Law 25 Privacy Notice

2. Our Role

Weblo is responsible for the personal information it collects for its own purposes, such as information about visitors to our website, people who request a demo or contact us, and users of our clients' accounts.

When we provide our AI employee services to property management companies, we process the personal information of their tenants, prospects, owners, and other contacts on their behalf, under a written contract, as permitted by section 18.3 of the Act. The property management company remains responsible for that information. We use it only to carry out our mandate, we protect it with appropriate security measures, and we refer any request about it to the company concerned while helping it respond.

3. Personal Information We Collect and Why

We determine the purposes for collecting personal information before we collect it, and we collect only the information necessary for those purposes.

• Contact and business information: Name, email address, phone number, company name, number of units managed, and property management software used, when you request a demo, book a meeting, or contact us. We use it to respond to you, schedule and conduct demos, and manage our business relationship.
• SMS consent information: Name, email address, phone number, and the date and method of your consent or opt-out. We use it to send the transactional text messages you agreed to receive and to keep proof of your choices.
• Client account information: Name, business contact details, login credentials, and account settings of our clients' users. We use it to create and manage accounts, authenticate users, provide support, and bill for our services.
• Communications processed for our clients: Caller phone numbers, call recordings, transcripts, text and email messages, maintenance requests, and appointment details. We use them only to provide our AI employee services as instructed by the property management company concerned.
• Voice demo audio: If you use the live voice demo on our website, your voice is processed in real time by our AI provider to generate the demo assistant's responses.
• Technical and usage information: IP address, browser and device type, pages visited, referring website, ad click identifiers, and cookie identifiers. We use it to operate and secure our website, understand how it is used, and measure the effectiveness of our advertising.

How We Collect It

We collect personal information directly from you (through our web forms, phone calls, text messages, and email), automatically through cookies and similar technologies when you use our website, and from our clients and the property management software they connect to our services.

4. Your Consent

When we need your consent, we ask for it in clear and simple terms, separately for each specific purpose and separately from any other information. Your consent must be manifest, free, and informed, and it is valid only for as long as necessary to achieve the purposes for which it was requested.

By providing your personal information after being informed of the purposes described in this notice, you consent to its use and communication for those purposes. We do not use your information for any other purpose without your consent, except where the Act allows it, for example for a purpose consistent with the one for which it was collected. We obtain your express consent before using sensitive personal information for any secondary purpose.

You may withdraw your consent at any time by contacting our person in charge of the protection of personal information or, for text messages, by replying STOP. Withdrawing your consent may limit our ability to provide certain services.

We do not knowingly collect personal information from minors under 14 years of age without the consent of the person having parental authority or the tutor.

6. Decisions Based on Automated Processing

Our services use artificial intelligence to answer calls and messages, create maintenance tickets, schedule appointments, and follow up with leads on behalf of our clients. If a decision about you is based exclusively on automated processing of your personal information, you will be informed of it no later than when you are informed of the decision.

On request, you may be informed of the personal information used to make the decision, the reasons and the principal factors and parameters that led to it, and your right to have the personal information used corrected. You may also submit observations to a member of our staff who is in a position to review the decision. When the decision is made for a property management company, that company is responsible for informing you, and we help it do so.

7. Who We Share Your Information With

We do not sell your personal information. We communicate it only to the following categories of third parties, and only as necessary for the purposes described in this notice:

• Service providers: Cloud hosting and infrastructure, AI model providers (OpenAI), telephony and SMS providers, email delivery (Resend), analytics (PostHog), and scheduling (Calendly). They act under written contracts that limit their use of your information to the services they provide to us and require them to protect it and notify us of any confidentiality incident.
• Our clients and their software: The property management company on whose behalf we process your information and, at its direction, the property management software it uses (such as AppFolio, Buildium, Yardi Breeze, Rentec Direct, or CondoManager).
• Advertising platforms: Meta and OpenAI, for the limited advertising measurement purposes described in section 5.
• Legal and business requirements: Public authorities when the law requires it and, in the case of a merger, acquisition, or other commercial transaction, the other party, under an agreement that protects your information as the Act requires.

Within Weblo, access to personal information is limited to the personnel who need it to perform their duties, such as our support, customer success, engineering, and sales teams.

8. Communication Outside Quebec

Your personal information may be communicated outside Quebec, including elsewhere in Canada and in the United States, where several of our service providers (such as OpenAI, Meta, PostHog, Resend, and Calendly) store or process data.

