Privacy policy

Fireweed AI ("Fireweed AI," "we," "our," or "us") is an Indigenous-led, federally incorporated Canadian company headquartered in Whitehorse, Yukon. Data sovereignty and responsible information governance are the foundation of our business, and that commitment extends to how we treat your personal information. This Privacy Policy explains what we collect when you visit our website or contact us, how we use it, and the choices and rights you have.

This Policy is provided in plain language and is intended to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable privacy law.

1. Scope of this Policy

This Policy applies to your use of our public website (fireweedai.ca) and your correspondence with us — for example, when you fill out a contact form, request a demo, or email us.

It does not govern data processed inside the Sovereign Institutional Intelligence System (SIIS) or any sovereign instance we operate for a client. Information handled within a deployed SIIS instance is governed by the separate written agreement between Fireweed AI and the institution that holds that instance, and by the data governance principles set out in that agreement. If you are an end user of a SIIS instance, please refer to your organization's agreement and policies.

2. Information we collect

Information you provide to us. When you contact us, request information, or otherwise correspond with us, we may collect your name, email address, organization, role, and any other details you choose to include in a form or message.

Information collected automatically. When you visit our website, we may collect limited technical and usage information, such as your IP address, browser type, device information, pages visited, referring page, and time spent on the site. We use cookies and similar technologies to operate the site, remember preferences, and understand how the site is used.

We do not seek to collect sensitive personal information through this website, and we ask that you not send us sensitive information (for example, health, financial account, or government identification numbers) through web forms or unencrypted email.

3. How we use your information

We use the information we collect to:

• respond to your inquiries and provide the information or follow-up you request;

• operate, maintain, secure, and improve our website;

• understand site usage and measure the effectiveness of our content;

• send updates or communications you have asked to receive, and which you can opt out of at any time; and

• meet our legal, regulatory, and contractual obligations.

We use your information only for the purposes identified at or before the time of collection, or for a use that is consistent with those purposes, unless we obtain your consent or are otherwise permitted or required by law.

4. Consent

By providing your information through this website or in correspondence, you consent to its collection, use, and disclosure as described in this Policy. For most website interactions we rely on your implied consent. Where the law requires express consent — for example, to send certain marketing communications — we will obtain it. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us using the details in Section 13. Withdrawing consent may affect our ability to provide certain information or services.

5. Cookies and analytics

Our website uses cookies and similar technologies to function properly and to help us understand how visitors use the site. You can usually control or disable cookies through your browser settings; disabling some cookies may affect how the site works. Where we use third-party analytics or hosting providers, those providers process data on our behalf under their own terms; we encourage you to review the providers listed in Section 7.

6. We do not sell your personal information

We do not sell or rent your personal information, and we never have. We do not trade your information to data brokers or advertising networks.

7. Service providers and disclosure

We may share your information with trusted service providers who help us operate our website and communicate with you — for example, website hosting, form processing, email, and analytics providers. These providers may only use your information to perform services for us and are required to protect it.

We may also disclose your information where we are required or permitted to do so by law, to comply with a valid legal process, or to protect our rights, safety, or property and those of others. We do not otherwise disclose your personal information to third parties without your consent.

8. Data residency and cross-border processing

Our SIIS platform is built for Canadian hosting under client-specific agreements; sovereign hosting arrangements for client instances are described in those agreements, not here.

Our public website and the third-party providers that support it may, depending on the provider, store or process limited website and contact-form data on servers located outside Canada. Where this occurs, your information may be subject to the laws of the jurisdiction in which it is stored, including lawful access requests by authorities there. We take reasonable steps to use reputable providers that apply appropriate safeguards. If you would prefer not to have your information processed outside Canada, please contact us before submitting it and we will tell you what options are available.

9. Indigenous data governance

Fireweed AI's approach to information is informed by Indigenous data sovereignty principles, including the OCAP® principles (Ownership, Control, Access, and Possession) and the CARE Principles for Indigenous Data Governance. These frameworks govern First Nations data and our client engagements through the agreements that establish each sovereign instance. While the personal information collected through this website is not "First Nations data" in that specific sense, the values behind those frameworks — respect for the people whose information we hold, and accountability for how it is used — guide how we treat all personal information.

OCAP® is a registered trademark of the First Nations Information Governance Centre. CARE is a framework of the Global Indigenous Data Alliance. References to these frameworks describe our approach and do not imply endorsement by, or affiliation with, those organizations beyond any relationship we separately disclose.

10. How we protect your information

We take reasonable administrative, technical, and physical measures to protect personal information against loss, theft, and unauthorized access, use, or disclosure, appropriate to the sensitivity of the information. No website or method of transmission over the internet is completely secure, however, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

11. Retention

We keep personal information only as long as necessary to fulfill the purposes for which it was collected, to maintain a reasonable business record, and to meet legal and regulatory requirements. When information is no longer needed, we take reasonable steps to securely delete or de-identify it.

12. Your rights

Subject to applicable law, you have the right to:

• access the personal information we hold about you;

• request correction of inaccurate or incomplete information;

• withdraw consent or opt out of marketing communications; and

• request deletion of your personal information, subject to legal and contractual obligations.

To exercise any of these rights, contact us using the details in Section 13. We will respond within the timeframes required by law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

13. Contact us and Privacy Officer

We have designated a Privacy Officer who is accountable for our compliance with this Policy. To ask a question, exercise a right, or make a complaint about your personal information, contact:

Privacy Officer — Fireweed AI Email: privacy@fireweedai.ca Whitehorse, Yukon, Canada

14. Third-party links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites, and this Policy does not apply to them. We encourage you to review the privacy policies of any site you visit.

15. Children

Our website and services are directed to organizations and adults, not to children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

16. Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will post the updated version here with a revised "Last updated" date. Material changes will be made clear. Your continued use of our website after an update takes effect means you accept the revised Policy.