Privacy Policy

01What we collect

02Temporary processing and background storage

To provide document extraction and AI-assisted processing services, PID Intelligence may temporarily process, cache, transmit, or store uploaded documents and extracted content within secure infrastructure systems and third-party processing services.

This may include:

• encrypted upload handling
• OCR preprocessing
• temporary image or text extraction buffers
• structured extraction outputs
• API request and response logging
• monitoring and error logs
• infrastructure backups
• processing through third-party AI providers

PID Intelligence does not use customer documents to train its own AI models. See Section 05.

03Third-party services and sub-processors

PID Intelligence uses third-party service providers to operate the platform. The following sub-processors are explicitly named:

A current list of sub-processors and their privacy policies is maintained at pidintelligence.com/pages/sub-processors.

PID Intelligence does not use advertising networks, analytics tracking, social media pixels, or any other data collection services beyond those listed above.

04Cross-border data processing

By using PID Intelligence, you consent to this transient transfer of data outside Canada, including to the United States, for the purpose of operating the extraction service. Each sub-processor named in Section 03 operates under their own published data-handling and regional infrastructure policies. Where supported, PID Intelligence selects regional endpoints or configurations that minimize cross-border transfer; complete confinement of all processing (including transient AI/OCR calls) within Canada is not currently offered.

Region selection is not a residency guarantee. Where an AI provider offers a Canadian processing region, choosing it reduces cross-border transfer but does not by itself ensure that every inference request is processed in Canada: providers may route requests to other regions for capacity, failover, or model availability, and the binding commitment is whatever that provider's own terms state. PID Intelligence therefore makes no residency guarantee for AI inference, and you should not assume one from the residency of data at rest.

05AI training and model use

PID Intelligence does not use customer documents to train its own AI models.

Third-party providers (Anthropic, Google Cloud) may process data according to their own policies and configured API terms. PID Intelligence selects API configurations designed to minimize retention and prevent model training on customer content where supported by the provider. We cannot, however, override the underlying terms of those providers — please review their published policies if model-training behavior is material to your decision to use PID Intelligence.

06How your documents flow through the system

For transparency, here is the typical data flow for a P&ID extraction:

1. You upload a PDF in your browser.
2. For vector PDFs, geometric symbol detection runs locally in your browser. No drawing data leaves your device for this step.
3. The PDF is rasterized (converted to an image) and transmitted to PID Intelligence's server over an encrypted connection.
4. The rasterized image is sent to Google Cloud (Vision AI) for OCR and text detection.
5. The rasterized image is sent to Anthropic (Claude API) for AI vision analysis, symbol interpretation, and cross-validation.
6. Structured extraction results are formatted and returned to you.
7. Uploaded files, intermediate processing artifacts, and logs are subject to the temporary-processing terms in Section 02. They are not intended for long-term storage, but may persist briefly in infrastructure systems or third-party environments.

07How we use your information

• To send your access code and onboarding information
• To communicate updates, changes, or issues with the tool
• To aggregate anonymised, non-identifiable usage patterns to improve the service
• To respond to support requests

We will never sell, rent, or share your personal information with third parties for marketing or commercial purposes.

By using PID Intelligence, you consent to the collection and use of information as described in this policy.

08Email communications (CASL)

Account emails (always sent): PID Intelligence will send you emails related to your account — welcome message, password reset, usage notifications, payment confirmations, and feedback requests after your first extraction. These are transactional messages and are not optional while you have an active account.

Newsletter (opt-in only): At signup you can choose to subscribe to the PID Intelligence newsletter — occasional product updates, P&ID extraction tips, and early-access offers. Canada's Anti-Spam Legislation (CASL) requires your express consent before we send these, so the newsletter checkbox is unchecked by default. We record the date, source, and wording of your consent.

Unsubscribe: Every newsletter message includes an unsubscribe link. You can also unsubscribe at any time by emailing hello@pidintelligence.com with "Unsubscribe" in the subject line. Unsubscribing stops marketing emails only — account emails will continue as long as you have an active account.

