Privacy Policy

This Privacy Policy explains how Maple Ridge Agency Inc. (“we”, “us”) collects, uses, discloses, and protects personal information when providing MRAFX Gate. We comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

1. What we collect

Category	Data	Purpose
Account	Name, email, company name, country or region	Open and manage your account, contact you
Verification	Identity documents, business registration and ownership	Anti-money-laundering, anti-terrorist-financing, and sanctions screening obligations
Payments	Amount, time, payment method type	Top-ups, invoicing, refunds, fraud prevention
Call metadata	Time, model, token counts, cost, upstream request ID, source IP, error codes	Billing, reconciliation, security and abuse prevention

Payment card data is handled directly by our payment processor (such as Stripe). We do not store full card numbers.

2. What we do not keep

By default, we do not store your prompts or model outputs. Request content passes through gateway memory only while being forwarded and is discarded once the request completes.

We store request content only if you turn on debug logging in the console. It is kept for the period you choose, and you can delete it at any time.

3. How upstream providers handle content

To generate a response, your request content must be sent to the upstream provider (currently Microsoft Azure OpenAI). Please note:

• The Azure resources we use are located in Canada, but they use the Global Standard deployment type, so inference may be processed in Microsoft data centres in any region.
• Under Microsoft’s policy, Azure OpenAI may retain prompts and outputs for abuse monitoring for up to 30 days unless Microsoft has approved an exemption. We will update this policy if we obtain one.
• Upstream providers process data under their own privacy terms.

4. Cross-border processing

Your information may be stored or processed outside Canada, including in the United States, where local law may allow local authorities to access it. By using the service, you acknowledge and consent to this processing.

5. Sharing

We do not sell personal information. We share it only:

1. With service providers needed to deliver the service: upstream model providers, cloud hosting, payment processing, and identity verification. They may process it only on our instructions.
2. Where required by law, for example to respond to a court order or to report to regulators such as the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).
3. In a corporate transaction such as a merger, acquisition, or asset transfer, where the recipient must continue to honour this policy.

6. Retention

• Account information: while the account is open, and for a reasonable period after closure to handle disputes.
• Transaction and billing records: at least 7 years, to meet Canadian tax requirements.
• Verification records: as required by applicable anti-money-laundering rules, typically at least 5 years.
• Call metadata: typically 13 months, for billing reconciliation and security analysis.

7. Security

We use reasonable technical and organizational safeguards, including encryption in transit (TLS), encrypted key storage, least-privilege access control, and access log review. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner of Canada as required by law.

8. Your rights

You may access and correct the personal information we hold about you, and withdraw consent or request deletion where law and contract allow. Records we are legally required to keep, such as transaction and verification records, cannot be deleted before their retention period ends. Send requests to the address below; we respond within 30 days.

If you are in Quebec, you also have the rights provided by Quebec’s Act respecting the protection of personal information in the private sector.

9. Cookies

The website uses only the cookies and local storage needed to keep you signed in and remember your language. We do not currently use advertising or third-party analytics cookies. We will update this policy if that changes.

10. Minors

The service is not intended for anyone under 18, and we do not knowingly collect personal information from minors.

11. Updates

We may update this policy and will give advance notice of material changes by website notice or email.

12. Contact

Privacy officer: privacy@mrafx.com Maple Ridge Agency Inc., Winnipeg, Manitoba, Canada

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.