Privacy Policy
Effective October 15, 2026 · Last Updated October 15, 2026
This Privacy Policy describes how Noticia Solutions Inc. (“Noticia”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards information in connection with the Claira platform and related services (the “Service”) and our websites (the “Website”). Noticia is an Ontario corporation.
This Privacy Policy applies to all users of the Service, including administrators, authorized users, and visitors to claira.to and associated websites. Sections 14 to 19 contain additional information for individuals in Canada (including Québec), the European Economic Area, the United Kingdom and Switzerland, the United States, Brazil, Mexico and Latin America, and Australia and New Zealand.
Our use of cookies and similar technologies on the Website is explained in more detail in our Cookie & Tracking Policy. Residents of the United States can also exercise their opt-out choices on our Your Privacy Choices page.
By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.
1. Scope
This Privacy Policy covers information collected through: the Claira web application at claira.to; the Claira extension for Nuix Discover; Claira integrations within third-party platforms; our support, billing, and marketing communications; our websites, including claira.to and its regional and language versions, and support.claira.to; and “Ask Claira”, the conversational assistant on our Website.
Organizations that subscribe to the Service (“Customers”) submit documents and content to the Service for review. We process that content on the Customer’s behalf, as described in Section 4.
This Privacy Policy does not cover third-party websites, platforms, or services that may be linked from or integrated with the Service. We are not responsible for the privacy practices of third parties.
2. Information We Collect
2.1 Account and Contact Information. When a Customer account is created or a user is provisioned, we may collect: name, email address, and job title; organization name and billing address; phone number (if provided); and account credentials and authentication tokens.
2.2 Billing Information. We collect billing details necessary to process payments, including billing contact name and address, and payment method details (processed and stored by our third-party payment processor; we do not store full credit card numbers).
2.3 Usage Data. We automatically collect information about how the Service is accessed and used, including: case activation and deactivation events; document processing volumes and credit consumption; feature usage patterns and frequency; timestamps and session duration; browser type, device type, operating system, and IP address; and error logs and performance data.
2.4 Customer Data (Documents and Content). Customers may submit documents and content to the Service for AI-assisted review and analysis. Our handling of Customer Data is governed by strict principles described in Section 4 below. Customer Data is processed solely to deliver the Service and is not retained, stored, or used for any other purpose.
2.5 Communications. We collect information you provide when you contact our support team, respond to surveys, or communicate with us through any channel.
2.6 Website Forms, Sign-ups, Demo Bookings, and Newsletter. When you submit a form on the Website, such as a request for a demo case, a request for an on-site visit, a partner inquiry, or a request to join our MCP waitlist, we collect the information you enter, such as your name, business email address, organization, job title, country, and message. Form submissions are processed by Formspree (United States), a form-processing service that delivers them to our team by email. When you sign up for Claira on the Website, with Google, with Microsoft, or with your work email, we collect your email address, your name as your Google or Microsoft account provides it, the data residency region you choose, and whether you already use Nuix Discover, and we keep them in our own sign-up database on Google Cloud in Montréal, Canada. When you book a demo, we collect the date and time you choose and any details you provide with your booking, and we schedule it through Calendly (United States). When you ask us to email you the one-page memo from our home page, we write it from the figures you entered and send it with Loops (United States). When you subscribe to our newsletter, your email address and any other details you choose to provide are sent to Loops (United States), the email platform we use to send newsletters, together with information about when and where you subscribed.
We also record each of these requests, sign-ups, bookings, and subscriptions in HubSpot (United States), the customer relationship management (CRM) platform we use to manage inquiries and business relationships. With it we record the Website page you used, the regional and language version of the Website, and, when we know it, how your visit reached the Website: the referring website, the campaign tags in the link you followed, and whether you arrived from one of our ads. If you allow marketing technologies, your browser keeps that information for as long as the tab is open, and we send HubSpot its cookie identifier with your request so that HubSpot can link the visits its tracking code recorded to your contact record. For a memo, we record the figures you entered but not the matter name.
2.7 Ask Claira. Our Website offers “Ask Claira”, an AI-powered chatbot that answers questions about Claira. Ask Claira is provided by Chatbase (United States) and is embedded on our chat page only. When you use it, the content of your conversation (your messages and the chatbot’s answers) and technical information about the session, such as your IP address and browser type, are collected and processed by Chatbase and by the large language model provider that Chatbase uses to generate answers. Chatbase stores a random identifier in your browser to keep your conversation together, and may store other information within the chatbot (see our Cookie & Tracking Policy). So that Ask Claira can answer for the regional and language version of the Website you are viewing, we tell Chatbase that version’s market, language, currency, and data residency region; this is not information about you. If you choose to provide contact details in the chat, for example to be contacted by our team, those details may be passed to HubSpot as a sales lead so that we can follow up. Ask Claira is an automated assistant: its answers may be incomplete or inaccurate and are not legal advice. Please do not enter confidential information, client or case information, or sensitive personal information in the chat.
2.8 Website Technical Data. When you visit the Website, our hosting provider automatically receives the technical information your browser sends with every request, such as your IP address, browser type, device type, operating system, referring page, the pages requested, and the date and time of the request. We use your IP address to determine your approximate country (and, where available, your region) so that we can suggest a regional version of the Website and apply the appropriate cookie-consent model. We do not store your IP address in your consent record.
