PRIVACY POLICY

Effective Date: June 17, 2026

1. SCOPE

This Privacy and Cookie Policy (this Policy) describes how VIREC Intelligence Inc., doing business as VIREC (VIREC, we, us, or our), collects, uses, discloses, and retains personal information about our platform customers, their account users, and visitors to our websites (collectively, you). It applies to platform.virec.ai, virec.ai, and related VIREC services (the Services).

This Policy does not cover the contents of VIREC's data products, which are governed by our agreements with customers, and it does not cover third-party websites, applications, or services, including those of our service providers, even if linked from the Services. This Policy is incorporated into and forms part of the VIREC Terms of Use; if they conflict, the Terms of Use control.

By accessing or using the Services, you acknowledge this Policy. If you do not agree with it, do not use the Services.

2. INFORMATION WE COLLECT

Account and identification information. Name, business email address, organization, role, and account settings you provide when registering or managing an account.
Authentication information. Usernames, hashed credentials, and multi-factor authentication identifiers used to secure account access. VIREC does not collect biometric identifiers or biometric information.
Billing and transaction information. Subscription, plan, and transaction history. Payments are processed by third-party payment processors; VIREC does not store full payment card numbers.
Usage and device information. Information collected automatically when you use the Services, including IP address, device and browser type, log data, security and authentication events, pages viewed, and interactions with the Services, including through cookies and similar technologies (Section 6).
Communications. The content of your communications with VIREC through email, chat, or other support channels.
Content you submit. Content, data, files, prompts, queries, and other inputs you submit to the Services, including Conversation Data from conversational and AI features (Section 4).
Information from service providers. Information received from providers acting on our behalf, such as payment, authentication, analytics, and security providers.
Derived information. Information we generate or infer from the above, such as account-level preferences, usage analytics, and security risk indicators.

3. HOW WE USE INFORMATION

We use personal information to: provide, operate, secure, support, and improve the Services; create and manage accounts; process transactions and billing; provide customer support; send transactional and service communications; send marketing communications, which you can opt out of at any time (Section 8); perform analytics, research, and product development; develop, train, fine-tune, and improve artificial intelligence models and other products and services (Section 4); detect, investigate, and prevent fraud, abuse, and security incidents; enforce our Terms of Use and other agreements; comply with applicable law and respond to lawful requests; and support corporate transactions. We may also use information for other purposes compatible with those described here or to which you consent.

4. AI FEATURES AND CONVERSATION DATA

4.1 You own the content you submit

As between you and VIREC, you retain ownership of the content, data, prompts, queries, and other inputs you submit to the Services, including Conversation Data from conversational and AI features, but excluding output generated by AI features. Ownership means title to your content; it does not mean exclusive use. The license described below is a permission to use your content, and the two operate together without contradiction.

4.2 How VIREC may use it

Under the VIREC Terms of Use, you grant VIREC a worldwide, non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up, sublicensable (through multiple tiers), and transferable license to host, store, copy, reproduce, transmit, display, adapt, modify, process, analyze, create derivative works of, and otherwise use your submitted content and Conversation Data: (a) to provide, operate, secure, support, and improve the Services; (b) to develop, train, fine-tune, evaluate, and improve artificial intelligence models, machine learning systems, and other VIREC products and services; (c) for VIREC's other lawful business and commercial purposes; and (d) to enforce the Terms of Use and comply with applicable law. This is stated plainly here so there is no ambiguity: content and Conversation Data you submit may be used to train and improve AI models and for other commercial purposes, and this license survives termination of your account.

4.3 Third-party AI processing

Information received from third parties in connection with the provision of the Services, such as payment processors, authentication providers, analytics or security service providers, or other service providers acting on our behalf, and only to the extent necessary to provide, secure, or improve the Services.

4.4 AI output

Output generated by AI features is produced by probabilistic, automated systems, is provided AS IS, may be inaccurate or incomplete, and must be independently verified before you rely on it or act on it. AI features assist analysis; they do not make decisions that are binding on you, and you remain responsible for all decisions made using the Services.

5. HOW WE SHARE INFORMATION

Service providers and subprocessors. Providers that perform services on our behalf, in categories including infrastructure and hosting, authentication and identity, payment processing and billing, artificial intelligence and data processing, communications, analytics, and security. Providers are engaged under terms requiring appropriate protection of personal information.
Affiliates. Entities under common control with VIREC, to operate, provide, secure, or improve the Services.
Enterprise account administrators. Where an account is provisioned or administered by a customer organization, we may share account and usage information with that organization's authorized administrators. The customer organization is responsible for its own notices to and authorizations from its users.
Corporate transactions. In connection with an actual or proposed merger, acquisition, financing, reorganization, or sale of assets, subject to customary confidentiality protections.
Legal and protective disclosures. Where we believe in good faith that disclosure is necessary to comply with law or a lawful request, enforce our agreements, or protect the rights, property, safety, or security of VIREC, our customers, our users, or the public.
With your direction or consent. Where you direct a disclosure or otherwise consent to it.
Aggregated and de-identified information. We may create, use, and share information that has been aggregated or de-identified so that it does not reasonably identify you, for any lawful purpose, without restriction.

