Overview
This Privacy Policy explains how 1001454451 Ontario Inc., carrying on business as "PersonaOn" ("PersonaOn," "we," "us," or "our") handles personal information when you use our websites, applications, APIs, AI Personas, and related services (collectively, the "Services").
PersonaOn is a Canadian company based in Ontario. We comply with the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), Quebec's Act respecting the protection of personal information in the private sector (commonly known as "Law 25"), Alberta's Personal Information Protection Act ("Alberta PIPA"), British Columbia's Personal Information Protection Act ("BC PIPA"), and applicable laws in other jurisdictions where our users reside, including U.S. state privacy laws and the EU/UK General Data Protection Regulation, where these apply to us.
By using the Services, you acknowledge the practices described in this Policy. Your use is also governed by our Terms of Use and, where you create Personas, our Creator Terms. Capitalized terms not defined here have the meanings given in the Terms of Use or Creator Terms.
We may revise this Policy from time to time. Material changes will be communicated by notice on the Services, by email, or other reasonable means. Continued use after a change takes effect constitutes acceptance.
Person in Charge of the Protection of Personal Information (Privacy Officer)
We have designated Sainath Setti as the person responsible for our compliance with PIPEDA and Quebec Law 25. You can reach our Privacy Officer at:
- Email: admin@personaon.com
- Mail: Sainath Setti, Privacy Officer, 1001454451 Ontario Inc., carrying on business as "PersonaOn", Address available on request via admin@personaon.com
To exercise privacy rights, ask questions, or file a complaint about our handling of your personal information, please contact our Privacy Officer first. If you are not satisfied with our response, you also have the right to file a complaint with the relevant regulator (see "Complaints" below).
Scope
This Policy applies to information we collect through the Services. It does not address the practices of third parties we do not own or operate, even where the Services link to or interoperate with their products. "Personal Information" means information about an identifiable individual, including any information defined as "personal information," "personally identifiable information," or "sensitive personal information" under applicable law.
What Personal Information We Collect
Below are the categories of Personal Information we collect, the purposes for which we collect them, and the categories of recipients with whom we may disclose them.
Account and Profile Data — name, email address, username, password hash, phone number, profile photo, language preference. Purposes: operating, securing, and improving the Services; communicating with you; account recovery and authentication. Disclosed to: service providers; Creators (where you interact with their Personas); persons you authorize.
Identity Verification Data (Creators only) — government-issued identification, date of birth, and similar identifiers used to verify Creator identity for trust-and-safety, anti-fraud, and tax-reporting purposes. Purposes: verifying identity; complying with applicable law (including Canadian and U.S. tax-reporting obligations). Disclosed to: identity-verification vendors; tax-reporting platforms.
Payment Data — payment card type, last four digits, billing address, billing email. Full card numbers are collected directly by our payment processor. Purposes: processing transactions; fraud prevention. Disclosed to: Stripe, Inc. (or replacement processor) and other financial service providers.
Device and Network Data — IP address, device identifiers, operating system, browser type and version, language settings, time zone, and similar technical signals. Purposes: operating and securing the Services; analytics; marketing. Disclosed to: hosting and analytics providers.
Usage and Analytics Data — pages viewed, features used, session duration, click and tap events, referral source, error logs, and performance telemetry. Purposes: operating, debugging, and improving the Services; product analytics. Disclosed to: analytics providers.
Voice and Audio Data — audio captured during interactions with Personas, voice training samples (provided by Creators), and transcripts derived from audio. Where you are a Creator, certain audio is used to train a synthetic voice model that resembles you. Purposes: speech recognition and synthesis; Persona generation (Creators only); operating the Services; quality assurance. Disclosed to: third-party providers of speech recognition, voice synthesis, and (where applicable) real-time communication, in each case under contractual restrictions; Creators (where you interact with their Persona).
Image and Video Data — photographs and videos uploaded by Creators for Persona generation; video frames captured during avatar interactions where supported. Purposes: avatar generation and rendering (Creators only); operating the Services. Disclosed to: third-party avatar rendering providers under contractual restrictions.
