Privacy Policy

Trinity AI Consulting (“Trinity,” “we,” “us,” or “our”) is an AI consultancy based in Maple Ridge, British Columbia, Canada. We help small businesses implement tailored AI systems and automations, with human oversight and responsible AI use at the core. We aim to collect only the information reasonably needed for our business and services, use it for clearly described purposes, protect it with appropriate safeguards, and respect applicable privacy rights.

This Privacy Policy explains how we handle personal information when you visit trinityaiconsulting.ca, contact us, engage our services, or when we process information on behalf of a client. It should be read together with any applicable contract, statement of work, data processing agreement, or client-specific privacy notice.

Table of Contents

1. Scope and Who This Policy Covers
2. Key Terms
3. Information We Collect
4. How We Collect Information
5. How We Use Information
6. AI, Automation, and Human Oversight
7. Cookies and Tracking Technologies
8. How We Disclose Information
9. International Transfers and Storage
10. Retention and Deletion
11. Security and Privacy Breaches
12. Your Rights and Choices
13. Information Processed on Behalf of Clients
14. Children’s Privacy
15. Third-Party Links and Services
16. Changes to This Privacy Policy
17. Contact Us and Complaints

1. Scope and Who This Policy Covers

This Policy applies to personal information handled by Trinity in connection with:

• Website visitors who browse trinityaiconsulting.ca.
• Prospective clients who submit an inquiry, sign up for communications, or book a consultation.
• Clients who engage Trinity to provide consulting, AI systems, automations, or related services.
• Individuals whose information is included in data provided by a client, such as the client’s customers, employees, contractors, or other contacts.

Privacy laws that may apply include British Columbia’s Personal Information Protection Act (“BC PIPA”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), and, depending on the circumstances, privacy laws in other jurisdictions. PIPEDA may apply to certain interprovincial or international commercial activities and federally regulated organizations. Where applicable, the European Union or United Kingdom General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), may provide additional rights.

Where Trinity processes information on behalf of a client, the client may be responsible for deciding why and how the information is processed. In that situation, the client’s privacy notice and instructions may also apply.

2. Key Terms

• Personal information generally means information about an identifiable individual, as defined by applicable Canadian privacy law. It does not generally include information that has been irreversibly anonymized.
• Personal data is the term used in some laws, including the GDPR, for information relating to an identified or identifiable person.
• Consent means a voluntary and informed agreement to the collection, use, or disclosure of personal information for identified purposes. Consent may be express or, where permitted by law, implied. You may withdraw consent subject to legal or contractual restrictions and reasonable notice.
• Controller means an organization that determines the purposes and means of processing personal data. This term is used principally under the GDPR.
• Service provider or processor means an organization that processes personal information on behalf of another organization, in accordance with that organization’s instructions and applicable contractual terms.
• Subprocessor means a service provider engaged by Trinity to process information in support of services Trinity provides to a client.

3. Information We Collect

The information we collect depends on your relationship with us and how you use our website and services. It may include:

3.1 Contact and business information

• Name, email address, telephone number, business address, company name, and job title.
• Information about your business, its operations, objectives, and technology needs.

3.2 Inquiries, consultations, and communications

• Information you provide in forms, emails, calls, consultation bookings, or other communications.
• Records of communications, meeting notes, preferences, service requests, and related correspondence.
• Information you choose to provide about your business, employees, customers, or business processes.

3.3 Client, account, billing, and payment information

• Client account, engagement, contract, project, and relationship records.
• Invoices, transaction details, payment status, and billing contact information.
• Payment card or bank information may be collected directly by a payment processor. We generally do not receive or retain complete payment card details.

3.4 Website and device information

When you visit our website, we or our service providers may collect information such as:

• Internet Protocol (“IP”) address, approximate location derived from IP address, device identifiers, browser type and version, operating system, language, and referring website.
• Pages viewed, links clicked, time spent on pages, access dates and times, and other website usage data.
• Cookie and similar technology identifiers and preferences.

3.5 Client business data

When delivering services, a client may provide business information, records, documents, databases, prompts, or other content. Depending on the service, that material may contain personal information about the client’s customers, employees, contractors, suppliers, or other individuals. The client is responsible for ensuring it has the authority and legal basis to provide that information to Trinity and to authorize the agreed processing.

We ask clients to avoid providing sensitive or unnecessary personal information unless it is required for the agreed service and appropriate safeguards have been arranged.

