Privacy

Privacy Policy

Last updated: 7 July 2026

Neural Forge AI Inc. ("Neural Forge AI", "we", "us", "our") respects your privacy and is committed to protecting personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. This Privacy Policy explains what we collect, why we collect it, how we use and disclose it, how long we retain it, and your rights as an individual in Canada.

1. Organization identity and Privacy Officer

Privacy Officer
Neural Forge AI Inc.
199 Bay Street, Suite 4000
Toronto, ON M5L 1A9, Canada
Email: [email protected]
Phone: +1 (416) 861-7420
Business Number (BN): 79218 5304 RC0001

The Privacy Officer is accountable for our compliance with PIPEDA and serves as the primary contact for privacy enquiries, access requests, corrections and complaints. You may also reach us at [email protected] for general enquiries that will be routed appropriately.

2. Scope

This policy applies to personal information collected through neuralforgeai.pro (the "Site"), contact forms, email and telephone communications, AI build review requests, discovery sprints, client engagements, retainer agreements and related professional services. It does not apply to third-party websites linked from our Site — review their policies before providing personal information.

Client project data processed under contract is governed by the applicable statement of work, master services agreement and data processing terms in addition to this policy. Where contractual terms impose stricter obligations, those terms prevail for the relevant engagement.

3. What personal information we collect

Depending on your interaction with us, we may collect:

  • Contact and identity data: name, job title, organization, email address, telephone number, mailing address and billing details.
  • Enquiry and communications data: messages you submit via forms, email content, meeting notes, call summaries and support tickets.
  • Technical data: IP address, browser type, device identifiers, pages viewed, referral URLs, session duration and approximate location derived from IP — primarily through cookies, local storage and server logs when you use the Site.
  • Client project data: operational data, documents, credentials and configuration you provide for AI strategy, custom build, machine learning, generative-AI, retrieval-augmented generation and automation engagements — processed only as instructed and contractually agreed.
  • Model interaction data: prompts, outputs, evaluation records and audit logs generated during proof-of-concept and production deployment work, retained only as needed for support, model evaluation, responsible-AI review and regulatory accountability.
  • Consent records: timestamps and evidence of PIPEDA consent provided through our contact form or client agreements.

We do not knowingly collect personal information from children under 13. Our services are directed to business professionals and organizations.

4. Purposes of collection and use

We collect and use personal information for purposes that a reasonable person would consider appropriate in the circumstances, including:

  • Responding to enquiries, AI build review requests and project proposals;
  • Delivering applied-AI consulting, custom development, evaluation, MLOps and support services under contract;
  • Administering accounts, invoicing and CAD project fee processing;
  • Improving our Site, services and client experience through aggregated, de-identified analytics where consent permits;
  • Complying with legal obligations, resolving disputes and enforcing agreements;
  • Protecting security, detecting fraud, abuse and maintaining system integrity;
  • Communicating service updates where you have not opted out and communication is permitted by law.

We identify the purposes of collection at or before the time of collection. If we wish to use your information for a new purpose not contemplated when it was collected, we obtain your consent unless the law permits otherwise.

5. Legal bases and consent

Under PIPEDA, we rely primarily on your knowledge and consent. Express consent is obtained when you submit our contact form with the PIPEDA consent checkbox checked, sign a client agreement, or otherwise agree in writing. Implied consent may apply for obvious follow-up to your enquiry or for information reasonably necessary to perform a requested service — for example, using your email address to reply to a message you sent us.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal may limit our ability to provide services or respond to ongoing support requests. To withdraw consent, contact [email protected] with sufficient detail for us to identify your records.

We do not require consent for collection, use or disclosure that is clearly in your interests and urgency prevents obtaining consent, or where collection is authorized or required by law.

6. Cookies and similar technologies

We use essential cookies for Site functionality and optional analytics cookies with your consent. Details are in our Cookie Policy. Cookie preferences are stored locally under the key nf_cookie_consent for six months. You may change preferences via the Site banner, cookie modal or browser settings.

Blocking essential cookies may affect Site functionality. Rejecting analytics cookies does not prevent us from collecting server logs necessary for security and troubleshooting.