2.9 Cookies and Tracking Technologies. Our websites and web application may use cookies, local storage, and similar technologies to authenticate users and maintain sessions, remember preferences and settings (such as your chosen region and language and your cookie choices), analyze traffic and usage patterns, measure the effectiveness of our marketing, and support security and fraud prevention. On the Website, these include:
- Strictly necessary cookies set by us to remember your cookie choices and your chosen region and language;
- Analytics technologies: Google Analytics 4 (Google LLC), which measures how the Website is used, and Microsoft Clarity (Microsoft Corporation), which produces heatmaps and session replays showing how visitors click, scroll, and navigate on our pages;
- Marketing technologies: the HubSpot tracking code (HubSpot, Inc.), which records visits to the Website and can link them to a contact record if you submit a form; the Apollo.io website tracker, which identifies the organization associated with a visitor’s IP address and adds company-level (firmographic) information; the LinkedIn Insight Tag, which measures conversions from our LinkedIn advertising and helps us build advertising audiences; and Google Ads (Google LLC), which does the same for our advertising on Google.
Analytics and marketing technologies are used only in accordance with your choices, as described in our Cookie & Tracking Policy. Some pages also include embedded content from third parties that may use their own cookies or browser storage: YouTube videos, which load only when you press play; and the Ask Claira chatbot (Chatbase), on our chat page only. You can change your choices at any time using “Cookie preferences” in the Website footer. You may also control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Website or the Service.
2.10 Information From Other Sources. We may receive information about you from: your organization, when a Customer administrator provisions you as an authorized user; Apollo.io, which provides company-level information (such as company name, industry, size, and location) about organizations whose networks are used to visit our Website, if marketing technologies are enabled; LinkedIn, which provides us with aggregated reports about the performance and audiences of our advertising (LinkedIn does not identify individual members to us); and HubSpot, which may associate Website activity recorded by its tracking cookie with your contact record after you submit a form.
3. How We Use Information
We use the information we collect for the following purposes: providing, operating, and maintaining the Service; processing transactions and sending billing-related communications; authenticating users and managing accounts; providing customer support; monitoring usage for billing, capacity planning, and service improvement; generating aggregated, anonymized analytics and benchmarks (which never include Customer Data or information that could identify a Customer or its clients); communicating product updates, new features, and service-related notices; marketing and promotional communications (with the ability to opt out); enforcing our Terms of Use and protecting the security of the Service; and complying with applicable law and responding to lawful requests.
In connection with the Website, we also use information to: operate the Website and remember your region, language, and cookie choices; respond to inquiries, demo and on-site visit requests, partner inquiries, waitlist sign-ups, demo bookings, and requests made through Ask Claira, and follow up with prospective customers; provide the Ask Claira assistant and review conversations to improve its answers and our Website content; measure and analyze how the Website is used and improve it; measure the effectiveness of our advertising, identify the organizations that visit our Website, and show our advertising to relevant audiences on LinkedIn and Google; and keep records of consent and privacy choices.
We send marketing emails only with your express consent, as required by Canada’s Anti-Spam Legislation (CASL) and other applicable laws, and every marketing email includes an unsubscribe link.
We do not make decisions about you based exclusively on automated processing that produce legal effects or similarly significantly affect you.
4. Customer Data: Processing, Retention, and Security
4.1 Document Content and Results Are Not Kept. Customer Data submitted for AI review is processed in real time. Documents are transmitted to the AI model, a response is generated, and the result is written to the Customer’s environment. Noticia keeps no copy of the document content or of the result once processing is complete, and does not index either. During a large bulk review, the instructions the Customer wrote for that review (never the documents) may be held with the model provider, encrypted and in the Customer’s region, until the review ends and for no more than one hour after they were last used.
Some features exist so that users can keep their work, and they keep what a user creates with them: Agent Mode conversations and the files attached to them; the Insights, Case Context and early case assessments a user generates, with the field values or statistics they were generated from; the prompts a user writes; and feedback a user sends about a response. Noticia stores this content in the Customer’s region and deletes it after the user deletes it or when the Customer deletes the case’s data. Privacy and Security in the Claira help centre lists what each feature keeps.
Operational metadata, including billing records, scan history, and configuration data, is stored as necessary to operate the Service.
4.2 No Model Training. Customer Data is never used to train, fine-tune, retrain, or otherwise improve any machine learning or AI model. Each processing interaction is ephemeral and isolated.
4.3 No Secondary Use. Customer Data is not used for analytics, benchmarking, product development, or any purpose other than delivering the Service to the Customer that submitted it.
4.4 Data Residency and Infrastructure. Customers choose where the Service processes their Customer Data: Canada, the United States, the United Kingdom, the European Union, Brazil, or Australia. Customers in the United Kingdom may choose either the United Kingdom or the European Union. Customer Data submitted for AI review is processed in the region selected by the Customer. Customer Data in transit is encrypted using industry-standard protocols (TLS 1.2 or higher). For Customers accessing the Service through Nuix Discover, the document security policies of the Customer’s Nuix environment continue to apply.
4.5 Sub-Processors. Customer Data may be processed by third-party infrastructure and model providers as necessary to deliver the Service. These sub-processors are contractually bound to obligations of confidentiality and data protection consistent with this Privacy Policy. Noticia selects sub-processors that offer zero data retention and no model training on customer inputs. A current list of sub-processors is available upon request.