4. How We Collect Information

We may collect information:

• Directly from you, such as when you submit a form, email us, book a consultation, enter into a contract, or provide information during a project.
• Automatically, through cookies, server logs, analytics tools, and similar technologies when you use our website.
• From service providers, such as website hosting, analytics, scheduling, email, CRM, payment, and AI technology providers.
• From publicly available sources, where reasonably relevant to business communications or service delivery and permitted by law.
• From clients, when they provide information to enable us to deliver services or support an AI system or automation.

If you provide personal information about another person, you are responsible for providing any notice and obtaining any consent required by law.

5. How We Use Information

We may use personal information for the following purposes:

• To respond to inquiries and communicate with prospective or existing clients.
• To schedule and conduct consultations and assess business requirements.
• To provide, operate, maintain, and support consulting services, AI systems, and automations.
• To configure systems, integrate business tools, troubleshoot issues, and provide project support.
• To manage client accounts, contracts, projects, and business relationships.
• To process invoices and payments, maintain business records, and administer our operations.
• To improve our website, services, systems, and user experience.
• To monitor security, prevent fraud, investigate misuse, and protect people, systems, and property.
• To comply with legal, regulatory, tax, accounting, and contractual obligations and respond to lawful requests.
• To send marketing communications where permitted by law and, where required, with your consent.

You may unsubscribe from marketing emails using the instructions in the message or by contacting us. We may still send non-marketing messages relating to an inquiry, service, transaction, or legal obligation.

We will identify purposes at or before collection, obtain consent where required, and limit collection, use, and disclosure to purposes that are reasonable and appropriate in the circumstances or otherwise permitted by law.

6. AI, Automation, and Human Oversight

AI technologies may be used in the delivery of our services. The specific tools and processing depend on the project, the client’s instructions, the applicable contract, and the information involved.

6.1 How client data may be used

To provide a client’s services, we may use client-provided information to:

• Configure, test, operate, and maintain an AI system or automation.
• Create or improve prompts, workflows, retrieval systems, knowledge bases, integrations, or other project components.
• Fine-tune or otherwise adapt a model only where this is part of the agreed service and authorized by the applicable client agreement.

Client data is not sold by Trinity. We do not use client data to train or fine-tune third-party public foundation models unless the client expressly agrees to that use in writing. Where information is used for configuration, testing, or project-specific adaptation, the applicable agreement should identify the purpose, data, tools, safeguards, retention, and deletion arrangements.

6.2 Third-party AI and cloud services

We may use third-party AI models, cloud hosting, software, and infrastructure providers to deliver or support a project. These providers may process information on our or the client’s behalf, subject to applicable contractual protections and instructions. The service providers used for a particular project may be identified in the applicable agreement or on request, subject to confidentiality and security considerations. See Section 8.

6.3 Human oversight and automated decisions

We use human oversight and responsible AI practices in designing and delivering solutions. AI outputs may be inaccurate, incomplete, or biased and should be reviewed by a qualified person before being relied upon, particularly where they may materially affect an individual.

Trinity does not intend to make decisions about individuals solely by automated means in a way that produces legal or similarly significant effects, unless this is expressly agreed and handled in accordance with applicable law. Where a client uses an AI system or automation to make or support decisions affecting individuals, the client is responsible for determining the appropriate legal basis, notices, safeguards, and human review. We will work with clients to implement agreed oversight and controls.

6.4 AI data retention and deletion

AI-related information is retained and deleted in accordance with the applicable client agreement, project requirements, and Section 10 of this Policy. Unless otherwise agreed, project data and datasets used for configuration or testing are deleted or de-identified following contract termination, subject to legal retention duties, necessary security records, and routine backup deletion cycles.

6.5 Emerging AI and automated decision-making law

Rules for artificial intelligence, automated decision-making, and data are developing in Canada and internationally. We design and operate our solutions with a view to complying with the AI, privacy, and automated decision-making laws that apply to our business as they come into force, including any federal Canadian AI legislation enacted in the future, and with the privacy laws described in this Policy.

As part of our responsible AI approach, and where appropriate to the service we provide, we aim to:

• assess the risks of an AI system or automation before it is put to use and reassess it when its use or context changes;
• apply human oversight proportionate to the risk, including review of outputs that could materially affect an individual;
• be transparent with clients about when AI is used, what it is used for, and its known limitations;
• document the purpose, data, tools, and safeguards for significant deployments;
• avoid using personal information in ways that are unlawful, discriminatory, or contrary to the purposes for which it was collected; and
• review our practices as legal requirements and industry standards evolve.

These commitments supplement, and do not replace, the specific obligations described elsewhere in this Policy or in an applicable client agreement. Where a new legal requirement applies to a service we already provide, we will take reasonable steps to update our practices and, where necessary, our agreements with clients.

