1. Introduction
BillyAI is an AI automation platform that helps Quebec and Canadian businesses manage their client communications, leads, and operations - through conversational AI agents deployed on SMS, email, Messenger, and other channels.
This policy explains how we collect, use, store, and protect personal data as part of our services.
Our core commitments:
- Your data is hosted on Canadian infrastructure
- Your data is never sold to third parties
- Your data is never used to train AI models
- You retain full ownership of your data at all times
2. Who We Are and Our Roles
BillyAI (heybilly.ai), a company incorporated in Quebec, Canada.
In providing our services, we act in two capacities:
Data Controller for data you provide directly: account information, contact details, billing, communications with our team.
Data Processor for your end-customers' data: leads, messages, appointments, conversations. We process this data solely according to your instructions and on your behalf. You remain the data controller with respect to your customers.
3. Data We Collect
Business data (you): Company identification, contact names and details, billing address, payment information, client portal activity, agent and flow configuration.
End-customer data (processed on your behalf): Lead and contact information, communication content (SMS, email, Messenger), appointment details, conversation history, transaction data. This data belongs to your business. We process it solely to provide you with the service.
Technical data: IP addresses, browser and device information, system activity logs, API logs. This data is used exclusively for platform security, debugging, and performance.
4. How We Use Your Data
We use your data solely for:
- Service delivery - AI agents, automation flows, conversation management
- AI analysis and response generation within your configured flows
- Integrations activated by you - CRM, calendar, e-commerce, communication channels
- Customer support and technical issue resolution
- BillyAI platform improvement (aggregated and anonymized data only)
- Fraud, abuse, and security breach prevention
- Compliance with our legal obligations
We never use your data for third-party marketing or to train AI models.
5. Artificial Intelligence and Language Models
Your AI agents use third-party language models to analyze messages, generate responses, qualify prospects, and orchestrate workflows.
Current AI providers: Anthropic (Claude). Other providers may be used depending on your agent configuration.
What these providers receive: The content of conversations being processed, transmitted securely via encrypted API.
What they do not do: The AI providers we work with are contractually committed to not using data transmitted via API to train their models. Your conversations are not used to improve third-party models.
Automated decisions: Certain actions are executed automatically by AI agents (responses, bookings, CRM updates). You retain control via the client portal and can intervene manually at any time through the takeover feature.
6. Data Sharing
We never sell your data. We share it only in the following cases:
Essential service providers: Twilio (SMS and voice transmission), Meta (Messenger and Pages/Ads integrations), AWS (Canadian hosting infrastructure), Anthropic and other AI providers (conversation processing).
Integrations activated by you: Zoho CRM, Google Calendar, HubSpot, GoHighLevel, Shopify, and any other tool you connect to your account. You control these connections and can revoke them at any time.
Legal obligations: If required by law, if requested by a competent authority, or to protect the rights and safety of BillyAI, our clients, or the public.
Note on AWS hosting: Note on AWS hosting: AWS is a US company subject to the US Cloud Act. In practice, for Canadian business data hosted on Canadian infrastructure, no transfer to foreign servers is made. Data remains physically in Canada.
7. Hosting, Security, and Retention
Hosting
All data is hosted on Canadian infrastructure - AWS ca-central-1 (Montreal). No data transfers to servers outside of Canada.
Security
- Encryption in transit: TLS 1.3
- Encryption at rest: AES-256
- OAuth 2.0 authentication for all third-party integrations
- No third-party passwords stored in plain text
- Strict role-based access controls
- Complete audit logs for all actions
- Continuous monitoring and anomaly detection
- Regular encrypted backups
- Complete data isolation between client accounts
Retention
- Account data: duration of relationship + 2 years
- Billing data: 7 years (Quebec legal requirement)
- Conversations and logs: 24 months by default, configurable to your needs
- Technical logs: 12 months maximum
8. Quebec and Canadian Legal Compliance
Law 25 — Personal Information Protection (Quebec)
BillyAI complies with Law 25 obligations: minimal data collection, declared purpose, access and deletion rights, designation of a data protection officer, and reporting of privacy incidents to the Commission d'accès à l'information (CAI) within required timelines.
CASL / Canada's Anti-Spam Legislation
The platform is architected to comply with CASL. Automated communications are only sent to contacts who have given their consent. No unsolicited cold outreach module is available on the platform.
9. Cookies
- Essential - authentication, session security. Cannot be disabled.
- Functional - interface preferences, language settings. Can be disabled without affecting core features.
- Analytics - platform usage understanding (aggregated and anonymized data). Can be disabled via your browser settings.
10. Your Rights
Under Quebec's Law 25 and applicable legislation, you have the following rights:
- Access - obtain a copy of your personal data that we hold
- Rectification - correct inaccurate or incomplete data
- Deletion - request erasure of your data (subject to legal retention obligations)
- Portability - receive your data in a structured, readable format (CSV/JSON)
- Consent withdrawal - for processing based on your consent
- Objection - object to certain processing in cases provided by law
To exercise your rights: privacy@heybilly.ai
Response time: 30 days maximum.
11. Rights of Your End-Customers
Individuals whose data is processed by your BillyAI agents (your leads, clients, prospects) must exercise their rights directly with your business - you are the data controller with respect to them.
BillyAI will assist you in processing these requests, including for the deletion or export of specific data at your request.
12. Privacy Incidents
In the event of a security incident affecting personal data, BillyAI commits to:
- Notifying you as soon as possible, and no later than the timelines required by Law 25
- Documenting the incident and measures taken
- Collaborating with you on applicable regulatory notifications
- Reporting the incident to the Commission d'accès à l'information if required
13. Modifications to This Policy
This policy may be updated to reflect changes in our practices or applicable legislation. Significant changes are communicated by email to active clients with reasonable notice before taking effect.
The current version is always available at heybilly.ai/privacy.
14. Contact
Privacy inquiries: privacy@heybilly.ai
General contact: hello@heybilly.ai
Complaints: Commission d'accès à l'information du Québec (CAI) - cai.gouv.qc.ca