4.6 Our Role. When we process Customer Data, we act on behalf of the Customer, as its service provider (a “processor” under some laws). The Customer decides what Customer Data to submit and is responsible for its own obligations to the individuals whose information appears in it. If your personal information is contained in documents submitted by a Customer and you wish to exercise your privacy rights, please contact that Customer. We will assist the Customer as required by applicable law and our agreement with it. For all other personal information described in this Privacy Policy, such as Website, account, billing, and usage information, Noticia is the organization responsible (the “controller” under some laws).
5. How We Share Information
We do not sell personal information for money, and we never sell Customer Data or use it for advertising. However, if you allow marketing technologies on our Website (or, in the United States, do not opt out of them), the LinkedIn Insight Tag, Google Ads, the Apollo.io website tracker, and the HubSpot tracking code may be considered “sharing” of personal information for cross-context behavioural advertising, and under some US state laws a “sale”. See Section 16 and our Your Privacy Choices page to opt out.
We may share information in the following limited circumstances: with service providers and sub-processors that perform functions on our behalf (payment processing, hosting, form processing, customer relationship management, meeting scheduling, email delivery, analytics, and the Ask Claira chatbot), subject to confidentiality obligations; with advertising and marketing partners, in accordance with your cookie choices, as described in our Cookie & Tracking Policy; with Customer’s organization administrators, who may have visibility into account activity and usage; to comply with applicable law, regulation, legal process, or enforceable governmental request; to enforce our Terms of Use or protect the rights, property, or safety of Noticia, our users, or others; in connection with a merger, acquisition, or sale of all or substantially all of our assets, in which case affected users will be notified; and with Customer’s consent or at Customer’s direction.
The main service providers and partners that receive personal information in connection with the Website are:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Google LLC) | Hosting of the Website, its content management system, and its sign-up database | Montréal, Canada |
| HubSpot, Inc. | CRM (requests, sign-ups, demo bookings, and subscriptions made on the Website, and leads from Ask Claira) and HubSpot tracking code (marketing) | United States |
| Calendly, LLC | Scheduling demo bookings | United States |
| Formspree, Inc. | Website form processing (demo-case, on-site visit, partner and MCP waitlist forms) | United States |
| Loops | Newsletter subscriptions and emails | United States |
| Google LLC | Google Analytics 4 (analytics); Google Ads (advertising measurement and audiences); YouTube (embedded videos, loaded only when you press play) | United States |
| Chatbase | Ask Claira chatbot. Conversations are also processed by the large language model provider that Chatbase uses | United States |
| Microsoft Corporation | Microsoft Clarity (analytics, heatmaps, and session replay) | United States |
| LinkedIn Insight Tag (advertising measurement and audiences) | United States and Ireland | |
| Apollo.io | Identification of visiting organizations (marketing) | United States |
Providers may also process information in other locations where they or their sub-processors operate. Information about the sub-processors that process Customer Data is available upon request (see Section 4.5).
6. Data Retention
Account and contact information is retained for the duration of the Customer relationship and for a reasonable period thereafter for legal and business purposes. Billing records are retained as required by applicable tax and financial reporting obligations. Usage data is retained in aggregated or anonymized form for analytics and capacity planning; identifiable usage data is retained for a reasonable period and then deleted. Customer document content and review results are not retained after processing, and content a user chooses to keep is retained until it is deleted (see Section 4.1). Operational metadata such as billing records, scan history, and configuration is retained as needed to operate and support the Service. Communications are retained for a reasonable period to support ongoing service delivery.
For Website information, the following periods apply:
| Information | Retention period |
|---|---|
| Website form submissions and CRM records | In Formspree: 24 months after submission. In our CRM: for as long as needed to respond to your request and manage our business relationship; records of prospective customers with no activity are deleted or anonymized 24 months after the last interaction |
| Sign-ups to Claira (the sign-up database) | No set end date: these are the records of the people who signed up for the Service. We delete a sign-up record when you ask us to |
| Newsletter subscriptions | Until you unsubscribe. After you unsubscribe, we keep your email address on a suppression list so that we do not email you again, and we keep records of your consent for as long as necessary to demonstrate compliance with CASL and other applicable laws |
| Ask Claira conversations | 24 months. Contact details sent to HubSpot follow the CRM retention period above |
| Consent records (random consent ID, choices, date and time, policy version, and country or region) | 3 years, as proof of consent |
| claira_consent cookie | 13 months |
| claira_market cookie | 12 months |
| Google Analytics cookies | Up to 13 months |
| Google Analytics event data | 2 months; aggregated reports may be kept longer |
| Microsoft Clarity data | 30 days for session recordings and 13 months for heatmaps |
| Other analytics and marketing cookies | As described in our Cookie & Tracking Policy (up to approximately 2 years) |
| Server and security logs | 30 days |
When information is no longer needed, we delete it or anonymize it so that it can no longer identify you.
7. Security
We implement administrative, technical, and physical safeguards designed to protect the information we collect and process. These include encryption of data in transit (TLS 1.2+), access controls and authentication mechanisms, regular security assessments and vulnerability management, logging and monitoring of access to production systems, and incident response procedures.
If a security incident involving personal information occurs, we will notify affected individuals, Customers, and regulators where required by applicable law.
No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.
