Privacy Policy

1. Introduction

M2aBot (hereinafter “the Service”) is an intelligent conversational assistant designed for small and medium-sized businesses. This privacy policy describes how we collect, use, retain and protect personal information in connection with our operations, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws.

By using our Service, you acknowledge that you have read and understood this policy. If you do not agree with these practices, please do not use the Service.

2. Privacy Officer

M2aBot has designated a privacy officer responsible for ensuring compliance with this policy and responding to any requests related to personal data.

Email: support@m2abot.ai
Address: Moncton, New Brunswick, Canada

3. Information We Collect

3.1 Information Provided by Clients

• First name, last name and business name
• Professional email address
• Phone number
• Billing and payment information (processed by a PCI-DSS certified third-party payment provider)
• Website content used to populate the chatbot knowledge base

3.2 Visitor Information

• Content of conversations with the chatbot
• Name, email and phone (if voluntarily provided via the capture form)
• Preferred language of communication

3.3 Social Messaging

When the chatbot is connected to third-party messaging platforms (e.g., Facebook Messenger, Instagram, WhatsApp), we receive the content of messages sent by users as well as their public profile identifier. We do not collect additional data from these platforms.

3.4 Automatically Collected Data

• IP address (anonymized)
• Browser type and operating system
• Pages visited and session duration
• Aggregated and anonymized usage data

4. Use of Information

We use the collected information for the following purposes:

• Provide, maintain and improve the Service
• Generate relevant and personalized responses through the chatbot
• Manage client accounts and billing
• Send Service-related notifications (transactional emails, alerts)
• Produce anonymized usage statistics and analytics
• Forward prospect contact information to clients (leads)
• Ensure security and prevent abuse

5. Artificial Intelligence and Automated Processing

M2aBot uses artificial intelligence technologies to analyze our clients’ website content and generate conversational responses. Conversations are processed in real time by our AI models.

• Conversation data is not used to train third-party AI models
• Processing is performed in a Canadian data center
• Responses are generated exclusively from content provided by the client
• No automated decisions with legal consequences are made by the system

6. Data Hosting and Location

All data is hosted and processed exclusively in Canada:

• Application servers located in a Canadian data center
• Database hosted in Canada
• Artificial intelligence processing performed in the Canadian region
• No transfer of personal data outside of Canada

This approach ensures that your data remains subject to Canadian personal information protection legislation.

7. Disclosure and Sharing of Information

M2aBot does not sell, rent or share your personal information for commercial purposes. However, we may share data with the following categories of service providers, strictly for the operation of the Service:

• PCI-DSS certified third-party payment provider (payment processing)
• Transactional email service provider (notifications)
• SMS messaging service provider (alerts)
• AI processing service provider (conversational response generation, hosted in Canada)

We may also disclose information where required by law or to protect our legal rights.

8. Consent

8.1 Website Visitors

Visitor consent is obtained when they initiate a conversation with the chatbot. A privacy notice with a link to this policy is displayed before the first message is sent. Submitting contact information through the lead capture form constitutes explicit consent.

8.2 Clients

Client consent is obtained explicitly upon registration for the Service and acceptance of the terms of service.

8.3 Withdrawal of Consent

You may withdraw your consent at any time by contacting us at support@m2abot.ai. Withdrawal of consent may affect our ability to provide certain services. We will process your request within 30 days.

9. Data Retention

• Conversations: retained for 12 months, then automatically deleted
• Activity logs: retained for 90 days
• Client account data: retained for the duration of the subscription and 30 days after termination
• Billing data: retained in accordance with Canadian tax requirements (7 years)

You may request early deletion of your data by contacting us.

10. Data Security

We implement appropriate technical and organizational security measures to protect your personal information:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Restricted data access based on the principle of least privilege
• Multi-factor authentication for administrator accounts
• Daily encrypted backups
• Continuous monitoring and security alerts

11. Your Rights Under PIPEDA

Under the Personal Information Protection and Electronic Documents Act, you have the following rights:

• Right to access your personal information
• Right to correct inaccurate information
• Right to withdraw your consent
• Right to file a complaint with the Office of the Privacy Commissioner of Canada
• Right to request deletion of your data

To exercise your rights, contact us at support@m2abot.ai. We will respond within 30 days.

12. Cookies

Our Service uses cookies that are strictly necessary for operation:

• Session cookies to maintain your login
• Preference cookies for language and theme
• Anonymized analytics cookies to improve the Service

We do not use advertising tracking cookies. You can configure your browser to reject cookies, but this may affect the functionality of the Service.

13. Changes to This Policy

We reserve the right to modify this policy at any time. Significant changes will be communicated by email to active clients and posted on this page with the update date. Continued use of the Service after changes are published constitutes your acceptance of the updated policy.