Privacy Policy

Orizn AI Ltd (operating as Orizn AI) is a premium AI agency incorporated under the Business Corporations Act (British Columbia), Canada. We design, build, and deploy custom AI agents for businesses.

Data Controller: Orizn AI Ltd
Address: 100-95 Schooner Street, Coquitlam, BC V3K 7A8, Canada
Email: contact@orizn.ai

We collect the following personal data:

• Contact form: Name, email address, company name, and message content when you submit our contact form.
• Origin of your request: When you send a request or book a call, we also record the website that brought you to us, any campaign parameters in the link (UTM parameters) and your optional answer to "How did you hear about us?". If you accepted audience measurement cookies, we also record the first page of your visit. We use this to learn which pages and channels bring requests; it is kept with your request, for the same period. When you write to the agent on our website, the address of the page where the conversation starts, without its parameters, is sent with the conversation, for the same reason.
• Authentication: Email address when you create an account via magic link.
• Billing: Payment information processed securely by Stripe (we never store card details).
• SMS alerts: if you turn them on, the mobile numbers you register for your team and the date each one was confirmed with a code.
• Usage data: Aggregated analytics about how you use our platform (with your consent).
• Technical data: IP-based country for currency display, browser type, and device information.

As a British Columbia company, we process your data in compliance with the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (BC PIPA). Where we handle personal information of Quebec residents, Quebec's Law 25 also applies. For users in the European Union, we comply with the GDPR.

• Consent: For analytics cookies and marketing communications.
• Contract execution: For providing our SaaS services, processing payments, and managing your account.
• Legitimate interest: For website security, fraud prevention, and service improvement.

For EU users, these bases correspond to GDPR Art. 6(1)(a), 6(1)(b), and 6(1)(f) respectively.

Your data is used to:

• Respond to your inquiries and provide customer support
• Create and manage your account
• Process payments and manage subscriptions
• Deliver and improve our AI agent services
• Send transactional emails (account confirmation, billing)
• Send an SMS alert to the team of a client who asked for it, for their visitors' urgent requests (the type of request and the callback number the visitor gave)
• Analyze website usage (with consent) to improve our services
• Detect and prevent fraud and abuse

We share your data with the following processors, all bound by Data Processing Agreements (DPAs) compliant with PIPEDA, BC PIPA, and the GDPR:

We do not sell, rent, or commercially share your personal data with third parties.

Mobile numbers registered for SMS alerts are used only to send those alerts. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Replying STOP to one of these texts stops messages to that number.

Some of these processors handle your data outside Canada. For questions about the policies and practices governing those cross-border transfers — a requirement of section 13.1 of Alberta's PIPA — write to privacy@orizn.ai.

Two of these processors are identified by category rather than by corporate name. The GDPR (art. 13(1)(e)) expressly allows "recipients or categories of recipients", and neither PIPEDA nor Alberta's PIPA requires naming a vendor. Corporate names are provided on request at privacy@orizn.ai.

Our database is hosted in the European Union (Frankfurt, Germany). Chat conversations are processed in the United States by our conversational agent platform, and responses are generated in the United States by our language model provider. Application compute (Vercel) runs across European and US regions depending on visitor location, and other providers, including Stripe, Google Analytics and Twilio (SMS alerts), operate outside the EU. Canada benefits from a partial EU adequacy decision for commercial organizations subject to PIPEDA. Transfers outside the EU include equivalent protection guarantees through:

• Contractual safeguards ensuring equivalent data protection standards
• Standard Contractual Clauses (SCCs) for transfers outside the EU, as approved by the European Commission
• Verification that each processor maintains appropriate technical and organizational measures

Our principal service providers maintain international compliance standards with appropriate contractual safeguards.

We retain your data for the following periods:

• Account data: Until you request deletion or 2 years after last activity
• Contact form submissions: 12 months
• Billing records: 10 years (legal obligation)
• Analytics data: 14 months (GA4 configuration)
• Consent records: 13 months (privacy legislation maximum)
• Authentication tokens: Session duration only
• Security IP addresses: 30 days
• SMS alerts: mobile numbers until you remove them or delete your account; unused confirmation codes, 24 hours; send log (date and status, without the text of the message), 13 months

Under PIPEDA and BC PIPA (and Quebec Law 25 where applicable), you have the right to:

• Access your personal data and confirm its processing
• Rectify inaccurate data
• Erase your data (except where legal retention obligations apply)
• Data portability — receive your data in a structured format for transfer
• Object to processing for legitimate reasons
• Restrict processing in certain circumstances
• Withdraw consent at any time

For users in the European Union, all rights under the GDPR also apply, including the right to be forgotten and the right to lodge a complaint with your local supervisory authority.

Response timeframe: Maximum 30 days from your request, extendable by two additional months for complex requests.

To exercise your rights, contact us at contact@orizn.ai or use the data management tools in your dashboard settings.

We use cookies and similar technologies. For detailed information, please see our Cookie Policy.

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS)
• Secure authentication via magic links (no passwords stored)
• Role-based access control
• Regular security reviews
• Content Security Policy headers

You have the right to lodge a complaint with a supervisory authority:

• British Columbia: Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — PO Box 9038 Stn Prov Govt, Victoria, BC V8W 9A4 — Phone: 1-250-387-5629 — www.oipc.bc.ca
• Canada: Office of the Privacy Commissioner of Canada (OPC) — 30 Victoria St, Gatineau, QC K1A 1H3 — Phone: 1-800-282-1376 — www.priv.gc.ca
• Quebec residents: Commission d'accès à l'information du Québec (CAI) — 525 René-Lévesque Blvd East, Suite 2.36, Quebec, QC G1R 5S9 — Phone: 1-888-528-7741 — www.cai.gouv.qc.ca

For users in the European Union, you may also contact your local data protection authority.

We encourage you to contact us first so we can address your concerns.

We may update this policy from time to time. If we make significant changes, we will re-request your consent where necessary. The date of the last update is indicated at the top of this page.