8. Where We Process Information and International Transfers
8.1 Website. The Website and its content management system are hosted on Google Cloud in Montréal, Canada. Some of the tools we use on the Website are operated by providers in the United States, as listed in Section 5: HubSpot (CRM and marketing tracking), Calendly (demo bookings), Formspree (forms), Loops (newsletter and memo emails), Chatbase (the Ask Claira chatbot, which processes conversations in the United States together with its large language model provider), Google (Google Analytics, Google Ads, and YouTube), Microsoft (Clarity), LinkedIn, and Apollo.io.
8.2 Service. Customer Data is processed in the region selected by the Customer, as described in Section 4.4.
8.3 Account, Billing, and Support Information. Account information, billing data, operational metadata, and support communications are managed by Noticia from Canada and may be accessed by Noticia personnel in Canada and by our service providers.
8.4 Safeguards. When personal information is transferred to or accessed from another jurisdiction, it is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement, and national security authorities. We use contractual and other measures to require our service providers to protect personal information in a manner consistent with this Privacy Policy and applicable law. Sections 14 to 19 describe the additional safeguards that apply to transfers of information about individuals in specific jurisdictions.
9. Your Rights and Choices
Depending on your jurisdiction, you may have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion of your personal information, subject to legal and contractual obligations; object to or restrict certain processing activities; receive your information in a portable format; and withdraw consent where processing is based on consent. Sections 14 to 19 describe the rights available in specific jurisdictions.
To exercise any of these rights, contact us at support@claira.to. We will respond within the timeframe required by applicable law. We may need to verify your identity before responding, and we will use the information you provide in a request only to verify your identity and respond to it. We do not charge a fee for requests unless permitted by applicable law. If your request concerns Customer Data, we will refer you to the relevant Customer (see Section 4.6).
You can also:
- Change your cookie choices at any time using “Cookie preferences” in the Website footer;
- Unsubscribe from marketing emails using the link in any marketing email, or by contacting us; we will process your request within 10 business days. We may still send you service-related and billing communications;
- Opt out of the sale or sharing of personal information and targeted advertising (United States) on our Your Privacy Choices page. We also honour Global Privacy Control signals, as described in Section 16.
For Customers subject to Canadian privacy legislation (including PIPEDA and Québec’s Law 25), we are committed to handling all requests in accordance with applicable requirements.
10. Children
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on our website and, where appropriate, by email. The “Last Updated” date at the top of this Privacy Policy shows when it was last changed. Continued use of the Service following notification constitutes acceptance of the updated policy. Where applicable law requires your consent to a change, we will ask for it.
12. Contact
If you have questions or concerns about this Privacy Policy or our data practices, contact:
- Noticia Solutions Inc.
- Address: 333 Preston Street, Suite 120, Ottawa, Ontario K1S 5N4, Canada
- Email: support@claira.to
- Website: https://claira.to
Privacy Officer. Lucas Fraser, Chief Technology Officer, is our Privacy Officer. He is the person in charge of the protection of personal information under Québec law, our Data Protection Officer for the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and our Data Protection Officer (Encarregado) under Brazil’s General Data Protection Law (LGPD). You can contact him at support@claira.to, with “Attention: Privacy Officer” in the subject line.
13. Complaints
If you have a concern about how we handle personal information, please contact our Privacy Officer first at support@claira.to. We will investigate and respond to every complaint.
If you are not satisfied with our response to a privacy inquiry, you may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca or, if applicable, the Commission d’accès à l’information du Québec at https://www.cai.gouv.qc.ca. Individuals in other jurisdictions may also contact the authorities listed in Sections 15 to 19.
14. Canada (Including Québec)
14.1 Accountability. Noticia is responsible for the personal information under its control. Our Privacy Officer, Lucas Fraser, Chief Technology Officer, is accountable for our compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, under Québec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), has been delegated the function of person in charge of the protection of personal information. He can be reached at support@claira.to.
14.2 Consent. We obtain consent in a form appropriate to the sensitivity of the information and the circumstances. We obtain express consent for marketing emails and, on the Website, for analytics and marketing technologies. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. We will explain the consequences of withdrawing consent, for example that we may no longer be able to provide the Service if the information is necessary to provide it.
14.3 Access and Correction. You may ask to access the personal information we hold about you and to have it corrected if it is inaccurate or incomplete. We will respond within 30 days, unless the law allows us to extend this period, in which case we will tell you. If we refuse a request, we will explain why, except where the law prevents us from doing so, and tell you about the recourses available to you.
14.4 Rights Under Québec Law. If you are in Québec, you have the right to:
- be informed, when your information is collected, of the purposes and means of collection, your rights of access and rectification, your right to withdraw consent, the third parties or categories of third parties to whom it is necessary to communicate your information, and the possibility that it may be communicated outside Québec (this Privacy Policy provides this information);
- access your personal information and have it rectified if it is inaccurate, incomplete, or equivocal, or deleted if its collection, communication, or keeping is not authorized by law;
- withdraw your consent to the communication or use of your personal information;
- receive computerized personal information collected from you (but not information created or inferred from it) in a structured, commonly used technological format, or have it communicated to any person or body you designate (data portability);
- ask us to stop disseminating your personal information or to de-index any hyperlink attached to your name that provides access to it, where the conditions set out by law are met;
- be informed when a decision about you is based exclusively on automated processing, and, on request, be informed of the personal information used to make the decision, the reasons and principal factors that led to it, and your right to have the personal information corrected, and to submit observations to a member of our staff who can review the decision. We do not currently make decisions based exclusively on automated processing; and
- be informed when we use technology that allows you to be identified, located, or profiled, and of the means available to deactivate those functions. On the Website, the analytics and marketing technologies that have these functions are deactivated by default for visitors outside the United States, including in Québec, and are activated only if you consent. You can deactivate them at any time using “Cookie preferences” in the Website footer.
