GovAI

Legal

Privacy Policy

1. Introduction

Civia Inc., doing business as GovAI ("GovAI," "we," "us" or "our"), provides an artificial-intelligence platform and related websites, applications, services, integrations and support services.

This Privacy Policy explains how GovAI collects, uses, discloses and protects personal information when individuals:

  • visit our websites;
  • communicate with us;
  • request information or demonstrations;
  • establish or administer an account;
  • use the GovAI platform;
  • interact with GovAI through an integration; or
  • interact with a GovAI-powered chatbot, assistant or other service made available by a GovAI customer; or
  • otherwise engage with GovAI.

"Personal Information" means information that identifies, relates to, describes or could reasonably be associated with an identifiable individual. It does not include information that has been aggregated or de-identified so that it can no longer reasonably identify an individual.

Additional information about GovAI's privacy, security and compliance practices is available at trust.govai.com.

2. Our Role

GovAI processes Personal Information in different capacities depending on the circumstances.

Customer-Directed Processing

When GovAI processes prompts, messages, files, records, integration data or other information on behalf of an organization using GovAI, including information submitted through a customer-configured public-facing chatbot or assistant, the organization generally determines the purposes for which that information is processed.

In those circumstances:

  • the organization is generally the business, controller or other entity responsible for the information;
  • GovAI acts as its service provider, contractor or processor;
  • the organization's agreement with GovAI, including any applicable Data Processing Addendum, governs GovAI's processing; and
  • requests concerning that information should ordinarily be directed to the organization.

The organization may provide additional notices, disclaimers or terms governing its particular use of GovAI, including public-facing deployments.

This Privacy Policy does not change the allocation of rights and responsibilities in an agreement between GovAI and an organization.

GovAI's Own Processing

GovAI determines the purposes and means of processing certain Personal Information relating to:

  • website visitors;
  • prospective customers;
  • customer representatives;
  • account administration;
  • billing and commercial relationships;
  • support and service communications;
  • security, fraud prevention and platform integrity;
  • legal and regulatory compliance; and
  • GovAI's business operations.

For this processing, GovAI acts as the business, controller or organization responsible for the Personal Information, as applicable.

3. Scope

This Privacy Policy applies to GovAI websites, domains, applications, services, integrations and communications that link to or reference this Privacy Policy.

Organizations may make GovAI-powered chatbots, assistants or other services available through their own websites, applications or digital services. This Privacy Policy applies to GovAI's processing in connection with those services. The organization's own privacy notices, disclaimers and policies may also apply to its collection and use of information through the service.

It does not apply to:

  • an organization's independent handling of Personal Information;
  • third-party websites or services that are not operated by GovAI;
  • information processed solely by a third party through an independently configured service; or
  • GovAI personnel information governed by internal employment policies.

Third-party services have their own terms and privacy practices. Organizations should evaluate and authorize integrations before enabling them.

4. Personal Information We Collect

The information we collect depends on how an individual or organization interacts with GovAI.

Account and Identity Information

We may collect:

  • name;
  • organizational email address;
  • organization and department;
  • role or job title;
  • account identifiers;
  • authentication and single sign-on information;
  • account preferences; and
  • administrator-provided user information.

We do not ordinarily require users to provide personal payment information when access is supplied through an organization.

Organizational Content

When individuals use GovAI, we may process information submitted to or generated through the service, including:

  • prompts and messages;
  • uploaded files and documents;
  • generated output;
  • comments and feedback;
  • records contained in connected systems;
  • information retrieved through integrations; and
  • metadata associated with that content.
  • questions, messages and other information submitted through customer-provided public-facing chatbots or assistants;

Organizational Content may be submitted by an organization's personnel or by residents, citizens, website visitors or other individuals interacting with a service made available by the organization.

Organizational Content may contain Personal Information or other sensitive information. Users should submit only information they are authorized to use.

Integration and Connected-System Information

Organizations may authorize GovAI to connect with databases, document repositories, communications systems, productivity tools, application programming interfaces, Model Context Protocol servers or other systems.

Depending on the integration and the organization's configuration, GovAI may process:

  • authentication tokens or connection credentials;
  • user, group and permission identifiers;
  • files, records or messages retrieved from a connected system;
  • search queries and retrieval results;
  • tool inputs and outputs;
  • actions requested or performed through an integration;
  • integration configuration;
  • audit and execution logs; and
  • related metadata.

