Data Privacy

Our Privacy Policy explains what we do with information about you — a visitor, a contact, a candidate. This page covers something different: how we handle data inside the systems we build for clients, where we usually act as a service provider processing information on the client's behalf.

Data minimisation

We ask for the narrowest set of data that will make a system work, and we prefer anonymised or synthetic data during development wherever it is sufficient.

Purpose limitation

Client data is used only to deliver, support and improve the agreed engagement. It is not repurposed for anything else.

Client ownership

Data a client provides, and data their systems generate, remains theirs. We claim no ownership of it.

Return and deletion

At the end of an engagement we return or delete client data on request, subject to any records we are legally required to keep.

This is the question clients ask most, so we state it plainly:

• We do not use one client's data to train models that serve another client.
• Where an engagement uses a third-party model provider, we select and configure services so that submitted content is not used to train that provider's general-purpose models, and we confirm the applicable terms in writing for each engagement.
• Where a model is fine-tuned on a client's data, the resulting model is for that client only and is governed by the engagement agreement.
• Prompts, retrieved documents and generated outputs are treated with the same confidentiality as any other client data.

We serve clients across Canada and the United States, and infrastructure or model providers may process data outside the province or country where it was collected. While personal information is outside Canada it is subject to the laws of that jurisdiction, including lawful access by courts and government authorities there.

Where data residency matters — and it often does in healthcare, finance and public-sector work — we agree the processing locations in writing before an engagement begins and select providers accordingly.

TODO_COPY — name the default hosting regions and the categories of sub-processor actually used (cloud, model provider, email, analytics). PIPEDA's openness principle expects this to be findable.

When we process personal information on a client's behalf, requests from individuals are the client's to answer. We support them by locating relevant records in systems we built, and by carrying out correction or deletion within agreed timelines. If an individual contacts us directly about a client's system, we refer them to that client and let the client know.

Each engagement is governed by a written agreement covering confidentiality, permitted use, security obligations, breach notification, sub-processing and what happens to data when the engagement ends. We are happy to work with a client's own data processing agreement.

Questions about data handling can go to our privacy and trust contact at hello@ravisolutions.ai, or by phone at +1 289-992-4445. We aim to acknowledge every enquiry within five business days.

TODO_COPY — add the registered postal address. CASL requires a valid mailing address in commercial messages, and PIPEDA expects a named, reachable accountable person.