Cross-Border Transfer Disclosure
Last updated: July 2026·Canuckt AI Solutions (Canuckt Synergy Solutions Inc.), Halifax, NS, Canada
1. Purpose
This disclosure is published to satisfy Canuckt Synergy Solutions Inc.'s obligations under Quebec Law 25, articles 17 and 17.1, which require an organization to inform individuals before personal information is communicated outside Quebec, and under the PIPEDA accountability principle (Schedule 1, Principle 1), which requires transparency about transfers to third parties for processing.
It applies to personal information about our customers and about end users of our products — Valdra, Shielk and canuckt.ai.
2. Where your data lives
All production databases and application workloads are hosted in Canada — a Canadian data centre in Quebec. Canadian data residency is the default and is a core commitment of our products.
3. Transfers outside Canada
The following sub-processors receive personal information outside Canada:
| Service category | Country | What is transferred | Why |
|---|---|---|---|
| AI model provider | 🇺🇸 United States | Prompt content submitted to AI features. Personal information is redacted by our own PII engine before the prompt is sent. | AI inference for the compliance assistant, document drafting and the AI gateway |
| Payment processor | 🇺🇸 United States | Email address and billing details (card data is handled by the processor and never touches our servers) | Payment and subscription processing |
| Email delivery provider | 🇺🇸 United States | Email address and message content | Transactional and notification email |
| DNS, CDN and security provider | 🇺🇸 United States | IP addresses and request metadata transiting the edge network | Content delivery and DDoS/WAF protection |
| Error monitoring provider | 🇺🇸 United States | Application error traces and diagnostics, configured to exclude personal information | Reliability monitoring |
| Source-code hosting | 🇺🇸 United States | No customer personal data | Engineering |
We do not publish the identities of our individual service providers, as that information is commercially sensitive. Customers receive the complete, named sub-processor list on request and under our Data Processing Agreement, together with advance notice of any change and a right to object. Contact our Privacy Officer below.
4. What this means — US government access
5. Safeguards
Transfers to each sub-processor are governed by that provider's data-processing terms, which are incorporated into our service agreement with them. In addition:
- PII redaction before AI processing. Prompt content is passed through our own PII detection and redaction engine, before it is sent to the AI provider — so personal information is replaced with placeholder tokens rather than transmitted.
- Data minimization. Error monitoring is explicitly configured not to capture personal information.
- No card data. Payment card numbers never touch our servers; our PCI-DSS Level 1 certified payment processor handles them directly.
- Canadian residency by default. Every production database stays in Quebec.
6. Your rights
You may ask us what personal information about you has been transferred outside Canada, object to a transfer, or withdraw consent. Contact our Privacy Officer below. You may also complain to the Office of the Privacy Commissioner of Canada or, if you are a Quebec resident, to the Commission d'accès à l'information du Québec.
7. Contact
Privacy Officer
Vivek Chakravarthy, Founder & Privacy Officer
Email: [email protected]
Canuckt Synergy Solutions Inc.
160 Spinnaker Dr, Halifax, NS B3N 3C6, Canada
See also our Privacy Policy.