7. Disclosure of personal information

We do not sell personal information. We may disclose information to:

  • Service providers (hosting, email delivery, analytics, cloud infrastructure, payment processing) bound by confidentiality and data protection obligations appropriate to the sensitivity of the data;
  • Subcontractors and senior engineers engaged on your project under non-disclosure terms;
  • Professional advisors (legal, accounting, insurance) when necessary for our legitimate business interests;
  • Law enforcement, regulators or courts when required by law, subpoena or to protect rights, safety and property.

Some service providers may process data outside Canada. When we transfer personal information internationally, we assess risks and implement safeguards appropriate to sensitivity — including contractual protections, encryption and vendor due diligence. We disclose cross-border processing in client agreements where it affects project data.

8. Client data and AI model data handling

Client operational data, documents and model training material are processed solely to deliver agreed project scope. Access is limited to personnel with a need to know, enforced through role-based controls and audit logging where practicable. We segregate client environments when project scale warrants it.

Fine-tuning, prompt engineering and model evaluation use client data only with authorization documented in the statement of work. We do not use client confidential data to train general-purpose models for other clients without explicit written consent.

Upon project completion, data retention and deletion follow the contract — typically return or secure deletion within 90 days unless a retainer requires ongoing access. Backup retention may extend briefly for disaster recovery before overwrite.

AI systems may produce errors, omissions or hallucinations; outputs are not guaranteed accurate. Human review processes we implement do not eliminate privacy obligations — logged interactions may contain personal information and are protected accordingly.

9. Retention

We retain personal information only as long as necessary for the purposes collected:

  • Enquiry records: up to 24 months after last contact unless a client relationship continues;
  • Client project records: per contract, typically 7 years for financial, tax and legal records;
  • Site server logs: up to 12 months;
  • Cookie consent preferences: 6 months (local storage);
  • Security incident records: as required by law and our incident response policy.

When retention expires, we delete or anonymize information using secure methods proportionate to sensitivity.

10. Security safeguards

We implement administrative, technical and physical safeguards proportionate to sensitivity, including access controls, least-privilege policies, encryption in transit (TLS), encrypted storage where appropriate, employee confidentiality obligations, vendor review and incident response procedures. No method of transmission or storage is completely secure; we cannot guarantee absolute security against determined attackers.

If we become aware of a breach of security safeguards involving personal information that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law, and maintain records of all breaches as PIPEDA requires.

11. Your rights under PIPEDA

You have the right to:

  • Know whether we hold personal information about you;
  • Access your personal information and receive an account of its use and disclosure;
  • Request correction of inaccurate or incomplete information;
  • Withdraw consent (subject to limits noted above);
  • Challenge our compliance with PIPEDA through our Privacy Officer and, if unsatisfied, the Commissioner.

Submit requests to [email protected] or the postal address above. We respond within 30 days unless an extension is permitted under PIPEDA. We may verify identity before releasing information. Access may be limited where disclosure would reveal confidential commercial information, legal privilege, third-party personal information or information collected for investigation purposes.

We do not charge a fee for access unless permitted by law for voluminous or repetitive requests, in which case we will inform you in advance.

12. Office of the Privacy Commissioner of Canada

If you are unsatisfied with our response to a privacy concern, you may contact:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, QC K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca

We encourage you to contact our Privacy Officer first so we may attempt to resolve your concern directly.

13. Third-party links and embedded content

Our Site may link to external resources such as documentation, model provider pages or professional networks. We are not responsible for their privacy practices, cookies or data collection. Review their policies before providing personal information.

14. Automated decision-making

We do not use personal information collected through the Site for solely automated decision-making that produces legal or similarly significant effects on individuals without human review. Client-facing AI systems we build for organizations may include automated components; those are governed by client policies and project agreements, not this Site policy.

15. Changes to this policy

We may update this Privacy Policy to reflect legal, technical or business changes. The "Last updated" date will change accordingly. Material changes will be posted on this page. Continued use of the Site after changes constitutes acknowledgment unless further consent is required for new purposes.

16. Questions

For privacy questions or to exercise your rights, contact [email protected] or write to the Privacy Officer at the address above. For general business enquiries, [email protected] remains available.