We respond to written requests within 30 days. Access is free of charge, although a reasonable fee may be charged for the transcription, reproduction, or transmission of information, in which case we will tell you the amount in advance.
14.5 Communication Outside Québec. Personal information may be communicated outside Québec: to other Canadian provinces; to the United States, where HubSpot, Formspree (forms), Loops, Chatbase and its large language model provider (Ask Claira), Google (Google Analytics, Google Ads, and YouTube), Microsoft, LinkedIn, and Apollo.io process it; and, for Customer Data, to the region selected by the Customer. Before communicating personal information outside Québec, we conduct a privacy impact assessment that takes into account the sensitivity of the information, the purposes for which it will be used, the protection measures (including contractual measures) that will apply to it, and the legal framework applicable in the destination jurisdiction, including its data protection principles. We communicate the information only if the assessment establishes that it would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information, and only under a written agreement that takes into account the results of the assessment.
14.6 Confidentiality Incidents. We keep a register of confidentiality incidents and of breaches of security safeguards. If an incident presents a risk of serious injury, or a real risk of significant harm, to the individuals concerned, we notify them and report the incident to the Commission d’accès à l’information du Québec and the Office of the Privacy Commissioner of Canada, as applicable.
14.7 Governance. We have established policies and practices governing personal information, approved by our person in charge of the protection of personal information. They set out the roles and responsibilities of our personnel throughout the life cycle of personal information, the rules for its retention and destruction, and a process for handling complaints. This Privacy Policy summarizes them. We conduct privacy impact assessments for projects to acquire, develop, or overhaul information systems or electronic service delivery systems that involve personal information.
14.8 Commercial Electronic Messages. We send commercial electronic messages only with your express consent or as otherwise permitted by CASL. Every message identifies Noticia, includes our contact information, and contains an unsubscribe mechanism. We give effect to unsubscribe requests within 10 business days.
14.9 Complaints. You may file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca or, if you are in Québec, with the Commission d’accès à l’information du Québec at https://www.cai.gouv.qc.ca.
15. European Economic Area, United Kingdom, and Switzerland
This Section applies if you are in the European Economic Area (EEA), the United Kingdom, or Switzerland.
15.1 Controller. The controller of your personal information is Noticia Solutions Inc., 333 Preston Street, Suite 120, Ottawa, Ontario K1S 5N4, Canada, support@claira.to. For Customer Data, Noticia acts as a processor on behalf of the Customer, which is the controller (see Section 4.6).
15.2 Representatives. Our representative in the European Union under Article 27 of the GDPR is Lucas Fraser, Noticia Solutions Inc., 333 Preston Street, Suite 120, Ottawa, Ontario K1S 5N4, Canada, support@claira.to. Our representative in the United Kingdom under Article 27 of the UK GDPR is Lucas Fraser, Noticia Solutions Inc., 333 Preston Street, Suite 120, Ottawa, Ontario K1S 5N4, Canada, support@claira.to. You may contact our representatives, in addition to or instead of us, about any matter relating to the processing of your personal information.
15.3 Data Protection Officer. Our Data Protection Officer is Lucas Fraser, who can be reached at support@claira.to.
15.4 Purposes and Legal Bases. We process personal information for the following purposes and on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing and operating the Service, managing accounts, and authenticating users | Performance of a contract (Art. 6(1)(b)) where you are the contracting party; otherwise our legitimate interests in providing the Service to our Customers and their authorized users (Art. 6(1)(f)) |
| Billing, payment, and keeping accounting records | Performance of a contract (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)) |
| Customer support and service-related communications | Performance of a contract (Art. 6(1)(b)); legitimate interests in supporting our Customers (Art. 6(1)(f)) |
| Operating and securing the Website, and remembering your region, language, and cookie choices (strictly necessary cookies) | Legitimate interests in providing a functioning and secure Website (Art. 6(1)(f)) |
| Keeping records of consent | Compliance with the legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1)); legitimate interests (Art. 6(1)(f)) |
| Analytics technologies, including cookies and session replay (Google Analytics 4, Microsoft Clarity) | Consent (Art. 6(1)(a)) |
| Marketing technologies (HubSpot tracking code, Apollo.io, LinkedIn Insight Tag, Google Ads) | Consent (Art. 6(1)(a)) |
| Responding to form submissions, demo and on-site visit requests, partner inquiries, waitlist sign-ups, demo bookings, and requests to be contacted | Steps taken at your request before entering into a contract (Art. 6(1)(b)); legitimate interests in responding to business inquiries (Art. 6(1)(f)) |
| Providing Ask Claira and reviewing conversations to improve its answers | Legitimate interests in answering the questions you ask and improving our answers and Website content (Art. 6(1)(f)) |
| Newsletter and other marketing emails | Consent (Art. 6(1)(a)) |
| Aggregated, anonymized analytics and benchmarks; service improvement; capacity planning | Legitimate interests in improving and planning our Service (Art. 6(1)(f)) |
| Security, fraud prevention, and enforcing our Terms of Use | Legitimate interests in protecting our Service, users, and business (Art. 6(1)(f)) |
| Complying with the law and responding to lawful requests | Compliance with legal obligations (Art. 6(1)(c)); legitimate interests in complying with other laws that apply to us (Art. 6(1)(f)) |
| Corporate transactions such as a merger or acquisition | Legitimate interests in carrying out and completing the transaction (Art. 6(1)(f)) |
References to articles are to the GDPR and, for the United Kingdom, the corresponding articles of the UK GDPR. Where we rely on legitimate interests, you may ask us for more information about how we balanced our interests against your rights. You are not required to provide personal information to browse the Website; if you do not provide contact details, we cannot respond to your request. Account information is necessary to use the Service.
