Privacy policy

Last updated: June 19, 2026

1. Who we are

Obrio (hereinafter "we," "our" or "Obrio") is an AI-agent automation company headquartered in Gatineau, Quebec, Canada. We help SMBs automate their repetitive tasks with artificial-intelligence agents.

For any question about this policy, you can reach us at:

• Email: info@obrio.ca
• Address: Gatineau, Quebec, Canada

2. Personal information we collect

2.1 Contact form

When you submit a request through our form, we collect:

• First name
• Company name
• Email address
• Phone number (optional)
• Industry
• Number of employees
• A description of your automation needs

2.2 Email communications

When you contact us directly by email, we keep the content of the conversation along with your email address.

2.3 Browsing data (website)

Our site automatically collects limited technical data: IP address (anonymized), browser type, pages visited and visit duration. This data is used solely to improve the site's performance and does not allow us to identify you personally.

2.4 Data handled as part of our services

If you become an Obrio client, we may process your company's operational data (emails, documents, customer data) as part of deploying and operating your AI agents. A separate data processing agreement governs this processing.

3. Purposes of processing

We use your personal information for the following purposes:

• Responding to your requests and contacting you within 48 hours of your submission
• Assessing whether our services match your needs
• Preparing and carrying out a services agreement
• Improving our website and our services
• Meeting our legal obligations

We do not send you marketing emails without your express consent.

4. Legal basis for processing

We process your personal information on the following bases:

• Your consent — for marketing communications, where applicable
• Performance of a contract — to deliver our services
• Legitimate interest — to improve our services and respond to your requests
• Legal obligation — to comply with applicable laws

5. Information sharing

We never sell your personal information. We may share it only in the following cases:

5.1 AI service providers

As part of our services, we rely on artificial-intelligence models (including large language model APIs). These providers process data only to carry out the requested tasks and are bound by confidentiality agreements. The data is not used to train their models.

5.2 Technical providers

We may share data with technical providers (hosting, email, project management tools) under a data processing agreement with confidentiality obligations equivalent to Law 25.

5.3 Legal obligations

We will disclose information where required by law or to protect the rights, property or safety of Obrio or a third party.

6. Data retention

We retain your personal information for as long as necessary for the purposes described in this policy:

• Contact requests with no follow-up: 12 months
• Active client data: the duration of the contract + 5 years (accounting and legal requirements)
• Browsing data: 13 months maximum

Once these periods expire, the data is securely deleted or anonymized.

7. Your rights (Law 25 and GDPR)

Under Law 25 and, where applicable, the GDPR, you have the following rights:

• Right of access: obtain a copy of the information we hold about you
• Right to rectification: have inaccurate information corrected
• Right to erasure: request the deletion of your data, subject to our legal obligations
• Right to portability: receive your data in a structured format
• Right to object: object to certain processing
• Right to withdraw consent: withdraw your consent at any time for processing that depends on it

To exercise these rights, write to us at info@obrio.ca. We will respond within 30 days.

8. Person in charge of personal information protection

In accordance with Law 25, responsibility for protecting personal information rests with Obrio's management, reachable at info@obrio.ca.

9. Security

We apply technical and organizational security measures proportionate to the risk: encryption of data in transit (TLS), restricted access to personal information, and incident management procedures. In the event of a confidentiality incident, we will notify the Commission d'accès à l'information du Québec and the individuals concerned within the timeframes prescribed by Law 25.

10. Transfers outside Quebec

Some of our technical providers and AI providers are located in the United States or the European Union. Before any transfer, we conduct a privacy impact assessment (PIA) in accordance with section 17 of Law 25 and ensure that an equivalent level of protection is guaranteed.

11. Cookies

Our site uses a minimal number of session cookies needed for proper technical operation. We do not use advertising cookies or third-party trackers for commercial targeting.

12. Automated decisions

No decision with a legal or significant effect on you is made by an Obrio AI agent in a fully automated way. In line with our "Final human judgment" commitment, a member of our team validates any important action before it is carried out.

13. Changes to this policy

We may update this policy from time to time. The date of the last change is shown at the top of this page. For significant changes, we will notify you by email if you are a client or if you have recently submitted a request to us.

14. Complaints

If you believe your personal information protection rights have been violated, you may file a complaint with the Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca.