age Requirement (16+)
Mnemosyne is available to learners 16 years of age or older. We verify age with a date of birth at account creation and do not knowingly create accounts for, or collect personal information from, anyone under 16.
If we learn that an account belongs to someone under 16, we will close the account and delete its personal information promptly.
Younger students can use Aethon, our school platform, through their school with teacher oversight and the additional safeguards school settings require.
Questions about age verification, or requests to review or delete information, can be sent to support@inquisitiveflow.ca.
10. Data Residency & Protection
Your data is stored in Canada.
- Application server and database: AWS Canada (Montreal, Canada)
- AI processing: Cohere Inc. (Canadian company; US processing under a data protection agreement — no training, 30-day deletion)
- Company headquarters: Montreal, Quebec, Canada
- Roadmap: we are committed to moving AI processing onto Cohere's Canadian infrastructure as it becomes available.
Some auxiliary services (Stripe for payments, SendGrid for email, Cloudflare for CDN, and optional features like Perplexity AI research and Google Cloud Vision OCR) may process data outside Canada. In all cases, appropriate contractual safeguards are in place. Your core learning data remains stored in Canada.
11. Cookies and Tracking
We use essential cookies only — the minimum required for the platform to function:
- Session cookie: Keeps you logged in during your visit
- CSRF token cookie: Protects against cross-site request forgery attacks
No advertising cookies. No third-party tracking. No marketing analytics. We do not track your browsing activity, build advertising profiles, or share cookie data with any third party.
12. Data Breach Notification
In the event of a data breach that poses a risk of serious harm, we will:
- Notify you promptly — affected individuals will be informed as quickly as possible
- Report to the CAI — the Commission d'accès à l'information du Québec will be notified as required by Law 25
- Contain and remediate — immediate steps will be taken to stop the breach and prevent recurrence
- Document the incident — a full record of the breach, its scope, and our response will be maintained
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Posting a notice on our website
- Sending an email to your registered email address
The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of Mnemosyne after changes are posted constitutes acceptance of the updated policy.
14. Summary: What We Do vs. What We Don't Do
What We Do
- Store your data in Canada (AWS Canada)
- Contractually protect AI processing (Cohere DPA: never trained on, deleted within 30 days)
- Encrypt everything (TLS 1.3 + AES-256)
- Delete your data within 30 days on request
- Use essential cookies only
- Comply with PIPEDA and Quebec Law 25
- Offer MFA for all accounts
What We Don't Do
- Sell your data to anyone
- Use your data to train AI models
- Use advertising or tracking cookies
- Share your learning data with third parties
- Profile you for marketing purposes
- Store your payment card details
- Allow human review of your conversations
15. Contact & Complaints
For any privacy-related questions, requests, or concerns, contact our Privacy Officer:
Privacy Officer
Inquisitive Flow Learning
Montreal, Quebec, Canada
Email: support@inquisitiveflow.ca
If you are not satisfied with our response, you may file a complaint with:
- Quebec: Commission d'accès à l'information du Québec (CAI) — www.cai.gouv.qc.ca
- Canada: Office of the Privacy Commissioner of Canada (OPC) — www.priv.gc.ca