Personal information governance rules

In force from 3 November 2026. These rules say how Syel protects the personal information of the people who use it, from the moment it is collected until it is destroyed. They are published under Québec's Act respecting the protection of personal information in the private sector (section 3.2). The privacy policy says what is collected and why; this document says who answers for it and how.

Who is responsible

Syel is a sole proprietorship in Québec (NEQ 2282670977). Its founder, Ted Nsangou, is the person in charge of the protection of personal information. He is the only person at Syel with access to the systems. He can be reached at support@syel.ai.

The person in charge:

• approves these rules and reviews them at least once a year, and with every significant change (a new provider, a new feature that touches personal information);
• assesses the risks before any project that touches personal information;
• handles requests for access, correction, portability and deletion, and complaints;
• keeps the register of confidentiality incidents.

If Syel ever brings on other people, each will have access only to what they need, will commit to confidentiality in writing, and will be trained on these rules before any access.

The life cycle of personal information

Collection. Syel collects only what the service needs: what the person writes, what Syel writes for them (their pages and patterns), their language, region and time zone, and, only if they choose to, an email address and a first name. No analytics, no trackers, no advertising.

Use. This information is used to reply to the person, to write their pages and to keep their account. Nothing else. No one at Syel reads conversations: they are decrypted only to reply and to write pages, and no internal tool displays them.

Disclosure. To write a reply, the text it needs is handed, for the time of the request, to artificial intelligence providers, some of which are located outside Québec and Canada. The email address, the account identifier and the IP address are never sent. Other providers (hosting, email, subscriptions, notifications) receive only what their role requires. No information is ever sold.

Retention. Everything the person writes is stored encrypted, with a key of its own for each account, itself sealed by a master key kept outside the database. Conversations stay readable for as long as the person keeps them; they can choose to have them erased automatically beyond their plan's window. Data is hosted in Canada. Backup copies of the database are kept by the person in charge on private storage; what the person wrote stays encrypted there.

Destruction. The person deletes, at any time and immediately, their conversations or their whole account, in Settings, Account. Deleting the account also destroys the key that decrypted their writing, which makes it unreadable for good. A backup made before the deletion may still hold the account, encrypted, until it is replaced, at most 60 days. The spending ledger keeps its lines (model, token count, cost), with no link to the person. An account found to belong to a minor is deleted.

Protection by default

The default settings are the most protective ones: no email address is needed to start, no notification is sent without consent, and no notification shows what the person wrote.

Before any new project

Before adding a provider, disclosing information outside Québec, or launching a feature that touches personal information, the person in charge assesses the privacy risks: how sensitive the information is, the purpose, the safeguards, and, for a disclosure outside Québec, the legal framework of the place it goes to. Every provider that processes personal information is bound by a written agreement that limits its use to the service it provides to Syel.

Confidentiality incidents

Unauthorised access, use or disclosure of personal information, or its loss, is an incident. When one happens, the person in charge:

1. takes the measures to reduce the harm and prevent it from happening again,

without waiting;

2. assesses the risk of serious injury;

3. if that risk exists, notifies the Commission d'accès à l'information and each

person concerned without delay;

4. records it in the incident register, in every case, and keeps it there for

5 years.

Requests and complaints

Anyone can ask to access their information, correct it, receive it in a portable format or have it deleted, withdraw their consent, or complain about how Syel handles their information.

• Several of these are already buttons in the app: export your data, delete your conversations, delete your account.
• For anything else, or for a complaint, write to support@syel.ai. The person in charge acknowledges it, looks into it and answers in writing within 30 days. The answer says what was done, or why a request is refused.
• Anyone who is not satisfied can turn to Québec's Commission d'accès à l'information (cai.gouv.qc.ca).

Contact

Ted Nsangou, person in charge of the protection of personal information support@syel.ai Syel (NEQ 2282670977), 1625 De Maisonneuve Boulevard West, Montréal, Québec H3H 2N4, Canada