Biometric Data (Creators only) — voiceprints and facial geometry derived from Creator-provided audio, photo, and video Content for purposes of generating a Creator's AI Persona. Biometric data is treated as sensitive personal information under PIPEDA and Quebec Law 25, and we collect it only with your express consent. See our Biometric Consent Form for details. Purposes: Persona generation and operation. Disclosed to: service providers contractually restricted in their use.
Conversation Data — the content of messages, prompts, and responses exchanged between End Users and Personas, including any Personal Information End Users voluntarily provide in conversation. Conversation Data may include sensitive topics (such as health, finances, or relationships) where End Users choose to discuss them. Purposes: delivering the Services; improving Persona quality with appropriate safeguards; supporting the Creator who operates the relevant Persona. Disclosed to: service providers; the Creator whose Persona is engaged in the conversation.
Sensitive Information — government identifiers (Creators only), biometric data (Creators only), and any health, financial, or similar sensitive information you elect to share. We collect this only with your express consent and use it only for the purposes for which you provided it.
Communications With Us — emails, support tickets, and other communications you send to us, and our responses. Purposes: providing support; record-keeping; legal compliance.
Why We Collect It (Purposes)
We identify the purposes for which we collect Personal Information at or before the time of collection, in accordance with PIPEDA and Quebec Law 25. The principal purposes are:
Operating and improving the Services, including creating and managing accounts, processing transactions, providing customer support, responding to requests, debugging, monitoring for security incidents, conducting research and analytics, and developing new features.
Personalizing the Services, including recommending Personas, remembering preferences, and tailoring content.
Communicating with you, including sending transactional messages, service notices, security alerts, and (where you have given express opt-in consent under CASL or where permitted by law) commercial electronic messages.
Marketing and advertising, including measuring and optimizing campaigns. We obtain consent as required under the Canadian Anti-Spam Legislation ("CASL") for commercial electronic messages.
Legal and safety purposes, including fulfilling legal obligations, enforcing our Terms, preventing fraud and abuse, protecting the rights and safety of users and others, responding to lawful requests from public authorities, and resolving disputes.
We will not collect new categories of Personal Information, or use Personal Information we already hold for materially different purposes, without first identifying the new purpose to you and obtaining your consent where required.
Consent
We collect, use, and disclose Personal Information with your knowledge and consent, except where law authorizes otherwise. Depending on the sensitivity of the information and the reasonable expectations of the individual:
- Express consent is required for biometric data, other sensitive information, and commercial electronic messages.
- Implied consent may apply where the purpose is obvious and the information is not sensitive (for example, processing your email address to send you a service-related message).
- You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to provide some or all of the Services. To withdraw consent, contact our Privacy Officer at admin@personaon.com.
Sources of Personal Information
We collect Personal Information from:
- You directly, when you create an account, configure a Persona, interact with a Persona, contact support, or otherwise provide information through the Services.
- Automatically, through cookies, SDKs, log files, and similar technologies described below.
- Other users, for example, when a Creator invites you to interact with a Persona, or when an End User interacts with a Creator's Persona.
- Third parties, including identity verification vendors, payment processors, fraud prevention partners, advertising and analytics providers, and authentication providers (such as Google or Apple, where applicable).
How We Disclose Personal Information
Service providers and subprocessors
We engage vendors who process Personal Information on our behalf. Our principal subprocessors include:
- Cloud and infrastructure providers for hosting, storage, and content delivery. Servers may be located in the United States, Canada, or elsewhere.
- AI agent and model providers for agent runtime, reasoning, and large-language-model inference.
- Speech recognition providers for transcription and speech-to-text.
- Voice synthesis providers for text-to-speech and synthetic voice generation.
- Avatar rendering providers for the generation and animation of visual avatars.
- Real-time communication and meeting integration providers for voice, video, and meeting capture, where Personas are deployed in those contexts.
- Payment processors, currently Stripe, Inc., for processing transactions. Stripe's terms and privacy policy govern its handling of payment information.
- Analytics, support, and operational vendors used for product analytics, customer support, identity verification, fraud prevention, and email delivery.
We require service providers to maintain reasonable safeguards comparable to our own and to use Personal Information only for the purposes of performing services for us.
