Your data stays in Canada. Always.
At Inquisitive Flow Learning, we believe your privacy is not optional. Our entire infrastructure — from AI processing to data storage — is hosted in Canada.
Table of Contents
- Information We Collect
- How We Use Your Information
- AI and Your Data
- How We Protect Your Information
- Third-Party Service Providers
- Privacy Impact Assessment
- Data Retention
- Your Privacy Rights
- Children's Privacy
- Canadian Data Sovereignty
- Cookies and Tracking
- Data Breach Notification
- Changes to This Policy
- Summary
- Contact & Complaints
1. Information We Collect
We collect only the information necessary to provide our learning services. Here is exactly what we collect and why:
| Information | Purpose | Retention |
|---|---|---|
| First name, Last name | Account identification, personalization | Until account deletion |
| Email address | Account login, communications, password reset | Until account deletion |
| Password (encrypted) | Account security (bcrypt hashed, never stored in plain text) | Until account deletion |
| Learning preferences | Personalize educational content and AI responses | Until account deletion |
| Subscription information | Manage your plan (Explorer, Scholar, or Sage) and billing | Until account deletion + legal retention |
| Learning session data | Provide AI tutoring, mind maps, and progress tracking | Until account deletion |
2. How We Use Your Information
We use your information for the following purposes, with the corresponding legal basis under PIPEDA and Quebec Law 25:
| Purpose | Legal Basis |
|---|---|
| Provide personalized AI tutoring sessions | Performance of contract (your subscription) |
| Generate mind maps showing concept connections | Performance of contract |
| Process subscription payments | Performance of contract |
| Send account notifications (password reset, subscription updates) | Performance of contract |
| Improve service quality and fix bugs | Legitimate interest |
| Comply with legal requirements | Legal obligation |
We NEVER:
- Sell your personal information to third parties
- Use your data for advertising or marketing profiling
- Use your conversations to train AI models
- Share your learning data with other users
- Track your browsing activity across other websites
3. AI and Your Data
Azure OpenAI (Canada East Region)
Your conversations with Mnemosyne are processed by Azure OpenAI, hosted in the Canada East region. Microsoft does not use your API data to train or improve their models. There is no human review of your conversations. Your data is not retained by Microsoft after processing.
When you use Mnemosyne, your conversations are processed by our AI to provide personalized tutoring. This educational content:
- Is used solely to provide your personalized learning assistance
- Is stored to enable your mind map feature showing concept connections
- Is not used to train AI models
- Is not shared with other users or third parties for their purposes
- Contains educational topics only (e.g., "photosynthesis", "algebra") — not personal information
Perplexity AI (Sage Tier — Research Mode)
If you are on the Sage plan, the research mode feature sends your research queries to Perplexity AI (US-based) to retrieve cited, up-to-date sources. Only the research query is sent — no personal information or account data is transmitted.
Google Cloud Vision (Scholar & Sage Tiers — Handwriting OCR)
If you are on the Scholar or Sage plan, you can upload handwriting images for text recognition. These images are sent to Google Cloud Vision (US-based) for optical character recognition. Only the image data is sent — no personal information or account data is transmitted. Google does not retain your images after processing.
4. How We Protect Your Information
We implement industry-leading security measures to protect your information:
- Encryption in transit: All data is encrypted using TLS 1.3 between your browser and our servers
- Encryption at rest: All stored data is encrypted using AES-256
- Password hashing: Passwords are hashed using bcrypt with strong salting — we never store your password in plain text
- CSRF protection: Cross-site request forgery tokens protect all state-changing requests
- Multi-factor authentication: MFA is available for all accounts for an additional layer of security
- Regular security audits: Continuous monitoring and periodic security assessments
- Access controls: Strict limits on employee access to personal data, following the principle of least privilege
5. Third-Party Service Providers
We work with trusted third-party providers to deliver our service. All providers are bound by data processing agreements.
| Provider | Purpose | Location | Data Shared |
|---|---|---|---|
| Azure OpenAI | AI tutoring responses | Canada East | Learning queries (not used for training) |
| AWS | Application server, database, secrets | Canada | All application data (encrypted) |
| Stripe | Payment processing | United States | Payment card data (we never store card details) |
| SendGrid (Twilio) | Transactional email delivery | United States | Email address, email content |
| Cloudflare | CDN, DDoS protection, DNS | Global | IP address, request metadata |
| Perplexity AI | Research mode (Sage tier only) | United States | Research queries only |
| Google Cloud Vision | Handwriting OCR (Scholar & Sage tiers) | United States | Uploaded handwriting images only |
Core infrastructure stays in Canada. Your application data and AI processing are hosted in Canada (AWS Canada and Azure Canada East). Only specific auxiliary services (payments, email, CDN, and optional features like research and handwriting OCR) involve US-based or global providers.
