Privacy Policy

1. Introduction

PresenceCraft is committed to protecting your privacy and handling your personal information with transparency and care. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and what rights you have as a user.

This policy applies to all users of the PresenceCraft platform, including our website and progressive web application (PWA).

By creating an account, you agree to the collection and use of your personal information as described in this policy. At account creation, you will be asked to expressly consent to having your data stored and processed by services located in the United States, including cloud infrastructure (Amazon Web Services) and AI processing (Anthropic). For these cross-border data transfers, we obtain your express consent as required by Law 25.

2. Who We Are

PresenceCraft is operated by Metacis Inc., a corporation based in Quebec, Canada, doing business under the name PresenceCraft.

We comply with applicable Canadian and Quebec privacy laws, including the Act to modernize legislative provisions as regards the protection of personal information (commonly referred to as Law 25 or Bill 64), which came into full effect on September 22, 2023. Where you access the Service from within the European Economic Area, we also comply with the General Data Protection Regulation (GDPR) where applicable.

2.1 Person Responsible for the Protection of Personal Information

In accordance with Law 25, Metacis Inc. has designated a person responsible for the protection of personal information. For inquiries, requests, or complaints related to your personal information, please contact:

3. Data We Collect

We collect the following categories of personal information:

3.1 Account Information

Email address or phone number, required for account creation and authentication.

3.2 Conversation and Bot Data

• Chat messages you send to and receive from your AI bots.
• Bot configuration, including personality settings, custom instructions, memory data, and other configuration you define.
• Bot interaction history and metadata about when bots were active or accessed.

3.3 User-Shared Information in Conversations

When you chat with your bots, you may voluntarily share personal information as part of the conversation—such as your location, preferences, or other details. This information is shared by you, to your bot, for your own purposes. We do not harvest or use conversation content for our own purposes. See Section 7 for details on message handling.

3.4 Payment Information

When you subscribe to a paid plan, payment is processed by Stripe. PresenceCraft does not store your full credit card number or CVV. We receive and store only limited billing metadata from Stripe (e.g., subscription status, plan type, last four digits of card, billing email).

3.5 Usage Data

• Platform usage analytics, including page views and feature interactions (see Section 9).
• Server-side log data including IP addresses, request timestamps, and error information, retained for security and debugging purposes.

3.6 Data We Do Not Collect

• We do not collect biometric data.
• We do not collect your precise geolocation (though you may share location with your bots in conversation).
• We do not build advertising profiles.
• We do not sell your personal information to third parties.

4. How We Use Your Data

We use your personal information for the following purposes:

We do not use your chat messages or bot conversation content for advertising, model training, or analytics purposes.

5. How We Store Your Data

All PresenceCraft data is stored on Amazon Web Services (AWS) infrastructure located in the us-east-1 region (US East). We use industry-standard cloud infrastructure with encryption at rest and in transit.

5.1 Encryption

Your data is encrypted when stored (at rest) and when transmitted (in transit) using industry-standard encryption protocols, including TLS 1.2 or higher for data in transit and AES-256 for data at rest.

5.2 Access Controls

Access to stored data is restricted to authorized personnel and automated systems on a need-to-know basis. We implement role-based access controls and audit logging for administrative access.

6. Third-Party Services

PresenceCraft uses the following third-party services that may handle your personal information:

6.1 Anthropic (AI Processing)

• Purpose: Powers the AI language model underlying your bots (Claude API).
• Data shared: Your chat messages and bot context are sent to Anthropic's API for processing in real time.
• Location: Anthropic's infrastructure is US-based (see Section 11 regarding international transfers).
• Privacy policy: https://www.anthropic.com/privacy

6.2 Stripe (Payments)

• Purpose: Processes subscription payments.
• Data shared: Billing information, email address, payment method details.
• Note: PresenceCraft does not store full payment card data. Stripe is PCI-DSS compliant.
• Privacy policy: https://stripe.com/privacy

6.3 Amazon Web Services (Infrastructure)

• Purpose: Hosts all PresenceCraft infrastructure.
• Data shared: All platform data resides on AWS.
• Location: Data is stored in AWS us-east-1 (US East).
• Privacy policy: https://aws.amazon.com/privacy/

We do not share your personal information with any other third parties for marketing, advertising, or data brokerage purposes.

7. Message Privacy and AI Processing

7.1 How Messages Are Processed

When you send a message to your bot:

• The message is transmitted over an encrypted connection to PresenceCraft's servers.
• The message, along with relevant bot context (personality, memory), is sent to the Anthropic Claude API for processing.
• The AI response is returned and displayed to you.
• Both the message and response are stored securely (encrypted at rest).

7.2 What You Share in Conversations

Your bots are your own personal assistants. If you choose to share personal information with your bots—such as your location, daily routines, or other details—that information is used solely to power your bot's responses to you. We do not read, analyze, or harvest the content of your conversations for our own purposes.

7.3 Anthropic Data Handling

By using PresenceCraft, you acknowledge that your chat messages are processed by Anthropic's API. Anthropic may process this data in the United States. PresenceCraft uses Anthropic's API under terms that restrict Anthropic from using API inputs to train their models (subject to Anthropic's current API terms). Please review Anthropic's privacy policy for details.

7.4 No Message Content Used for Analytics

We do not read, analyze, or use the content of your chat messages for analytics, product improvement, or any purpose other than providing the Service to you.

