Privacy Policy

1. Introduction

Specira AI ("Specira," "we," "our," or "us") takes your privacy seriously. This policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at www.specira.ai or use our services.

This policy applies to all visitors and users regardless of location, and has been designed to comply with applicable Canadian privacy legislation (including the Personal Information Protection and Electronic Documents Act, PIPEDA, and Quebec's Act respecting the protection of personal information in the private sector, commonly referred to as Law 25), the European Union General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

By accessing or using our website, you consent to the collection and use of your information as described here. If you don't agree with these terms, please do not access the site.

2. Privacy Officer

In accordance with Quebec's Law 25, we have designated a Privacy Officer responsible for overseeing our compliance with privacy legislation. The Privacy Officer can be reached at:

Privacy Officer, Specira AI
Email: privacy@specira.ai

If you are unsatisfied with our response to a privacy concern, you may file a complaint with the Commission d'acces a l'information du Quebec (CAI), the Office of the Privacy Commissioner of Canada, or the relevant supervisory authority in your jurisdiction.

3. Information We Collect

Categories of Personal Information

We collect the following categories of personal information:

Information You Provide Directly

• Identifiers and contact information: When you sign up for early access or contact us, we collect your name, email address, company name, and job title.
• Communications: When you email us or submit a form, we collect the content of your messages and any attachments.

Information Collected Automatically

• Internet and network activity: Pages visited, time spent on pages, referring URLs, click patterns, and interactions with our website.
• Device and browser information: Browser type and version, operating system, device type, screen resolution, and language preferences.
• IP address: Used for security purposes, approximate geographic location, and to help comply with jurisdiction-specific requirements.

Information We Do Not Collect

We don't collect sensitive personal information such as financial account details, government-issued identifiers, biometric data, health information, or precise geolocation.

4. Lawful Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under the following legal bases as defined by GDPR Article 6:

• Consent (Art. 6(1)(a)): When you voluntarily submit your information through our early access form or contact form. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)): For website analytics, security monitoring, and service improvement, where our interests do not override your data protection rights.
• Legal obligation (Art. 6(1)(c)): When processing is necessary to comply with applicable laws.

5. How We Use Your Information

We use the information we collect for the following specific purposes:

• Process your early access registration and communicate with you about our services
• Respond to your inquiries and provide customer support
• Improve our website, analyze usage patterns, and develop new features
• Send you updates about Specira AI (you can opt out at any time by clicking the unsubscribe link in any email or contacting us)
• Protect against fraudulent, unauthorized, or illegal activity
• Comply with legal obligations, including responding to lawful requests from public authorities

We don't use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals. Should this change in the future, we'll update this policy and provide notice as required by Law 25, GDPR, and CCPA/CPRA.

6. Data Sharing and Disclosure

We don't sell, rent, or trade your personal information to third parties. We don't share personal information for cross-context behavioral advertising. We may disclose your information only in the following circumstances:

• Service providers: With trusted third-party services that help us operate our website and deliver our services (detailed in Section 7). These providers are bound by data processing agreements and are contractually obligated to protect your data and use it only for the purposes we specify.
• Legal requirements: When required by law, regulation, subpoena, court order, or other legal process, or to protect our rights, property, or safety.
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets. In such cases, we will notify affected users before personal information is transferred and becomes subject to a different privacy policy.

In the preceding 12 months, we have disclosed the following categories of personal information to service providers for business purposes: identifiers (name, email), internet activity data (usage analytics), and device information.

7. Third-Party Services

Our website uses the following third-party services, which may process your data outside Canada:

• Google reCAPTCHA Enterprise: To protect our contact forms from spam. Subject to Google's Privacy Policy. Google may process data in the United States.
• Vercel: For website hosting and content delivery. Subject to Vercel's Privacy Policy. Vercel may process data in the United States.
• FormSubmit: For contact form processing. Subject to FormSubmit's privacy policy.
• Google Tag Manager: A tag management service used to manage and deploy analytics tags on our website. Subject to Google's Privacy Policy. Google may process data in the United States.
• Microsoft Clarity: A behavioural analytics service that uses heatmaps and session recordings to understand how visitors interact with our website. Subject to Microsoft's Privacy Statement. Microsoft may process data in the United States.

8. International Data Transfers

Specira AI is based in Quebec, Canada. Some of our service providers may process your data in jurisdictions outside Canada, including the United States. When personal information is transferred outside of Quebec or Canada, we take steps to ensure it receives an adequate level of protection in accordance with applicable law.

