Privacy notice

1. Who we are and how to reach us

[Legal entity name — to be confirmed] (“Infold”, “we”, “us”) operates infold.ai and the Infold managed AI receptionist service.

Our person in charge of the protection of personal information is our Privacy Officer: [Name and title]. You can reach them at hi@infold.ai (subject line “Privacy”) [or a dedicated privacy address, to be confirmed], or by mail at [business mailing address].

2. What this notice covers

This notice covers two different situations, and who is responsible differs between them.

You visit our website or talk to us about Infold

We decide how your information is used, and we’re responsible for it under this notice.

You call a business that uses Infold

That business decides what its receptionist collects and why. We handle the information on its behalf and only under its instructions, as its service provider. The business’s own privacy policy applies, and you can contact it directly. We help our customers answer requests about calls.

3. What we collect on our website

4. What we collect on calls, for our customers

When Infold answers a call for a business, it handles:

• the caller’s phone number and the date, time and length of the call;
• what the caller says — the audio is turned into text so the receptionist can understand and respond [whether audio is kept, and for how long, to be confirmed];
• the details the business’s intake asks for — for example a name, what the caller needs, a preferred time, or an address for a home visit;
• what happened on the call — bookings made, messages taken, texts sent and transfers;
• the summaries and call reports we send to the business.

Every greeting tells callers they’re speaking with the business’s AI assistant. Callers are told the call is recorded, why, and how to opt out [wording to be confirmed against the live greeting]. For health and legal businesses, the receptionist does intake only and never gives clinical or legal advice. For patient-facing booking and intake that we configure, keeping advertising pixels out is a requirement before we switch it on.

5. How we use information

• To answer and handle calls for our customers, following their rules.
• To book, change and cancel appointments in connected calendars and send confirmations.
• To send summaries, alerts and call reports to our customers.
• To review calls, fix mistakes and keep improving each customer’s receptionist [scope of review and any model training to be confirmed — client data must never train shared models without consent].
• To reply to enquiries, run demos, and set up, bill and support accounts.
• To keep the website and the service secure and prevent fraud and abuse.
• To meet legal obligations, such as keeping tax records and answering lawful requests.
• To send product news by email — only with your consent, and you can unsubscribe at any time.

We don’t sell personal information, and we don’t share it for anyone else’s marketing.

6. Cookies and your choices

Optional cookies stay off until you choose. When you first visit, a small banner offers Accept, Reject and Choices with equal weight. Until you opt in, Google Consent Mode keeps analytics and advertising storage set to “denied”, and our tag manager doesn’t load.

Your choice is saved in this browser and applies on this device. You can change it at any time with the “Privacy choices” link at the bottom of every page, or here:

Change your cookie choices

7. Where information is stored, and transfers outside Canada

Call data is stored in Canada by default. Customers who need every step of the call processed in Canada can choose Canada-only processing, end to end.

Some service providers that help us run the website and the service may store or process information outside Canada — for example [website hosting, email, payment processing, analytics, and any part of the call path not hosted in Canada — list to be completed]. Information held outside Canada is subject to the laws of that country and may be accessed by its courts, law enforcement and national security authorities. We use written agreements to protect information our providers handle and limit them to what they need to provide their service.

Before we communicate personal information about people in Quebec outside Quebec, we assess the privacy risks, as Law 25 requires. Our service providers, with where each one stores and processes data, will be listed in the subprocessor table on our trust page before launch.

8. Who we share it with

• The business you called — call details, bookings, messages and summaries belong to that business.
• Service providers that help us deliver the service — telephone carrier, speech recognition, language model, voice, cloud storage, text and email delivery, payments and (with consent) analytics — only to provide their service to us.
• Tools the business connected, such as its calendar, practice-management software or CRM.
• Authorities, when the law requires it or to protect someone’s safety or our legal rights.
• A buyer or successor, if Infold is involved in a merger or sale, under the same protections.

9. How long we keep it

When we no longer need information, we delete it or make it anonymous.

10. How we protect it

We use safeguards that match how sensitive the information is [for example encryption in transit and at rest, access controls with logging, and staff confidentiality agreements — to be confirmed against the actual stack].

If a privacy breach creates a real risk of significant harm, we’ll notify the people affected and the Privacy Commissioner of Canada — and, in Quebec, the Commission d’accès à l’information — as the law requires, and keep a record of every breach.

11. Automated decisions

Infold’s receptionist follows rules set by the business you called. If a decision about you is based only on automated processing, you’ll be told, and you can ask what information was used and the main reasons for it, and have a person at the business review the decision.

12. Your rights

• Access the personal information we hold about you.
• Correct it if it’s wrong or incomplete.
• Withdraw consent, for example to marketing emails or optional cookies.
• In Quebec, also ask for your information in a structured, commonly used technological format, ask us to stop sharing it or to de-index it where the law allows, and be told about decisions made only by automated processing.

To make a request, email hi@infold.ai. We’ll confirm your identity and reply within 30 days. If you called a business that uses Infold, contact that business first — we’ll help it respond.

13. Children

Infold is a service for businesses. Our website isn’t directed at children, and we don’t knowingly collect their information through it.

14. Changes to this notice

We’ll publish any change here with a new date, and tell customers about significant changes [by email] before they take effect.

• Draft 0.1 · 27 October 2026 · First draft for counsel review.

15. Contact and complaints

Questions or concerns: our Privacy Officer, [Name and title], at hi@infold.ai. Please contact us first so we can try to fix it.

You can also complain to the Office of the Privacy Commissioner of Canada, to the Commission d’accès à l’information du Québec, or to your provincial privacy commissioner (for example in British Columbia or Alberta).