GovAI processes connected-system information only as authorized by the organization, the applicable user and the relevant agreement.

Enabling an integration does not transfer ownership of the connected information to GovAI.

Usage, Device and Technical Information

We may automatically collect:

  • IP address;
  • browser and device information;
  • operating system;
  • login and authentication events;
  • date and time information;
  • pages and features accessed;
  • service usage and interaction data;
  • error, diagnostic and performance information;
  • security events;
  • approximate location derived from IP address; and
  • cookies and similar technologies.

Commercial and Relationship Information

We may collect:

  • business contact information;
  • correspondence;
  • meeting and demonstration information;
  • contract and order information;
  • support requests;
  • billing contact information; and
  • payment and transaction records.

Payment card information may be collected and processed directly by a payment provider rather than GovAI.

Information From Other Sources

We may receive information from:

  • the individual's organization;
  • authorized administrators;
  • identity and authentication providers;
  • integrations enabled by an organization;
  • service providers;
  • business partners;
  • publicly available sources; and
  • individuals who communicate with GovAI.

5. How We Use Personal Information

Depending on the context, GovAI may use Personal Information to:

Provide and Operate the Services

  • create and administer accounts;
  • authenticate users;
  • provide prompts, retrieval, generation, workflow and integration functionality;
  • process customer-authorized requests;
  • maintain service availability;
  • provide support;
  • implement customer configurations; and
  • manage subscriptions and commercial relationships.
  • operate customer-configured public-facing chatbots, assistants and related digital services;

Operate Integrations and Connected Tools

  • authenticate and maintain authorized connections;
  • retrieve customer-authorized information;
  • provide relevant information to models, tools or workflows;
  • execute customer-authorized actions;
  • return results to the user or connected system;
  • enforce permissions and access controls; and
  • create security, audit and operational logs.

The information available to an integration depends on the permissions, systems and configuration selected by the organization.

Protect GovAI, Users and Organizations

  • detect and prevent unauthorized access;
  • investigate misuse, fraud and security incidents;
  • enforce access and usage controls;
  • monitor system integrity;
  • maintain logs;
  • protect legal rights; and
  • comply with legal obligations.

Maintain and Improve the Services

  • troubleshoot errors;
  • evaluate reliability, usability and performance;
  • improve platform features and workflows;
  • develop new features;
  • conduct internal analytics; and
  • understand general product adoption.

Customer Data is not used to train GovAI or third-party artificial-intelligence models.

GovAI may use aggregated or de-identified information that does not reasonably identify an individual or organization to understand and improve the service.

Communicate With Individuals and Organizations

  • respond to inquiries;
  • send administrative and security notices;
  • provide service updates;
  • manage demonstrations and events;
  • communicate about an account or agreement; and
  • send marketing communications where permitted by law.

Individuals may unsubscribe from non-essential marketing communications at any time.

Meet Legal and Business Requirements

  • comply with law, court orders and lawful government requests;
  • establish, exercise or defend legal claims;
  • conduct audits and compliance activities;
  • complete corporate transactions; and
  • maintain business and financial records.

6. Artificial Intelligence

GovAI uses artificial-intelligence models and related service providers to provide the service. Information submitted to GovAI may be sent to an artificial-intelligence provider where necessary to generate output or perform a customer-authorized function.

GovAI contractually and technically configures providers to restrict their use of Customer Data. GovAI does not permit Customer Data to be used to train third-party artificial-intelligence models.

Artificial-intelligence output may contain inaccuracies and should be reviewed before use.

Current information about material artificial-intelligence providers and other subprocessors is available at trust.govai.com.

7. How We Disclose Personal Information

GovAI may disclose Personal Information in the following circumstances.

Information submitted through a customer-provided public-facing chatbot or assistant may be made available to the organization operating that service and its authorized personnel in accordance with the organization's configuration, policies, legal obligations and agreement with GovAI.

Organizations and Authorized Administrators

Information associated with an organizational account may be disclosed to the organization where permitted by its agreement, configuration, policies or legal obligations.