Cross-border transfers. Many of our subprocessors are located in the United States or other jurisdictions outside Canada. By using the Services, you understand that your Personal Information may be transferred to, stored, and processed in the United States and other countries, and that the laws of those countries may provide different (and in some cases lesser) protections than the laws of Canada. We use contractual and technical safeguards intended to protect your Personal Information consistent with PIPEDA and Quebec Law 25, including conducting Privacy Impact Assessments where required.
Creators
When you interact with a Persona, the Creator who built and operates that Persona may receive your account profile data, conversation transcripts, summaries, and analytics about your interactions. Creators are responsible for their own use of this information and are bound by separate obligations under applicable law.
Persons you authorize
When you choose to share content (for example, a transcript of a conversation), the recipient will receive what you share.
Legal and safety disclosures
We may disclose Personal Information to comply with legal process, enforce our agreements, investigate suspected violations or fraud, protect the rights, property, or safety of any person, or respond to lawful requests from public authorities, including for law enforcement or national security purposes.
Corporate transactions
If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, Personal Information may be transferred as part of that transaction, subject to standard confidentiality protections and consistent with this Policy.
Aggregated and de-identified data
We may create and use aggregated, de-identified, or anonymized data that does not identify any individual, and may use and disclose such data for any lawful purpose.
Automated Decision-Making
Some Persona Outputs are generated through automated processing of inputs (including AI models). We do not use automated processing alone to make decisions that produce legal effects concerning you or that significantly affect you. If you are a Quebec resident and your Personal Information is used in connection with a decision based exclusively on automated processing, you have the right to be informed of that fact, to receive the Personal Information used and the principal factors and parameters that led to the decision, and to submit observations to a member of our personnel in a position to review the decision.
Cookies, Tracking, and Advertising
We use cookies, pixel tags, web beacons, SDKs, and similar technologies (collectively, "Cookies") to operate the Services, remember your preferences, analyze usage, and support advertising.
We use the following categories of Cookies:
- Strictly necessary — required to deliver the Services.
- Functional — remember your preferences and settings.
- Analytics and performance — help us understand how the Services are used. Providers may include Google Analytics; you can opt out via the Google Analytics Opt-out Browser Add-on.
- Advertising — measure the effectiveness of campaigns and serve interest-based advertising.
You can manage Cookies through your browser settings or any cookie preferences interface we provide. We honor Global Privacy Control (GPC) signals as an opt-out of "sale" and "sharing" where required by applicable law.
Data Security and Retention
Security
We maintain administrative, technical, and physical safeguards designed to protect Personal Information from unauthorized access, disclosure, alteration, and destruction. These include access controls, encryption in transit and (where applicable) at rest, monitoring, and personnel training. No system is perfectly secure; please use a strong password, keep it confidential, and notify us promptly of any suspected unauthorized access.
Retention
We retain Personal Information only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Specific examples:
- Account profile and authentication data are retained while your account is active.
- Payment records are retained for the periods required by Canadian and applicable foreign tax and accounting laws (typically at least six years for Canadian tax purposes).
- Audio and conversation logs are retained for the periods needed to deliver the Services and improve quality, and are subject to deletion on request.
- Biometric data is governed by the retention rules in our Biometric Consent Form (no later than three years after the Creator's last interaction with the Services for Illinois residents, and otherwise for the term of the Creator's relationship with us, with destruction in accordance with applicable Canadian and U.S. law).
- De-identified or aggregated data may be retained indefinitely.
We may retain limited Personal Information for longer where required to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements.
Breach Notification
If we become aware of a breach of security safeguards involving your Personal Information that creates a real risk of significant harm to you, we will notify you and the relevant regulator (in Canada, the Office of the Privacy Commissioner of Canada and, in Quebec, the Commission d'accès à l'information du Québec) as soon as feasible, in accordance with applicable law. We maintain records of breaches as required by law.
Children
The Services are not directed to children under 13 (or under 16 in the EEA, UK, and Switzerland), and we do not knowingly collect Personal Information from such children. If you believe we have collected Personal Information from a child, contact our Privacy Officer at admin@personaon.com and we will delete it.
Your Rights
Canadian residents
You have the right to:
- Access the Personal Information we hold about you;
- Correct inaccurate or incomplete Personal Information;
- Withdraw consent to our collection, use, or disclosure of your Personal Information, subject to legal or contractual restrictions and reasonable notice;
- File a complaint with our Privacy Officer.