For transfers from the EEA/UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or other appropriate transfer mechanisms under GDPR Chapter V. Canada has been recognized by the European Commission as providing an adequate level of data protection under GDPR.

For transfers outside Quebec under Law 25, we conduct privacy impact assessments before transferring personal information and ensure that the receiving jurisdiction provides adequate protection, or that appropriate contractual safeguards are in place.

9. Cookies and Tracking Technologies

Our website uses analytics and functionality cookies. We use Google Tag Manager to manage analytics tags, and Microsoft Clarity for behavioural analytics including heatmaps and session recordings. We do not use advertising cookies or share your data for cross-context behavioural advertising. Google reCAPTCHA Enterprise may set cookies when loaded on pages with contact forms. You can manage cookie preferences through your browser settings.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information in accordance with industry standards, including encryption in transit (TLS/HTTPS), access controls, regular security reviews, and privacy by design principles. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a security breach involving your personal information, we will notify the relevant authorities and affected individuals as required by law, including within 72 hours to the Commission d'acces a l'information du Quebec (Law 25), to the Office of the Privacy Commissioner of Canada (PIPEDA), and to the relevant supervisory authority under GDPR.

11. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Early access registrations: Retained until our service launches and you create an account, or until you request deletion.
• Contact form submissions: Retained for up to 24 months after the last interaction, then deleted or anonymized.
• Usage and analytics data: Retained in aggregate or anonymized form. Identifiable data is deleted within 14 months.

When personal information is no longer needed, we will securely delete or de-identify it in accordance with Law 25 de-identification requirements.

12. Your Privacy Rights

Depending on your jurisdiction, you have various rights regarding your personal information. We will respond to all verified requests within 30 days (or such shorter period as required by applicable law).

All Users

• Right of access: Request a copy of the personal information we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete information.
• Right to deletion: Request that we delete your personal information, subject to legal retention requirements.
• Right to withdraw consent: Withdraw your consent to processing at any time. This does not affect the lawfulness of processing performed before withdrawal.

Additional Rights under Canadian Law (PIPEDA and Law 25)

• Right to de-identification: Request that your personal information be de-identified rather than deleted, where applicable (Law 25).
• Right to be informed of automated decisions: Be informed if an automated decision is made about you and request a review by a qualified individual (Law 25).
• Right to data portability: Receive your personal information in a commonly used technological format (Law 25).
• Right to file a complaint: You may file a complaint with the Commission d'acces a l'information du Quebec or the Office of the Privacy Commissioner of Canada.

Additional Rights under GDPR (EEA/UK Residents)

• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including for direct marketing purposes.
• Right regarding automated decision-making: Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
• Right to lodge a complaint: File a complaint with your local data protection supervisory authority.

Additional Rights under CCPA/CPRA (California Residents)

• Right to know: Request details about the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes, and the categories of third parties with whom we share it.
• Right to delete: Request deletion of your personal information, subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt-out of sale or sharing: We do not sell your personal information or share it for cross-context behavioral advertising. As such, there is no need to opt out, but you may contact us to confirm this at any time.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined under the CCPA/CPRA.

To exercise any of these rights, contact our Privacy Officer at privacy@specira.ai. We may need to verify your identity before processing your request. We will not charge a fee for processing reasonable requests.

13. Do Not Sell or Share My Personal Information

Specira AI doesn't sell your personal information to third parties as defined under the CCPA/CPRA. We don't share your personal information for cross-context behavioral advertising. If our practices change in the future, we'll update this policy and provide a clear opt-out mechanism.

14. Privacy Impact Assessments

In accordance with Law 25, we conduct privacy impact assessments before implementing new information systems, technologies, or practices that involve the collection, use, or disclosure of personal information. We also conduct assessments before transferring personal information outside Quebec.

15. Children's Privacy

Our services are not directed to individuals under the age of 16. We don't knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@specira.ai and we will promptly delete it.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We'll notify you of material changes by posting the updated policy on this page with a revised effective date. For significant changes, we'll provide additional notice (such as via email to registered users). Your continued use of our website after the effective date constitutes acceptance of the updated policy.

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, contact us at:

Privacy Officer, Specira AI
Email: privacy@specira.ai
General inquiries: info@specira.ai
Website: www.specira.ai

You also have the right to lodge a complaint with your applicable data protection authority, including:

• Commission d'acces a l'information du Quebec (Quebec, Canada)
• Office of the Privacy Commissioner of Canada (Canada)
• Your local EU/EEA data protection supervisory authority (European Union)
• California Attorney General's Office (California, USA)

Effective date: February 27, 2026