Routine administrative analytics do not ordinarily include the content of private prompts, messages or uploaded files. Specially authorized access or export may occur for purposes such as:

  • records management;
  • freedom-of-information or public-records obligations;
  • security investigations;
  • audits;
  • legal holds;
  • regulatory compliance;
  • litigation; or
  • other authorized organizational purposes.
  • responding to or administering public inquiries and services;

Service Providers and Subprocessors

GovAI uses service providers and subprocessors to provide infrastructure, hosting, artificial intelligence, communications, customer support, authentication, analytics, security and other business services.

These providers may process Personal Information only for authorized purposes and subject to contractual obligations appropriate to the service they provide.

The current list of material subprocessors is maintained at trust.govai.com. The list may change as GovAI and its services evolve without requiring an amendment to this Privacy Policy.

Customer-Authorized Integrations

Where an organization or user enables an integration, GovAI may disclose information to and receive information from the connected system as necessary to perform the authorized function.

The organization controls which integrations are enabled and is responsible for ensuring that it has authority to connect the system and direct the processing.

Legal and Safety Disclosures

GovAI may disclose information where reasonably necessary to:

  • comply with applicable law;
  • respond to valid legal process;
  • protect the rights, safety or property of GovAI or others;
  • investigate fraud, misuse or security incidents; or
  • enforce applicable agreements.

Where legally permitted and appropriate, GovAI will direct requests for Customer Data to the relevant organization or notify the organization before disclosure.

Corporate Transactions

Personal Information may be disclosed or transferred as part of a financing, merger, amalgamation, reorganization, acquisition, sale of assets, change of control or similar corporate transaction.

Any successor will remain subject to applicable law and contractual obligations concerning Customer Data.

8. Sale, Sharing and Targeted Advertising

GovAI does not sell Personal Information.

GovAI does not use or disclose Customer Data for cross-context behavioural advertising or targeted advertising. GovAI may use limited website analytics and marketing technologies on its public websites. Where applicable law treats particular advertising or analytics disclosures as a "sale," "sharing" or targeted advertising, individuals may exercise the applicable opt-out rights by contacting GovAI or using any preference mechanism made available on the website.

GovAI honours legally required browser-based opt-out preference signals where applicable.

9. Cookies and Similar Technologies

GovAI may use cookies and similar technologies to:

  • operate and secure its websites and services;
  • maintain authenticated sessions;
  • remember preferences;
  • understand website usage;
  • diagnose errors; and
  • measure the effectiveness of communications.

Cookies may include:

  • strictly necessary cookies;
  • preference cookies;
  • security cookies; and
  • analytics cookies.

Available cookie choices may vary based on location and the website or service being used. Disabling necessary cookies may prevent parts of the service from operating correctly.

10. Retention and Deletion

GovAI retains Personal Information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the services, meet contractual commitments, maintain security, comply with legal obligations and resolve disputes.

Retention of Customer Data is governed by:

  • the organization's configuration;
  • the applicable Enterprise Subscription Agreement;
  • the applicable Data Processing Addendum;
  • legal and records-management obligations; and
  • backup and disaster-recovery practices.

For customer-provided public-facing services, the organization determines the applicable retention settings and may also be subject to records-management, freedom-of-information, public-records, archival or other legal obligations.

Removal from active production systems may not result in immediate removal from encrypted backups, archives, logs or legally required records. Residual copies are deleted or rendered inaccessible through established retention cycles unless continued retention is required by law.

GovAI may retain de-identified information that cannot reasonably identify an individual or organization.

11. Data Location and International Transfers

Customer Data is hosted in the location specified in the applicable Order Form or Enterprise Subscription Agreement, where applicable.

Personal Information may also be processed by GovAI or its service providers in Canada, the United States or other countries where they operate. Those jurisdictions may have privacy laws that differ from the laws where the individual resides.

Where required, GovAI uses contractual, organizational and technical safeguards for international transfers of Personal Information. Additional information about data hosting, transfer safeguards and subprocessors is available at trust.govai.com and in the applicable Data Processing Addendum.

12. Security

GovAI maintains administrative, technical and physical safeguards designed to protect Personal Information against unauthorized access, use, loss, alteration or disclosure.

These measures include, as appropriate:

  • encryption in transit and at rest;
  • authentication and access controls;
  • logical separation of customer environments;
  • logging and monitoring;
  • vulnerability management;
  • incident-response procedures;
  • business-continuity and disaster-recovery measures;
  • personnel security and training; and
  • vendor and subprocessor management.

No service can guarantee absolute security.

Additional information concerning GovAI's security and compliance program is available at trust.govai.com.

