Privacy Policy

01 Who this applies to, and our role

Netrasya Lens is a business-to-business service. Two relationships matter:

• Client firm (our customer). When a firm subscribes to Netrasya Lens, the firm decides what documents to upload and who may access them. For the documents and the information inside them, the firm is the controller and Netrasya acts as a service provider (data processor) on the firm’s instructions. We process that content only to operate the service for the firm — not for our own purposes. Where the firm has signed a Data Processing Addendum (DPA) or master services agreement with us, those terms govern the document data and prevail over this policy if they conflict.
• Authorized users (the firm’s people). Individuals the firm invites to sign in. For their account and usage information (below), Netrasya is the controller.
• Website visitors. Anyone browsing netrasyaai.ca.

If you are an individual whose personal information appears inside a client firm’s documents, please direct access or deletion requests to that firm; we will assist the firm in responding.

02 What we collect

2.1 Website visitors (netrasyaai.ca)

The marketing site is static. We do not set advertising or analytics cookies and we do not run third-party trackers. Standard server and access logs (for example IP address, browser type, pages requested, timestamp) may be generated by our hosting provider for security and reliability. Web fonts are served from our own origin, so no font provider receives your IP address.

2.2 Application account data

To create and secure an account we process:

• your email address (used as your identity and to deliver one-time sign-in codes);
• authentication data — a short-lived hashed one-time code, and a session token recording sign-in time, expiry, and revocation status;
• profile and role data — display name and the access role or groups your firm’s administrator assigns.

We use passwordless sign-in: we email you a one-time code rather than storing a password.

2.3 Customer content (documents and queries)

On your firm’s instructions we process:

• documents your firm uploads (and, for scanned files, text we extract via self-hosted OCR);
• derived data needed to make documents searchable (text chunks and numeric embeddings);
• questions you ask and the answers returned, including the source citations.

This content, and any personal information it happens to contain, is processed only to provide search, retrieval, and cited answers to your firm’s authorized users.

2.4 Usage and operational telemetry

To run, secure, bill, and improve the service we record usage events — for example which actions occurred (sign-in, ingest, query), document and chunk counts, processing latency per stage, and token counts for billing. We also keep application and infrastructure logs and metrics. We do not build advertising profiles from this data.

03 How we use information

• Provide the service — authenticate you, ingest and index documents, answer questions with citations, and enforce the access permissions your firm configures.
• Secure the service — detect and investigate abuse, troubleshoot, and maintain availability.
• Bill and account — measure usage for invoicing under your firm’s agreement.
• Communicate — send transactional messages such as sign-in codes and service notices.
• Improve the service — diagnose performance and reliability using operational telemetry.

We rely on your firm’s instructions and our agreement with the firm, on consent (for example when you request a sign-in code), and on our legitimate business interests in operating a secure, reliable service, as permitted under Canadian privacy law.

04 How we use AI

Netrasya Lens answers questions using a language model we host ourselves on our own infrastructure in Canada. Your documents and questions:

• are not sent to any third-party or public AI service;
• are not used to train our model or any third-party model;
• are used only, at the moment you ask, to retrieve relevant passages and generate an answer that is cited back to your source documents.

05 Where your data is stored and processed

Application data is stored and processed in Canada, in Amazon Web Services’ Canada (Central) region (ca-central-1). This includes documents, search indexes, account data, email delivery, and logs.

Our infrastructure provider, Amazon Web Services, is a global company. While we configure the service to keep your data in the Canadian region, AWS as an organization may be subject to laws of other jurisdictions. We therefore describe our commitment as “stored and processed in Canada” — we do not claim your data can never, under any legal process, leave Canada.

The public marketing website is served by a hosting and CDN provider (see sub-processors) that operates globally; it handles no customer documents or account data, only ordinary web traffic.

06 Sub-processors

We use a small number of providers to deliver the service. Each is bound to protect the information it handles and to use it only to provide services to us.

We will update this list before adding a sub-processor that handles customer content, as required by your firm’s agreement.

07 How we share information

We do not sell personal information and we do not share it for advertising. We disclose information only:

• to the sub-processors above, to operate the service;
• within your firm, according to the access permissions your administrator configures;
• when required by law — for example a valid court order or legal process. We will, where lawful and practical, notify the affected firm before disclosing their content;
• in a business transfer (merger, acquisition, financing), subject to this policy;
• with your firm’s consent or at its direction.

08 Security

We protect information with measures including encryption in transit; access restricted to a small team on a need-to-know basis; permission-aware retrieval so users only see documents their firm has granted them; passwordless authentication with revocable sessions; parameterized database access; and segregation of customer environments. No system is perfectly secure, but we work to protect your data and to limit and respond to any incident. We will notify affected firms of a security breach involving their data as required by law.

09 How long we keep data

• Documents and derived search data — kept for as long as your firm keeps them in the service. When your firm deletes a document, or when our agreement ends, the document and its derived search data are removed from the live service. Because document storage is versioned to protect against accidental loss, any previous version of a deleted or replaced document is permanently purged within 30 days.
• Database backups — automated backups of the application database are retained for 7 days on a rolling basis, then deleted.
• Application and infrastructure logs — retained for 7 days, then deleted.
• Sign-in codes — short-lived; the underlying code expires within minutes and only its hash is ever stored.
• Sessions — until they expire or are revoked.
• Account data — for the life of the account, then deleted or de-identified.
• Usage and billing records — retained for the life of the account and for as long as we are required to keep business and tax records, then deleted or aggregated so they no longer identify an individual.

Where your firm’s agreement with us sets different or shorter periods, that agreement governs.

10 Your privacy rights

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law, you may:

• access the personal information we hold about you;
• ask us to correct inaccurate information;
• withdraw consent where processing relies on consent (this may limit the service);
• ask about our handling of your information and complain to us, and to the Office of the Privacy Commissioner of Canada.

To exercise these rights, contact us using the details below. For information held inside a client firm’s documents, we will route your request to that firm, who controls it. We respond to verified requests within the timelines required by law.

11 Cookies and local storage

The marketing website uses no advertising or analytics cookies and no third-party trackers.

The application uses your browser’s local storage strictly to operate: it stores your sign-in token so you stay logged in, and a small flag noting when a session has expired. These are necessary for the service to function and are not used for tracking or advertising. Clearing them signs you out.

12 Children

Netrasya Lens is a workplace tool intended for businesses and their staff. It is not directed to children and we do not knowingly collect information from children.

13 Changes to this policy

We may update this policy as the service evolves. We will revise the “last updated” date and, for material changes affecting client firms, provide notice as required by the applicable agreement.

14 Contact us

You may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.