Before communicating personal information outside Quebec, we conduct a privacy impact assessment that considers the sensitivity of the information, the purposes for which it will be used, the protection measures (including contractual ones) that will apply, and the legal framework of the jurisdiction concerned. We communicate the information only if the assessment shows that it will receive adequate protection, and only under a written agreement. Information held outside Quebec may be subject to the laws of the jurisdiction where it is located.

9. Retention, Destruction, and Anonymization

We keep personal information only for as long as necessary to achieve the purposes for which it was collected, unless the law requires us to keep it longer. Once those purposes are achieved, we securely destroy the information or anonymize it to use it for serious and legitimate purposes, in accordance with generally accepted best practices and the Regulation respecting the anonymization of personal information.

Information we process on behalf of our clients is kept and destroyed in accordance with their instructions and our contracts with them. Our Privacy Policy describes our retention practices for each category of information.

10. Security and Confidentiality Incidents

We take security measures that are reasonable given the sensitivity, purpose, quantity, distribution, and medium of the personal information we hold. Our security program is aligned with the AICPA SOC 2 Trust Services Criteria, and our SOC 2 audit is currently in progress.

A confidentiality incident is any access, use, or communication of personal information that is not authorized by law, as well as its loss or any other breach of its protection. If we have reason to believe that an incident has occurred, we take reasonable measures to reduce the risk of injury and to prevent similar incidents. If the incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the persons concerned. We keep a register of all confidentiality incidents and provide it to the Commission on request.

If you believe your personal information has been compromised, please contact our person in charge of the protection of personal information immediately.

11. Privacy by Design

We conduct a privacy impact assessment for any project to acquire, develop, or overhaul an information system or electronic service delivery system that involves personal information. When our products offer privacy settings, they are set by default to provide the highest level of confidentiality, without any intervention on your part.

12. Your Rights

Under the Act, you have the following rights:

• Right to be informed: Know what personal information we hold about you, the categories of persons within Weblo who have access to it, how long we keep it, and how to contact our person in charge of the protection of personal information.
• Right of access: Obtain a copy of the personal information we hold about you.
• Right to portability: Receive the computerized personal information collected from you in a structured, commonly used technological format, or have it communicated to any person or body you designate.
• Right to rectification: Have inaccurate, incomplete, or equivocal information corrected, and have information deleted if it is outdated or if its collection, communication, or retention is not authorized by law.
• Withdrawal of consent: Withdraw your consent to the use or communication of your personal information at any time.
• Right to de-indexation: Ask us to stop disseminating your personal information or to de-index any hyperlink attached to your name that provides access to it, where its dissemination contravenes the law or a court order, or causes serious injury to your reputation or privacy, as provided in the Act.
• Automated decisions: Be informed of decisions based exclusively on automated processing and submit your observations to a person who can review them.
• Right to complain: File a complaint with us or with the Commission d'accès à l'information.

13. How to Exercise Your Rights

1. Send a written request to our person in charge of the protection of personal information by email at info@weblo.ai or by mail at the address above.
2. We may ask for information to verify your identity. Only you, or a person authorized to act on your behalf, may make a request about your personal information.
3. We respond in writing within 30 days of receiving your request. If we do not respond within that time, your request is deemed to have been refused. Access is free of charge; a reasonable fee may be charged for the transcription, reproduction, or transmission of information, and we will inform you of it in advance.
4. If we refuse your request, we will explain why, identify the provision of the Act on which the refusal is based, inform you of your recourse before the Commission d'accès à l'information and the time limit for exercising it, and help you understand our decision if you wish.
5. If your request concerns information we hold on behalf of a property management company, we will forward it to that company without delay and help it respond.

14. Complaints

If you have concerns about how we handle your personal information, send a written complaint to our person in charge of the protection of personal information. We will acknowledge receipt, review your complaint, and respond in writing within 30 days, explaining any measures taken.

If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec. If we refuse a request for access or rectification, you may also apply to the Commission for the examination of the disagreement within 30 days of our refusal.

15. Our Governance Policies and Practices

We have adopted policies and practices that govern how we handle personal information throughout its life cycle. They include:

• Roles and responsibilities for our personnel throughout the life cycle of personal information, from collection to destruction
• A framework for the retention and destruction of personal information
• A process for handling complaints about the protection of personal information
• A confidentiality incident response procedure and an incident register
• Privacy impact assessments for new projects and for communications outside Quebec
• Access controls that limit access to personal information to the personnel who need it
• Privacy and security training for our personnel

These policies and practices are approved by our person in charge of the protection of personal information and reviewed at least once a year.

16. Changes to This Notice

We will post any changes to this notice on this page and update the "Last Updated" date. We will inform you of significant changes through appropriate means, such as a notice on our website or an email. This notice is available in French and English.