15.5 Your Rights. You have the right to: access your personal information; have it rectified; have it erased; restrict its processing; receive it in a structured, commonly used, and machine-readable format and have it transmitted to another controller (portability); object to processing based on our legitimate interests on grounds relating to your particular situation; object at any time to processing for direct marketing; and withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We respond to requests within one month, which may be extended by up to two further months where necessary, in which case we will tell you. To exercise your rights, contact support@claira.to or our representatives.
15.6 International Transfers. We are located in Canada. The European Commission has recognized Canada as providing an adequate level of protection for personal information subject to PIPEDA, and the United Kingdom and Switzerland recognize Canada as adequate. Transfers of your personal information to us in Canada rely on these adequacy decisions. When personal information is transferred to service providers in the United States or other countries without an adequacy decision, we rely on: the EU-U.S. Data Privacy Framework, its UK Extension, or the Swiss-U.S. Data Privacy Framework, where the recipient is certified under them; or otherwise the European Commission’s standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum to the standard contractual clauses, and the standard contractual clauses as recognized by the Swiss Federal Data Protection and Information Commissioner, together with supplementary measures where appropriate. Customers who select the European Union or the United Kingdom as their data residency region have Customer Data processed in that region (see Section 4.4). You may request a copy of the relevant safeguards by contacting support@claira.to.
15.7 LinkedIn Insight Tag. For information collected through the LinkedIn Insight Tag from visitors in the EEA, the United Kingdom, and Switzerland, LinkedIn Ireland Unlimited Company and Noticia may act as joint controllers for the collection and transmission of that information to LinkedIn. LinkedIn is responsible for its subsequent processing, as described in the LinkedIn Privacy Policy. You may exercise your rights with us or with LinkedIn; we will forward to LinkedIn any request concerning LinkedIn’s processing.
15.8 Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. A list of EEA supervisory authorities is available on the European Data Protection Board’s website at https://www.edpb.europa.eu. In the United Kingdom, you may complain to the Information Commissioner’s Office at https://ico.org.uk; we will acknowledge any complaint you send us within 30 days. In Switzerland, you may complain to the Federal Data Protection and Information Commissioner at https://www.edoeb.admin.ch.
16. United States
This Section supplements this Privacy Policy for residents of California and other US states with comprehensive consumer privacy laws, to the extent those laws apply to us. It does not apply to Customer Data, which we process as a service provider on behalf of our Customers.
16.1 Personal Information We Collect and Disclose. The table below describes the categories of personal information we collect, their sources, and the categories of recipients to whom we disclose them. We use each category for the business and commercial purposes described in Section 3.
| Category | Examples | Sources | Disclosed for a business purpose to | Sold or shared to |
|---|---|---|---|---|
| Identifiers | Name, email address, postal address, account username, IP address, cookie and online identifiers | You; your device; your organization | Service providers (hosting, form processing, CRM, email, analytics, Ask Claira, payment processing); your organization’s administrators; professional advisors | Advertising and marketing partners (LinkedIn, Apollo.io, HubSpot tracking code): IP address and online identifiers |
| Customer records | Name, address, phone number, billing information | You; your organization | Service providers, including our payment processor | Not sold or shared |
| Commercial information | Subscriptions, Cases activated, document volumes, credit consumption, purchase history | Your use of the Service | Service providers; your organization’s administrators | Not sold or shared |
| Internet or other electronic network activity | Pages viewed, clicks, scrolling and navigation (including session replays), referring pages, interactions with our emails, Service usage data | Your device; your use of the Service | Service providers (analytics, CRM, email) | Advertising and marketing partners: browsing activity on our Website |
| Approximate geolocation | Country, region, or city derived from your IP address | Your device | Service providers | Advertising and marketing partners |
| Electronic information | Content of Ask Claira conversations and support communications | You | Service providers (Ask Claira, CRM) | Not sold or shared |
| Professional or employment-related information | Job title, organization, company-level information about your employer | You; your organization; Apollo.io | Service providers | Not sold or shared |
| Inferences | Your likely organization and interest in our products, based on your Website activity | Derived from the categories above; Apollo.io; LinkedIn | Service providers | Advertising and marketing partners |
| Sensitive personal information | Account log-in credentials | You; your organization | Service providers (hosting and authentication) | Not sold or shared |
We retain each category of personal information for the periods described in Section 6.
16.2 Sensitive Personal Information. We collect account log-in credentials only to authenticate users and secure the Service. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use under California law.