6. Privacy Impact Assessment
In accordance with Quebec Law 25, a Privacy Impact Assessment (PIA) is currently in progress for Mnemosyne. This assessment evaluates the privacy risks associated with our collection, use, and storage of personal information, and identifies measures to mitigate those risks.
The PIA covers all aspects of our data processing, including AI interactions, third-party integrations, and cross-border data transfers. Results will inform any necessary adjustments to our privacy practices.
7. Data Retention
We retain your information only as long as necessary for the purposes described in this policy.
| Scenario | Retention Period | Details |
|---|---|---|
| Active account | While account is active | All data retained to provide the service |
| Account deletion | 30 days | Personal information is permanently deleted within 30 days of your request |
| Legal requirements | As required by law | Some financial records may be retained longer to comply with tax and accounting laws |
8. Your Privacy Rights
Under PIPEDA and Quebec Law 25, you have the following rights regarding your personal information:
- Right of access: Request a copy of all personal information we hold about you
- Right of rectification: Correct any inaccurate or incomplete information
- Right of deletion: Request the deletion of your account and all associated personal information
- Right of portability: Receive your data in a structured, commonly used, machine-readable format
- Right to withdraw consent: Withdraw your consent at any time (note: this may affect your ability to use the service)
- Right to be informed: Know what information we collect and how it is used
To exercise any of these rights, contact our Privacy Officer at support@inquisitiveflow.ca. We will respond within 30 days.
9. Children's Privacy
In accordance with Quebec Law 25, we require parental or guardian consent before collecting personal information from individuals under 14 years of age.
If you are under 14, you must have your parent or guardian create an account on your behalf or provide their explicit consent before you use Mnemosyne.
If we learn that we have collected personal information from a minor under 14 without proper consent, we will delete that information promptly.
Parents or guardians may contact us at support@inquisitiveflow.ca to review, modify, or request deletion of their child's information.
10. Canadian Data Sovereignty
Our core infrastructure is entirely in Canada.
- Application server and database: AWS Canada (Montreal, Canada)
- AI processing: Azure OpenAI Canada East region
- Company headquarters: Montreal, Quebec, Canada
Some auxiliary services (Stripe for payments, SendGrid for email, Cloudflare for CDN, and optional features like Perplexity AI research and Google Cloud Vision OCR) may process data outside Canada. In all cases, appropriate contractual safeguards are in place. Your core learning data and AI processing remain in Canada.
11. Cookies and Tracking
We use essential cookies only — the minimum required for the platform to function:
- Session cookie: Keeps you logged in during your visit
- CSRF token cookie: Protects against cross-site request forgery attacks
No advertising cookies. No third-party tracking. No marketing analytics. We do not track your browsing activity, build advertising profiles, or share cookie data with any third party.
12. Data Breach Notification
In the event of a data breach that poses a risk of serious harm, we will:
- Notify you promptly — affected individuals will be informed as quickly as possible
- Report to the CAI — the Commission d'accès à l'information du Québec will be notified as required by Law 25
- Contain and remediate — immediate steps will be taken to stop the breach and prevent recurrence
- Document the incident — a full record of the breach, its scope, and our response will be maintained
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Posting a notice on our website
- Sending an email to your registered email address
The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of Mnemosyne after changes are posted constitutes acceptance of the updated policy.
14. Summary: What We Do vs. What We Don't Do
What We Do
- Store your data in Canada (AWS Canada)
- Process AI in Canada (Azure Canada East)
- Encrypt everything (TLS 1.3 + AES-256)
- Delete your data within 30 days on request
- Use essential cookies only
- Comply with PIPEDA and Quebec Law 25
- Offer MFA for all accounts
What We Don't Do
- Sell your data to anyone
- Use your data to train AI models
- Use advertising or tracking cookies
- Share your learning data with third parties
- Profile you for marketing purposes
- Store your payment card details
- Allow human review of your conversations
15. Contact & Complaints
For any privacy-related questions, requests, or concerns, contact our Privacy Officer:
Privacy Officer
Inquisitive Flow Learning
Montreal, Quebec, Canada
Email: support@inquisitiveflow.ca
If you are not satisfied with our response, you may file a complaint with:
- Quebec: Commission d'accès à l'information du Québec (CAI) — www.cai.gouv.qc.ca
- Canada: Office of the Privacy Commissioner of Canada (OPC) — www.priv.gc.ca