Privacy Policy

Otomaton LLC, 312 W 2nd St Unit #A2299, Casper, WY 82601, United States (“Otomaton”, “we”).

For any question about this policy or to exercise your rights, write to the person in charge of the protection of personal information: privacy@otomaton.com.

• People who visit our website or write to us (demo requests, documents sent, contact form, newsletter sign-up).
• Client companies and the people who administer their account.
• Our clients’ employees who take training in an Otomaton training centre (“learners”).
• People whose information appears in the documents a client gives us to produce a course.

For our website, our sales enquiries and our relationships with our clients, Otomaton decides how the information is used and is responsible for it.

In the training centre, learners’ information belongs to their employer, our client. We process it on the client’s behalf, according to its instructions and our agreement with it. To exercise your rights over this information, contact your employer first; we will help them respond to you.

On our website

• What you give us in our forms: name, work email, company, number of employees, role, message, time chosen for a demo.
• Information you submit through our lead forms in Meta ads (Facebook and Instagram): name, email, phone number, company and role.
• The documents you send us for a demo or a production, and the topic you describe.
• Technical data: IP address and server logs, kept for security. Where applicable, and with your consent, data collected by cookies (see section 12).

For our clients

• The contact details of the people who administer the account, billing information and our correspondence.

In the training centre (on behalf of our clients)

• Name, login credentials (email, or employee number and PIN), group, job title, language.
• Progress through courses, quiz results, certificates, documents read and signed, recorded hands-on training, reminders sent.
• The activity logs that serve as proof of training (tamper-proof audit log).

In the documents our clients give us

• Procedures and documents may contain employees’ names or photos. We ask our clients to remove any personal information that is not needed for the training.

To produce certain courses

• The voice and image of the people who appear in a course, when the client chooses a generated voice or an avatar in their likeness. We collect them with the person’s consent and destroy them when the agreement ends. No voice or avatar is created in the likeness of a learner who is a minor.

• To respond to your requests and follow up with you — by email, phone call or text message —, prepare and hold a demo, and send you a proposal.
• Some calls may be recorded for training and quality purposes; we tell you at the start of the call.
• To produce and deliver the courses ordered.
• To provide the training centre: accounts, learning paths, reminders, certificates, training records, reports.
• To bill our clients and manage our relationship with them.
• To keep our services secure, prevent fraud and meet our legal obligations.
• To improve our services using aggregate statistics.
• Where applicable, and with your consent, to measure the effectiveness of our advertising.
• To send you our news, only if you have consented.

We do not sell personal information. We make no decision about you based exclusively on automated processing. We use artificial intelligence to produce training content, not to evaluate people.

We collect your information with your consent, or because it is needed for the service that you or your employer requested. Consent to receive our news is requested separately, with an unchecked box, and you can withdraw it at any time through the unsubscribe link or by writing to us. Non-essential cookies are only enabled with your consent (see section 12). For sensitive information, such as a person’s voice or image used to create a generated voice or an avatar, we obtain that person’s express consent.

• With your employer, if you are a learner: your employer sees your progress, results and certificates.
• With our service providers, only to the extent needed for their services: hosting and cloud computing; email and document storage; customer relationship management; payment processing; artificial intelligence tools used to produce the courses; audience measurement and advertising, where applicable, with your consent.
• With the authorities, when the law requires it.

Some of our service providers are located outside Quebec (see section 8). We only give them what is necessary, and we use commercial offerings whose contractual terms exclude the use of your content to train their models.

Your information may be hosted or communicated outside Quebec by our service providers. Before communicating information to them, we assess the privacy factors, including the sensitivity of the information, the purpose, the protection measures and the legal framework of the country, and we enter into a written agreement. The information may then be subject to the laws of those countries.

We protect information with measures suited to its sensitivity: encrypted communications, access limited to the people who need it, authentication, logging of access and changes, and backups. No system is perfectly secure; we continually correct and improve our measures.

We keep information for as long as needed for the purposes for which it was collected, then securely destroy or anonymize it:

• website enquiries: 36 months after the last interaction, then anonymized;
• documents sent only for a demo, with no follow-up: 12 months after the demo, then destroyed;
• documents sent for a production: destroyed after the delivered course is accepted;
• a client account’s data and its learners’ data: for the duration of the agreement, then 90 days to allow export, unless the client asks us to keep it longer for its own obligations;
• generated voices and avatars: until the agreement ends, then destroyed;
• newsletter subscription: until you unsubscribe, with proof of consent kept for 3 more years;
• billing information: as long as tax laws require;
• technical logs: 12 months.

By writing to the person in charge of the protection of personal information, you can:

• find out what information we hold about you and obtain a copy, including in a structured, commonly used technological format;
• have it corrected if it is inaccurate, incomplete or equivocal;
• withdraw your consent, subject to legal or contractual obligations;
• stop receiving our calls, emails or text messages at any time: reply STOP to a text message, use the unsubscribe link in an email, or write to us;
• ask us to stop disseminating information or to de-index a hyperlink, in the cases provided for by law;
• know what information is used for any decision based exclusively on automated processing (we make none).

We respond within 30 days of receiving your request, free of charge except where the law provides otherwise. We may need to verify your identity. If you are a learner, we forward your request to your employer and help them respond.

If you are not satisfied with our response, you can file a complaint with the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca) or, where PIPEDA applies, the Office of the Privacy Commissioner of Canada (www.priv.gc.ca). Elsewhere, you can contact the data protection authority in your country.

Our website may use cookies and similar technologies. Essential cookies are used for the operation and security of the website. Audience measurement and advertising cookies — including the Meta Pixel (Facebook and Instagram) and Google measurement tools — are only enabled with your consent, which you can withdraw at any time through “Manage cookies” in the footer, your browser settings or your Meta ad preferences.

If a confidentiality incident occurs (unauthorized access, use or communication, or loss of information), we promptly take steps to reduce the risk of harm. If it presents a risk of serious injury, we notify the Commission d’accès à l’information and the people concerned. We keep a register of all incidents. If an incident affects a client’s data, we notify the client without delay.

Our services are intended for businesses. Learners aged 14 to 17 may take training at their employer’s request. The training centre is not offered to people under 14. For these learners, we only collect the information needed for their training, and no voice or avatar is created in their likeness.

We serve businesses around the world. When other laws apply to your information, for example the General Data Protection Regulation (GDPR) in the European Union, you have the rights they provide, in addition to those described here. Write to the person in charge to exercise them.

Our governance rules frame the protection of personal information throughout its life cycle. They provide in particular for:

• the roles and responsibilities of our staff, under the authority of the person in charge of the protection of personal information;
• complaint handling: any complaint can be sent to privacy@otomaton.com; we acknowledge receipt and respond in writing within 30 days;
• the retention and destruction of information, according to the periods in section 10;
• privacy awareness for our staff;
• a privacy impact assessment before any new technology project or any communication outside Quebec;
• a register of confidentiality incidents (section 13).

We publish any change to this policy here, with its date. If a significant change affects the use of your information, we will let you know by appropriate means.

Otomaton LLC · 312 W 2nd St Unit #A2299, Casper, WY 82601 · privacy@otomaton.com
Person in charge of the protection of personal information: privacy@otomaton.com