09Your rights

Under PIPEDA, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your registration data
• Withdraw consent for processing (this will end your platform access)

To exercise any of these rights, email hello@pidintelligence.com. We will respond within 30 days.

10Data retention

Registration data: retained for the duration of your Design Partner program membership plus 12 months.

Usage logs: retained for 24 months. Usage logs do not contain document content; they contain operational metadata such as timestamps, file sizes, and extraction methods used.

Documents and extraction outputs: Drawing images (valve crops, thumbnails) are deleted within 7 days. Structured extraction outputs and review records are deleted within 90 days.

Account-scoped review data: Some data generated by your review activity — confirmed corrections, suppressions, and drafting patterns the system learns from your drawings — supports extraction quality on an ongoing basis and does not yet have an automatic deletion window. You may request deletion of this data at any time by emailing hello@pidintelligence.com.

You may request earlier deletion of registration data at any time by emailing hello@pidintelligence.com.

11Security

PID Intelligence uses HTTPS encryption for all data in transit. Access to registration and usage data is restricted to PID Intelligence's operator. We follow reasonable security practices appropriate for a small SaaS business. While we take reasonable measures to protect your information, no system can be guaranteed to be 100% secure.

12ISO/IEC 27001-aligned practices

Controls currently in place:

• Encryption in transit: all traffic to and from PID Intelligence is served over HTTPS/TLS.
• Encryption at rest: stored application data (Amazon S3) is encrypted using AES-256.
• Storage in Canada: persistent client data is stored at rest in Canada (see Section 04). AI inference is not confined to Canada.
• Automated retention enforcement: the deletion windows in Section 10 are enforced by infrastructure-level lifecycle rules and a scheduled purge process, not by manual cleanup.
• Access hardening: Content Security Policy headers on all pages; no-store cache directives on API responses so extraction results aren't cached downstream.
• Endpoint protection: full-disk encryption is required on any workstation used to handle client documents.
• Administrative logging: access by PID Intelligence staff to administrative functions is recorded in an access log.
• Authenticated processing endpoints: document extraction requests require a verified account identity; unauthenticated requests are rejected at the endpoint.
• Documented incident response: we maintain a written incident response procedure covering breach detection, assessment, and notification.
• Sub-processor governance: sub-processors are named and reviewed (Section 03 and the sub-processors page); we track data processing agreements with each.

Some controls in our internal information security management system are still in progress and not yet fully implemented — for example, enforced multi-factor authentication across every administrative account. We don't claim that as complete here. If you need more detail for a vendor security review, contact us at hello@pidintelligence.com.

13Professional AI-use guidance (EGBC)

EGBC's Practice Advisory: Use of Artificial Intelligence (AI) in Professional Practice (v1.0, November 22, 2024) sets out how its registrants — the professional engineers and geoscientists who use AI tools in their work — stay accountable for AI-assisted output: a documented risk assessment, documented checks on what the tool produced, independent review for work the risk assessment rates high-risk, retained records, and the registrant's own continuing professional responsibility for everything the tool touches.

Those obligations belong to the registrant and their firm, not to us — we can't perform your risk assessment or sign off on your drawing. What we build toward is making that review possible to do well:

• Confidence and Flags on every field: each extracted value is marked HIGH or REVIEW, with a Flags column naming exactly what's missing or unverified — nothing is presented as checked when it isn't.
• Blank over wrong, by design: when a field can't be validated, we leave it blank rather than fabricate a value. That's a design choice, not a guarantee of accuracy — a misread can still pass validation and appear as a filled-in value (for example, a vision misread that a second read or cross-check agrees with). A blank is a known gap; a filled field is not a certified-correct one. Both need the same review.
• "Engineer sign-off required before issuing" is stated on extraction output — PID Intelligence produces data for review, not a decision or an approved deliverable.

We don't make engineering determinations, validate designs, or certify compliance with any code or regulation — see our Terms of Service. If your use of AI output falls under EGBC Bylaw 7.3.6 (independent review of high-risk professional activities or work), arranging that review is still yours to do.

14Contact

The data controller is AdaptIQ Solutions Inc. (operating as PID Intelligence).

Privacy questions or requests: hello@pidintelligence.com