VIREC does not sell personal information collected under this Policy and does not process it for targeted advertising.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies, including pixels, web beacons, and local storage, to operate and improve the Services: essential cookies required for authentication, security, core functionality, and storing your cookie preferences, which cannot be refused; functional cookies that remember preferences; and analytics cookies that help us understand usage and performance. We do not currently use advertising or retargeting cookies. Session cookies expire when you close your browser; persistent cookies are retained no longer than necessary for their purpose, typically from a few days up to twenty-four (24) months. You can control cookies through your browser settings and through our cookie banner. Where required by applicable law, we honor browser-based opt-out preference signals. Essential cookies cannot be disabled. Disabling other cookies may affect functionality.

7. RETENTION AND SECURITY

7.1 Retention

We retain personal information for as long as needed for the purposes described in this Policy, to comply with legal and tax obligations, to resolve disputes, and to enforce our agreements. When personal information is no longer needed, we delete it or de-identify it. De-identified and aggregated information may be retained and used indefinitely, and we do not attempt to re-identify it except where required by law with appropriate authorization.

7.2 Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, proportionate to its sensitivity. No method of transmission or storage is fully secure, and we cannot and do not guarantee the security of any information. You are responsible for keeping your credentials confidential and for security on your own systems, and you should notify us promptly at security@virec.ca of any suspected unauthorized access to your account. We respond to security incidents involving personal information as required by applicable law.

8. YOUR CHOICES AND RIGHTS

8.1 Right requests

Depending on where you live, you may have rights regarding your personal information, such as the right to request access to it, a copy of it, correction of inaccuracies, deletion, or to withdraw consent or object to certain processing. To make a request, email privacy@virec.ca with the subject line Privacy Rights Request, describe the right you wish to exercise, and provide information sufficient to verify your identity. We respond within the time required by applicable law. If we decline your request in whole or in part, you may appeal by replying to our response, and we will review the appeal and respond within the time required by applicable law. Rights are subject to limits and exceptions under applicable law, including where fulfilling a request would compromise security, reveal confidential information, affect the rights of others, conflict with legal retention obligations, or where the request is manifestly unfounded or excessive. Withdrawal of consent does not affect prior processing and may limit our ability to provide certain Services.

8.2 Marketing choices

You can opt out of marketing communications at any time using the unsubscribe link in any marketing message, through your account settings, or by emailing privacy@virec.ca. We will continue to send transactional and service communications related to your account.

9. INTERNATIONAL PROCESSING

VIREC operates from Canada and serves customers in the United States and Canada. Personal information may be transferred to, stored in, and processed in Canada, the United States, and other locations where VIREC or its service providers operate, and may be subject to the laws of those jurisdictions, which may differ from the laws of your jurisdiction. By using the Services, you acknowledge this processing.

10. CHILDREN

The Services are intended for business use by adults. Persons under the age of eighteen (18) years old may not create an account or use the Services, and VIREC does not knowingly collect personal information from anyone under the age of eighteen (18) years old. If you believe a minor has provided personal information to VIREC, contact privacy@virec.ca and we will delete it as soon as reasonably practicable.

11. CHANGES TO THIS POLICY

VIREC may update this Policy at any time. Updates take effect when the revised Policy is posted with a new effective date; for changes that materially affect how we handle personal information, we will provide notice by email or in-app notice. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy. If you do not agree, stop using the Services and contact privacy@virec.ca to request account closure.

12. LANGUAGE

VIREC's offerings, including the Platform interface and related materials, are made available in English and in French. You may request any component in another language by written email to support@virec.ca, and VIREC will use commercially reasonable efforts to make it available in the requested language following the written request. This Section does not create any service level, deadline, or other performance obligation. This Policy is made available in English and in French; the French version prevails for users in Canada and the English version prevails for all other users in case of divergence.

13. CONTACT; PRIVACY OFFICER

Questions, concerns, complaints, and rights requests regarding this Policy or our handling of personal information should be directed to VIREC's Privacy Officer:

Christo Mavrick, Privacy Officer, VIREC Intelligence Inc., 1250 Boul. Rene-Levesque O, Suite 2200, Montreal, Quebec H3B 4W8, Canada. Email: privacy@virec.ca (preferred) or legal@virec.ca.

Security matters: security@virec.ca. General account support: support@virec.ca.

BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THIS PRIVACY POLICY IN ITS ENTIRETY.

VIREC and the VIREC logo are trademarks of VIREC Intelligence Inc.

Version 1.3