7. Cookies and Tracking Technologies

Our website and service providers may use cookies, pixels, local storage, and similar technologies. Cookies are small files stored on your device. They may support website operation, remember preferences, measure site use, or support marketing.

The types of cookies that may be used include:

• Strictly necessary cookies, which support core website functions, security, and user-requested features.
• Performance and analytics cookies, which help us understand website traffic and usage and improve the website.
• Functionality cookies, which remember settings or preferences.
• Marketing cookies, which may be used to deliver or measure advertising, where enabled and permitted by law.

Our website may use third-party services such as Google reCAPTCHA to help protect forms and prevent abuse. These services may collect device and usage information under their own privacy terms.

You can manage cookies through any cookie consent tool made available on the website and through your browser settings. Blocking or deleting cookies may affect website functionality. Where consent is required by law, non-essential cookies will be used only after consent. For additional information about how we use cookies and similar technologies, contact us at trinityaiconsulting@yahoo.com.

8. How We Disclose Information

We do not sell personal information and do not share it for cross-context behavioural advertising. We may disclose personal information as described below, subject to applicable law and appropriate safeguards.

8.1 Service providers and subprocessors

We may disclose information to service providers that support our operations or client services, including providers of:

• Cloud hosting, storage, cybersecurity, and infrastructure.
• AI models, machine learning, and related software.
• Website hosting, analytics, cookies, and form security.
• Email, communications, scheduling, and customer relationship management (“CRM”).
• Payment processing, invoicing, bookkeeping, and accounting.

The providers used may change over time. A current or project-specific list may be obtained by contacting us at trinityaiconsulting@yahoo.com or as set out in the applicable client agreement. We require service providers to protect information through confidentiality obligations, contractual restrictions, and appropriate security safeguards. They may process information only for authorized purposes and in accordance with applicable agreements and law.

8.2 Professional advisers

We may disclose information to our lawyers, accountants, auditors, insurers, and other professional advisers where reasonably necessary for the services they provide and subject to appropriate confidentiality obligations.

8.3 Corporate transactions

Information may be disclosed in connection with a proposed or completed merger, financing, acquisition, restructuring, sale of assets, or similar corporate transaction. We will take reasonable steps to protect the information and, where required, provide notice or obtain consent.

8.4 Legal, regulatory, and safety purposes

We may disclose information where required or permitted by law, court order, or legal process; to respond to a lawful request from a public authority; to establish or exercise legal rights or defend legal claims; or to protect the rights, safety, and security of Trinity, our clients, individuals, or the public.

9. International Transfers and Storage

Our primary business operations are in Canada. Information may be stored in Canada and may be transferred to, accessed in, or processed in the United States or other jurisdictions where Trinity or our service providers operate.

Privacy laws in those jurisdictions may differ from those in your location, and information may be accessible to courts, law enforcement, or government authorities under the laws of those jurisdictions. Where required, we use appropriate safeguards, which may include contractual protections, vendor due diligence, security assessments, access controls, and other measures designed to protect information during processing and transfer.

For information protected by the GDPR, transfers outside the European Economic Area or the United Kingdom will be made using an applicable transfer mechanism and supplementary safeguards where required by law.

10. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, to provide services, meet legal or accounting requirements, resolve disputes, and enforce agreements. Retention may vary based on the information, the service, client instructions, and legal requirements.

Typical retention practices are:

When information is no longer required, we will securely delete, destroy, or de-identify it, subject to technical limitations, lawful retention obligations, and routine backup processes. Specific retention and deletion terms for client data may be set out in a client agreement or data processing agreement.

11. Security and Privacy Breaches

We use administrative, technical, and physical safeguards designed to protect personal information against loss, theft, unauthorized access, use, disclosure, alteration, or destruction. Depending on the sensitivity and context, safeguards may include:

• Encryption in transit and, where supported and appropriate, at rest.
• Access controls, least-privilege permissions, and multi-factor authentication.
• Security monitoring, backups, and system maintenance.
• Vendor due diligence and contractual security requirements.
• Confidentiality obligations for employees, contractors, and other authorized personnel.
• Policies and procedures for secure handling, retention, and disposal of information.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

We maintain incident response procedures to investigate suspected privacy or security incidents, limit their effects, and take appropriate remedial action. Where required by applicable law, we will notify affected individuals and regulators, including reporting a breach to the Office of the Privacy Commissioner of Canada where PIPEDA requires it, and notifying other applicable authorities. We will also notify clients as required by our agreements and applicable law, so that clients can meet their own obligations.

12. Your Rights and Choices

Your rights depend on the law that applies and the context in which we hold your information. You may contact us to ask what information we hold about you, request access or correction, or raise a privacy concern.