13. Privacy Incidents

GovAI maintains procedures for identifying, assessing and responding to privacy and security incidents.

Where required by law or contract, GovAI will notify affected organizations, individuals or regulators within the applicable timeframe.

Where GovAI processes Customer Data on behalf of an organization, incident notification obligations are governed by the applicable Enterprise Subscription Agreement and Data Processing Addendum.

14. Individual Privacy Rights

Depending on the individual's location and the circumstances of the processing, the individual may have rights to:

  • know whether GovAI processes their Personal Information;
  • access Personal Information;
  • correct inaccurate Personal Information;
  • request deletion;
  • obtain a portable copy;
  • withdraw consent where processing is based on consent;
  • opt out of certain sales, sharing or targeted advertising;
  • limit certain uses of sensitive Personal Information;
  • object to or restrict certain processing;
  • appeal a decision concerning a privacy request; and
  • receive equal service and treatment when exercising privacy rights.

These rights are subject to applicable exceptions and verification requirements.

Where GovAI processes information on behalf of an organization, the individual should ordinarily submit the request directly to that organization. This includes requests concerning information submitted through a public-facing chatbot or assistant made available by that organization. GovAI will support the organization as required by law and the applicable Data Processing Addendum. Requests concerning information for which GovAI is responsible may be submitted to [email protected].

GovAI may request information necessary to verify identity, authority and jurisdiction. Authorized agents may submit requests where permitted by law.

Individuals may also complain to the applicable privacy regulator or supervisory authority.

15. Sensitive Personal Information

GovAI does not require users to submit sensitive Personal Information unless it is necessary for an authorized customer purpose.

Organizations and users are responsible for determining whether sensitive information may appropriately be submitted to GovAI and for configuring access, integrations and retention accordingly.

GovAI uses sensitive Personal Information only as necessary to provide the requested service, maintain security, comply with law or perform another purpose permitted by the applicable agreement. GovAI does not use sensitive Personal Information to infer characteristics about individuals for advertising purposes.

16. Children and Minors

GovAI's workforce services are intended for authorized government and public-sector personnel. Organizations may also make GovAI-powered services available to the general public, which may be accessed by children or minors.

For purposes of this Privacy Policy, "child" or "minor" means an individual who is considered a child or minor under applicable law.

GovAI does not knowingly collect Personal Information from children or minors for its own independent purposes. Where Personal Information is submitted by or about a child or minor through a customer-provided service, GovAI generally processes that information on behalf of the organization and under the applicable agreement.

The organization is responsible for determining whether its use of GovAI is appropriate for children or minors and for providing any notices, obtaining any consents, establishing any legal authority and implementing any additional safeguards required by applicable law.

A parent, guardian or other authorized representative seeking to exercise rights concerning information processed through a customer-provided service should ordinarily contact the organization that made the service available. GovAI will assist the organization as required by applicable law and the applicable Data Processing Addendum.

17. Data Processing Addendum

Organizations may enter into GovAI's Data Processing Addendum, which addresses matters including:

  • processing instructions;
  • confidentiality;
  • security safeguards;
  • subprocessors;
  • assistance with privacy requests;
  • privacy incidents;
  • deletion and return of Customer Data;
  • audits and compliance information; and
  • international data transfers.

The current standard Data Processing Addendum is available through trust.govai.com or upon request.

If there is a conflict concerning GovAI's processing of Customer Data, the Enterprise Subscription Agreement and Data Processing Addendum govern over this Privacy Policy.

18. Changes to This Privacy Policy

GovAI may update this Privacy Policy to reflect changes in law, our services or our privacy practices.

The current version will be posted on our website with an updated effective date. Where required by law, GovAI will provide additional notice of material changes.

Changes to this Privacy Policy do not amend an Enterprise Subscription Agreement or Data Processing Addendum. Operational information that changes more frequently—such as subprocessors, service locations, certifications and security documentation—may be maintained at trust.govai.com without requiring an amendment to this Privacy Policy.

19. Contact Us

Questions or requests concerning this Privacy Policy may be directed to:

Privacy Officer
Civia Inc. d/b/a GovAI
375 Hagey Boulevard, Suite 310
Waterloo, Ontario N2L 6R5
Canada

Email: [email protected]

General support inquiries may be sent to [email protected]. Additional privacy, security and compliance information is available at trust.govai.com.