16.3 Sale, Sharing, and Targeted Advertising. We do not sell personal information for money. When marketing technologies are active on our Website, the LinkedIn Insight Tag, Google Ads, the Apollo.io website tracker, and the HubSpot tracking code collect your IP address, online identifiers, and browsing activity on our Website. This may constitute “sharing” of personal information for cross-context behavioural advertising under California law, and a “sale” of personal information or processing for “targeted advertising” under the laws of other states. In the United States, these technologies are active by default, and you have the right to opt out:
- use the Manage cookie preferences button on our Your Privacy Choices page, or “Cookie preferences” in the Website footer; or
- enable Global Privacy Control (GPC) in your browser or browser extension. We treat a GPC signal as a valid request to opt out of the sale and sharing of your personal information and of targeted advertising, and we automatically turn marketing technologies off for that browser.
Your choice applies to the browser and device you use. If you would also like us to apply your opt-out to information associated with your email address in our records, contact support@claira.to with the subject “Do Not Sell or Share”. We do not knowingly sell or share the personal information of consumers under 16 years of age.
16.4 Your Rights. Depending on your state of residence, you may have the right to:
- Know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting, selling, or sharing it, and the categories of third parties to whom we disclose it;
- Delete personal information we have collected from you, subject to exceptions permitted by law;
- Correct inaccurate personal information;
- Obtain a copy of your personal information in a portable format;
- Opt out of the sale or sharing of personal information, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in such profiling);
- Limit the use and disclosure of sensitive personal information (we do not use sensitive personal information in ways that give rise to this right); and
- Not be discriminated against for exercising your rights. We will not deny you services, charge you different prices, or provide a different level of quality because you exercised your privacy rights.
16.5 Submitting a Request. To exercise your rights to know, access, delete, correct, or obtain a copy, email support@claira.to with the subject “Privacy Request” and a description of your request. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to an additional 45 days), we will tell you why.
16.6 Verification. To protect your information, we verify requests by matching the information you provide with information we already hold, such as your email address and details of your interactions with us. We may ask for more information for requests for specific pieces of personal information or for deletion of sensitive information. We do not require verification for opt-out requests, but we may deny an opt-out request that we believe is fraudulent.
16.7 Authorized Agents. You may use an authorized agent to submit a request on your behalf. We will require the agent to provide your signed written permission, and we may ask you to verify your identity directly with us and confirm that you gave the agent permission. These requirements do not apply if the agent holds a valid power of attorney under applicable state law.
16.8 Appeals. If we decline to act on your request, you may appeal by replying to our decision or by emailing support@claira.to with the subject “Privacy Request Appeal”. We will respond to your appeal within the period required by your state’s law and explain our decision. If we deny your appeal, you may contact your state Attorney General.
16.9 De-identified Information. When we use de-identified information, we maintain and use it only in de-identified form and do not attempt to re-identify it, except as permitted by law.
16.10 Do Not Track. Some browsers send “Do Not Track” signals. Because there is no common standard for interpreting them, we do not respond to Do Not Track signals. We do honour Global Privacy Control signals as described in Section 16.3.
17. Brazil
This Section applies to the processing of personal information subject to Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018, “LGPD”).
17.1 Controller and Data Protection Officer. The controller is Noticia Solutions Inc., 333 Preston Street, Suite 120, Ottawa, Ontario K1S 5N4, Canada. Our Data Protection Officer (Encarregado pelo Tratamento de Dados Pessoais) is Lucas Fraser, who can be reached at support@claira.to. For Customer Data, Noticia acts as an operator (processor) on behalf of the Customer, which is the controller (see Section 4.6).
17.2 Legal Bases. We process personal information on the following legal bases under Article 7 of the LGPD: performance of a contract or preliminary procedures at your request (item V), for providing the Service, managing accounts, billing, support, and responding to inquiries and demo requests; compliance with legal or regulatory obligations (item II), for accounting and tax records and responding to lawful requests; consent (item I), for analytics and marketing technologies on the Website and for newsletters and marketing emails; legitimate interests (item IX), for operating and securing the Website, Ask Claira, service improvement, aggregated and anonymized analytics, and fraud prevention; and the regular exercise of rights in judicial, administrative, or arbitration proceedings (item VI).
17.3 Your Rights. Under Article 18 of the LGPD, you have the right to: confirmation of the existence of processing; access to your personal information; correction of incomplete, inaccurate, or outdated information; anonymization, blocking, or deletion of unnecessary or excessive information or information processed in breach of the LGPD; portability of your information to another service or product provider, in accordance with the regulations of the national authority; deletion of personal information processed with your consent, except where the LGPD allows it to be kept; information about the public and private entities with which we have shared your information; information about the possibility of not giving consent and the consequences of refusing; and revocation of consent. You may also oppose processing carried out on a basis other than consent if it does not comply with the LGPD, and request a review of decisions made solely on the basis of automated processing that affect your interests (we do not currently make such decisions).
17.4 Exercising Your Rights. Send your request to support@claira.to. We will confirm whether we process your personal information and, when you request complete information, provide a clear and complete statement within 15 days of your request.
17.5 International Transfers. Your personal information may be transferred to Canada, the United States, and, for Customer Data, the region selected by the Customer (Brazilian Customers may select Brazil). We carry out international transfers in accordance with Article 33 of the LGPD, including by using the standard contractual clauses approved by the National Data Protection Authority (ANPD), or other mechanisms permitted by the LGPD.
17.6 Complaints. You have the right to petition the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD) at https://www.gov.br/anpd regarding the processing of your personal information.
18. Mexico and Latin America
18.1 Privacy Notice for Mexico. This Section, together with the rest of this Privacy Policy, constitutes our comprehensive privacy notice under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, “LFPDPPP”).