If you are a Quebec resident, you also have the right to:
- Cease processing of your Personal Information or its de-indexing in certain circumstances;
- Data portability: receive Personal Information you provided in a structured, commonly used technological format and have it transmitted to another person where technically feasible;
- Be informed when a decision is based exclusively on automated processing, and the principal factors and parameters used;
- File a complaint with the Commission d'accès à l'information du Québec.
If you are an Alberta or BC resident, you have additional rights under Alberta PIPA or BC PIPA, including rights of access and correction, and may file a complaint with your provincial Information and Privacy Commissioner.
U.S. state residents
Depending on the U.S. state where you reside, you may have rights under the California Consumer Privacy Act (as amended by the CPRA), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Montana Consumer Data Privacy Act, the Oregon Consumer Privacy Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, the Virginia Consumer Data Protection Act, or similar laws. These may include rights to:
- Confirm whether we process your Personal Information and access a copy;
- Request deletion;
- Request correction;
- Receive a portable copy of your Personal Information;
- Opt out of "sale," "sharing," or targeted advertising;
- Limit our use of "Sensitive Personal Information";
- Not be discriminated against for exercising rights.
We do not sell Personal Information for monetary consideration. Certain disclosures via cookies and advertising tools may constitute a "sale" or "sharing" under California, Colorado, Connecticut, and similar state laws, and you have the right to opt out (see "Cookies, Tracking, and Advertising" above).
We do not knowingly sell or share the Personal Information of consumers under the age of 16.
Washington Consumer Health Data Privacy Notice
This section applies to Washington State residents. Consumer Health Data we may collect includes biometric data of Creators (as described in our Biometric Consent Form), and any health-related information End Users elect to share with a Persona.
- Sources: directly from you (or your representative).
- Purposes: to deliver the Services as you have requested.
- Disclosure: to service providers under contractual restrictions, and (where you choose to share information) to the Creator who operates the relevant Persona.
- Rights: Washington residents may access, delete, and withdraw consent regarding Consumer Health Data, and may appeal denials. Submit requests to admin@personaon.com. If we deny an appeal, you may submit a complaint to the Washington Attorney General at https://www.atg.wa.gov/file-complaint.
EU/UK/Swiss residents
If you reside in the EEA, United Kingdom, or Switzerland, you have rights under the EU GDPR, UK GDPR, or Swiss FADP, including access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with your supervisory authority. Our legal bases for processing include performance of a contract, our legitimate interests (where not overridden by your rights), legal obligation, and consent. You may withdraw consent at any time without affecting prior lawful processing.
If you reside in the EEA, UK, or Switzerland, please contact our Privacy Officer at admin@personaon.com to exercise your rights.
How to exercise your rights
To exercise any rights, contact our Privacy Officer at admin@personaon.com. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law (generally 30 days under PIPEDA, 30 days under Law 25 with possible extensions, 45 days under U.S. state laws, one month under GDPR). If we deny your request, you may appeal to our Privacy Officer.
Complaints
If you believe we have not handled your Personal Information in accordance with applicable law, please contact our Privacy Officer at admin@personaon.com in the first instance. We take complaints seriously and will investigate promptly.
You also have the right to file a complaint directly with the regulator in your jurisdiction:
- Canada (federal): Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca
- Quebec: Commission d'accès à l'information du Québec — https://www.cai.gouv.qc.ca
- Alberta: Office of the Information and Privacy Commissioner of Alberta — https://www.oipc.ab.ca
- British Columbia: Office of the Information and Privacy Commissioner for BC — https://www.oipc.bc.ca
- United States: the Attorney General of your state, or the FTC
- EEA / UK: your local Data Protection Authority (e.g., the UK ICO at https://ico.org.uk)
Contact Us
- Email: admin@personaon.com (privacy and rights requests) / admin@personaon.com (general support)
- Mail: Sainath Setti, Privacy Officer, 1001454451 Ontario Inc., carrying on business as "PersonaOn", Address available on request via admin@personaon.com
- Website: https://personaon.com
See also: Terms of Use · Creator Terms · Biometric Consent