8. Cookies and Tracking

PresenceCraft uses minimal cookies:

• Session cookies: Used to maintain your authenticated session. These are essential for the Service to function.
• No tracking cookies: We do not use third-party tracking cookies, advertising cookies, or behavioral tracking technologies.
• No cross-site tracking: We do not track your activity across other websites.

Locally cached data (such as data stored in your browser) can be cleared through your browser settings. You can configure your browser to reject cookies, but doing so may impair your ability to use the Service.

9. Analytics

9.1 What We Track

PresenceCraft may collect basic usage analytics to understand how the platform is used and to improve the Service, including:

• Page views and navigation patterns within the app.
• Feature usage (e.g., which features are used most frequently).
• Error and performance metrics.
• General session metadata (session duration, device type).

9.2 What We Do Not Track

• We do not analyze the content of chat messages for analytics purposes.
• We do not build individual behavioral profiles for advertising.
• We do not share analytics data with third-party advertising networks.

9.3 Analytics Tools

PresenceCraft may, in the future, use third-party analytics and marketing tools such as Google Analytics, Google Search Console, and Meta Pixel. If activated, these tools will be configured to minimize data collection and will not receive chat message content. This section will be updated to reflect any tools in active use.

10. Data Retention

We retain your personal information for as long as necessary to provide the Service and meet our legal obligations.

When you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g., payment records). Deletion includes removing your user record, chat messages, and bot configuration data.

11. International Data Transfers

11.1 Primary Storage in the United States

All primary platform data is stored in AWS us-east-1 (US East). We ensure appropriate safeguards are in place for cross-border data transfers as required by applicable law.

11.2 AI Processing in the United States

When you interact with your bot, your messages are processed by Anthropic's Claude API, operated by Anthropic PBC, a US-based company. This constitutes a cross-border transfer of personal information to the United States.

We have reviewed Anthropic's data handling practices and API terms, and we rely on contractual protections under Anthropic's terms of service.

11.3 Privacy Impact Assessment

In accordance with Law 25, Metacis Inc. has conducted a Privacy Impact Assessment (PIA) for cross-border transfers of personal information, including: (a) the storage of platform data on AWS infrastructure in the United States, and (b) the transmission of chat messages to Anthropic's Claude API in the United States. These assessments evaluate the sensitivity of the information, the purposes for which it will be used, and the legal framework of the destination jurisdiction, in accordance with CAI guidance. For more details, see our Privacy Impact Assessment.

11.4 Users Outside Canada

The Service is operated from Quebec, Canada and is primarily directed at Canadian users. We do not specifically target or market the Service to residents of the European Economic Area (EEA). If you access the Service from outside Canada, you do so at your own initiative and are responsible for compliance with local laws. Should PresenceCraft begin actively targeting users in the EEA, we will update this policy to reflect full compliance with the General Data Protection Regulation (GDPR).

12. Children's Privacy

PresenceCraft is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a user is under 18, we will promptly delete their account and any associated data. If you believe a child has created an account, please contact us immediately at the address in Section 16.

13. Your Rights

Under applicable Canadian and Quebec privacy laws (including Law 25), you have the following rights regarding your personal information:

13.1 Right of Access

You have the right to request access to the personal information we hold about you, including what data we have, why we have it, and who we have shared it with.

13.2 Right to Correction

You have the right to request that we correct inaccurate or incomplete personal information we hold about you.

13.3 Right to Deletion

You have the right to request deletion of your personal information. To request account deletion, please contact us at the address in Section 16. Note that we may retain certain data where required by law (e.g., financial records).

13.4 Right to Data Portability

You have the right to request a copy of your personal information in a structured, commonly used, machine-readable format. PresenceCraft provides data exports in JSON and plain text formats.

13.5 Right to Withdraw Consent

Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Withdrawal of consent may affect your ability to use the Service.

13.6 Automated Decision-Making

In accordance with Law 25, you have the right to be informed when decisions that produce legal or significant effects are made about you exclusively by automated processing. PresenceCraft's AI bots provide conversational responses only and do not make consequential decisions about you (such as credit decisions, employment screening, or access to services). If you believe automated processing has affected your rights, you may contact us to request a review.

13.7 Right to Lodge a Complaint

If you believe your privacy rights have been violated, you have the right to lodge a complaint with the Commission d'accès à l'information (CAI) of Quebec: https://www.cai.gouv.qc.ca/

You may also contact the Office of the Privacy Commissioner of Canada (OPC): https://www.priv.gc.ca/

To exercise any of your rights, please contact us using the information in Section 16. We will respond to requests within 30 days.

14. Data Breach Notification

In the event of a confidentiality incident (data breach) that creates a risk of serious harm to individuals, PresenceCraft will:

• Notify affected individuals as soon as reasonably possible.
• Notify the Commission d'accès à l'information (CAI) of Quebec within 72 hours of becoming aware of the breach, as required by Law 25.
• Maintain a confidentiality incident register as required by applicable law.

We implement reasonable technical and organizational measures to prevent data breaches, including access controls, encryption, and monitoring.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 30 days before the changes take effect. The updated policy will be posted on our website with the revised “Last updated” date.

Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

15.1 Language

This Privacy Policy is available in English and French. In the event of any discrepancy between the English and French versions, the English version shall prevail, provided the user has expressly agreed to be bound by the English version at account creation.

16. Contact Us

For questions, concerns, or to exercise your privacy rights, please contact:

We aim to respond to all privacy-related requests within 30 days.