- Controller: Noticia Solutions Inc., with its address at 333 Preston Street, Suite 120, Ottawa, Ontario K1S 5N4, Canada, is responsible for the processing of your personal data. Contact: support@claira.to.
- Personal data we process: identification and contact data, professional data, billing data, and electronic and technical data, as described in Section 2. We do not request sensitive personal data. Please do not include sensitive personal data in forms, emails, or Ask Claira conversations.
- Primary purposes (necessary for our relationship with you): providing, operating, and supporting the Service; managing accounts; billing; responding to your inquiries, demo and visit requests, demo bookings, and requests made through Ask Claira; securing the Website and the Service; and complying with legal obligations.
- Secondary purposes (not necessary for our relationship with you): sending newsletters and marketing communications; analytics and marketing technologies on the Website; measuring the effectiveness of our advertising; and surveys. Analytics and marketing technologies are activated only if you consent. If you do not want your personal data used for secondary purposes, you can refuse or withdraw consent using “Cookie preferences” in the Website footer, unsubscribe from our emails, or write to support@claira.to with the subject “Secondary Purposes”. Refusing does not affect the Service.
- Transfers: we share personal data with service providers that process it on our behalf (located in Canada, the United States, and, for Customer Data, the region selected by the Customer), which does not require your consent. We transfer personal data to LinkedIn, Google (for Google Ads), and Apollo.io only if you consent to marketing technologies. We may also transfer personal data to competent authorities where required by law, and to an acquirer in a merger, acquisition, or sale of assets, as permitted by the LFPDPPP.
- Limiting use or disclosure: you may limit the use or disclosure of your personal data by using “Cookie preferences”, unsubscribing from our emails, or writing to support@claira.to.
- Changes to this notice: we will publish any changes on this page and update the “Last Updated” date.
18.2 ARCO Rights. You have the right to Access your personal data, to Rectify it if it is inaccurate or incomplete, to Cancel it (have it deleted) when it is no longer needed or is processed improperly, and to Oppose its processing for specific purposes (together, “ARCO rights”), as well as to revoke your consent. To exercise these rights, send a request to support@claira.to that includes: your name and an email address or other means to receive our response; documents that prove your identity or, if a representative is acting for you, their identity and authority to represent you; a clear and precise description of the personal data concerned and the right you wish to exercise; any other information that helps us locate your personal data; and, for rectification requests, the changes you are asking for and supporting documents. We will communicate our decision and, if your request is granted, give effect to it within the time limits set by the LFPDPPP.
18.3 Authority. If you believe your rights have been infringed, you may file a complaint with the Mexican data protection authority, the Secretaría Anticorrupción y Buen Gobierno, which assumed the data protection functions of the former National Institute for Transparency, Access to Information and Personal Data Protection (INAI) in 2025.
18.4 Other Latin American Countries. If you are in another Latin American country, such as Argentina, Chile, Colombia, Peru, or Uruguay, you may have similar rights under local law to access, rectify, update, delete, and object to the processing of your personal data, and to file a complaint with your local data protection authority, for example Argentina’s Agencia de Acceso a la Información Pública, Colombia’s Superintendencia de Industria y Comercio, Peru’s Autoridad Nacional de Protección de Datos Personales, or Uruguay’s Unidad Reguladora y de Control de Datos Personales. You may exercise these rights by contacting support@claira.to. In Argentina, you may exercise your right of access free of charge at intervals of no less than six months, unless you show a legitimate interest in doing so sooner. The Agencia de Acceso a la Información Pública, as the supervisory authority under Law No. 25,326, has the power to address complaints and claims filed by anyone whose rights are affected by non-compliance with the rules on the protection of personal data.
19. Australia and New Zealand
19.1 Australia. To the extent the Privacy Act 1988 (Cth) applies to us, we handle personal information in accordance with the Australian Privacy Principles (APPs).
- What we collect, how, and why: the kinds of personal information we collect, how we collect and hold it, and the purposes for which we collect, use, and disclose it are described in Sections 2 to 6. We hold personal information electronically, with the safeguards described in Section 7.
- Anonymity: you can browse the Website without identifying yourself. We need to identify you to provide the Service and to respond to most requests.
- Access and correction: you may request access to, and correction of, the personal information we hold about you by contacting support@claira.to. We will respond within a reasonable period, generally within 30 days.
- Overseas disclosure: we are likely to disclose personal information to recipients in Canada, where we are located, in the United States, where several of our service providers operate (see Section 5), and, for Customer Data, in the region selected by the Customer (Australian Customers may select Australia). We take reasonable steps, including contractual measures, to ensure that overseas recipients handle personal information consistently with the APPs.
- Automated decisions: we do not use computer programs to make decisions that could reasonably be expected to significantly affect the rights or interests of individuals.
- Direct marketing: you may opt out of direct marketing at any time by using the unsubscribe link in our emails or by contacting us.
- Complaints: contact our Privacy Officer at support@claira.to. We will acknowledge your complaint and aim to respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.
19.2 New Zealand. If you are in New Zealand, you have rights under the Privacy Act 2020 to request access to, and correction of, your personal information by contacting support@claira.to. When we disclose personal information outside New Zealand, including to Canada and the United States, we do so in accordance with the Privacy Act 2020, including by using contractual safeguards where required. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at https://www.privacy.org.nz.