12.1 Rights and choices under Canadian law

Subject to applicable law and exceptions, you may:

• Request access to personal information we hold about you.
• Request correction of information that is inaccurate or incomplete.
• Withdraw consent to certain collection, use, or disclosure, subject to legal or contractual restrictions and reasonable notice.
• Ask questions about our privacy practices or request that information be deleted where deletion is legally available and appropriate.

We may need to verify your identity before processing a request. We may decline or limit a request where permitted by law, including where an exception applies or we cannot verify your identity. If we cannot fulfill a request, we will explain the reason where required by law.

12.2 Additional rights under the GDPR or UK GDPR

If the GDPR or UK GDPR applies, you may have the right, subject to legal conditions and exceptions, to:

• Request access to your personal data and information about its processing.
• Request correction or deletion.
• Request restriction of processing or object to processing.
• Request data portability for information processed on the applicable legal basis.
• Withdraw consent where processing is based on consent.
• Object to direct marketing.
• Lodge a complaint with the relevant supervisory authority.

Where required, the legal basis for processing may include your consent, performance of a contract, compliance with a legal obligation, protection of vital interests, or our legitimate interests, provided those interests do not override your rights and freedoms. The applicable basis depends on the activity and will be explained where required.

12.3 California privacy rights

If the CCPA/CPRA applies to our handling of your information, California residents may have rights, subject to applicable requirements and exceptions, to:

• Know and access certain information about the personal information we collect, use, disclose, or retain.
• Request deletion or correction of personal information.
• Obtain certain information in a portable format.
• Opt out of the sale or sharing of personal information for cross-context behavioural advertising.
• Limit the use and disclosure of sensitive personal information in circumstances covered by the law.
• Not be discriminated against for exercising privacy rights.

Trinity does not sell personal information and does not share personal information for cross-context behavioural advertising. We do not knowingly sell or share personal information of consumers under 16 years of age. California residents may submit a request using the contact details in Section 17. An authorized agent may make a request where permitted by law, subject to verification requirements.

12.4 How to make a request

To exercise a right or make a privacy request, contact us at trinityaiconsulting@yahoo.com. Please describe your request and the information or relationship it concerns. We may ask for information reasonably necessary to verify your identity and locate the relevant records.

We do not discriminate against individuals for exercising applicable privacy rights. A request may be subject to lawful limitations or exceptions.

13. Information Processed on Behalf of Clients

When Trinity processes personal information contained in a client’s data to deliver services, the client generally determines the purposes and means of processing, and Trinity acts as the client’s service provider or processor, subject to the applicable agreement and law.

If your personal information is held by Trinity on behalf of one of our clients, please direct your access, correction, deletion, or other privacy request to that client. We will refer your request to the client where appropriate and assist the client, as required by our agreement and applicable law, in responding to the request.

If you contact us directly, we may need to identify the relevant client before we can respond. We will not independently use client-provided personal information for purposes outside the client’s instructions, the applicable agreement, or what the law permits.

14. Children’s Privacy

Our website and services are directed to businesses and are not intended for children under 13 years of age, or under 16 where applicable law sets that age or requires additional protections. We do not knowingly collect personal information directly from children. If you believe a child has provided personal information to us, contact us at trinityaiconsulting@yahoo.com so we can assess and take appropriate steps.

15. Third-Party Links and Services

Our website or services may link to third-party websites, applications, or services. Those third parties operate under their own privacy practices. Trinity is not responsible for the privacy, security, or content practices of third parties, and we encourage you to review their privacy notices before providing information to them.

16. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, services, technologies, or legal requirements. The revised version will be posted on trinityaiconsulting.ca with an updated effective date. Where required by law, we will provide additional notice or obtain consent for material changes.

17. Contact Us and Complaints

For questions, privacy requests, or concerns about this Policy or our handling of personal information, contact:

Privacy Officer
Email: trinityaiconsulting@yahoo.com
Website: trinityaiconsulting.ca
Mailing address: 25389 98 Avenue, Maple Ridge, BC, Canada

Please include “Privacy Request” or “Privacy Concern” in the subject line of an email where appropriate. We will review and respond to concerns within a reasonable time and in accordance with applicable law.

If you are not satisfied with our response, you may submit a complaint to the appropriate privacy authority, including:

• Office of the Privacy Commissioner of Canada for matters within its jurisdiction.
• Office of the Information and Privacy Commissioner for British Columbia for matters within its jurisdiction.
• The relevant data protection supervisory authority in your country or region, where the GDPR or another law applies.
• The relevant California privacy regulator, where applicable.