Privacy Policy

Who we are and what this policy covers

This Privacy Policy explains how Oil Patch AI Systems Inc. ("Oil Patch AI Systems", "we", "us") collects, uses, discloses and protects personal information. We are based in Alberta, with our business base in Fort McMurray (Regional Municipality of Wood Buffalo) and our headquarters in Calgary.

It covers personal information we handle:

• through this website, including our contact and booking forms, the AI Readiness Assessment, the AI Readiness Pre-Test and the 3-Minute Readiness Check;
• when you email us, book a call, or speak with us at an event; and
• as part of running our business with clients, prospects, partners and advisors.

When a client hires us to build or run a playbook, the client's own records (for example field tickets, payroll, certifications, safety forms or member employment data) are governed first by that client's Data Governance Agreement and by our Data Sovereignty Commitment. In that work we act on the client's instructions as their service provider, and the client remains in control of the information. Section 8 explains how we handle that data, and section 9 covers Indigenous data sovereignty.

Information we collect

Information you give us

• Contact and booking forms: your name, company, work email, phone number, job title or role, company type, the type of inquiry, the best time to talk, and anything you write in the message box.
• AI Readiness Assessment: when you finish the assessment, we receive your name, work email, company, phone number, the seat you answered as, your 25 answers, your scores, your readiness band and the next step suggested, so we can send you your report and follow up if you ask us to.
• Free guide requests: when you ask for a free guide, such as Top 5 Ways to Start with AI in Your Back Office, we receive your first name, company, work email and phone number.
• Email copies of Pre-Test results: if you choose to email yourself your AI Readiness Pre-Test results, we receive your email address, your scores, your readiness band, the seat you answered as, and the next step suggested.
• Conversations: what you tell us on a discovery call or by email about your business, your systems and the work you want done.

Information collected when you use the site

• Browser storage: the site saves a few small settings in your own browser so it remembers your choices, such as which tab you last opened. Section 12 lists each one. This information stays on your device and is not sent to us.
• Technical information: like any website, the company that hosts our site and the services that deliver our fonts and page styling receive your device's IP address, browser type and the page requested, so the page can load. We do not currently use analytics, advertising or tracking cookies. If we add them, we will update this policy first and ask for your consent where the law requires it.

Information from other sources

We may receive your business contact details from a person who refers you to us, from an industry association or event you attend, or from public business sources such as company websites and professional networking profiles. We use this only to contact you about our services in a business context, and we follow Canada's anti-spam law when we do.

How we use your information

We use personal information only for purposes a reasonable person would consider appropriate in the circumstances, and only for the purposes we tell you about:

• to answer your questions and requests, and to book and hold discovery calls;
• to send you the assessment results you asked for;
• to prepare proposals, scope work and deliver the services you hire us for;
• to send you information about our services and free resources, where you have agreed to receive it;
• to keep business records, invoice, and meet our legal, tax and accounting obligations;
• to keep the website and our systems working and secure.

We do not use your information, or any client's information, to train artificial intelligence models, and we do not make automated decisions about you that have legal or similarly significant effects.

Consent

We collect, use and disclose personal information with your consent, except where the law allows or requires otherwise. When you send a form, you agree that we may use what you sent to respond to you. For anything beyond that, such as adding you to a mailing list, we ask separately.

You may withdraw your consent at any time, on reasonable notice, by emailing us. We will tell you if withdrawing consent means we can no longer provide a service you asked for. Withdrawing consent does not affect records we must keep by law.

Email and commercial messages

We send commercial electronic messages only with your express or implied consent, as Canada's Anti-Spam Legislation (CASL) requires. Every marketing email identifies us, includes our contact information, and has an unsubscribe link that works within 10 business days. Replies to your own questions, and messages about a service you have hired us for, are not marketing.

When we share information

We do not sell, rent or trade personal information. We share it only in these cases:

• Service providers that help us run the business, such as website hosting, email, scheduling, form handling, customer relationship management, document storage and accounting. They may use the information only to provide their service to us, under contract, with safeguards comparable to ours.
• Professional advisors such as our lawyers, accountants and insurers, under a duty of confidentiality.
• Our paid Indigenous advisor, where their review of work for a Nation-owned client is part of the engagement and the client has agreed.
• Legal requirements, where we must disclose information to comply with a law, court order or lawful request, or to protect the rights, property or safety of any person.
• A business transaction, such as a merger or sale of the business, under a confidentiality agreement and only as the law allows.

We never share one client's information with another client, an operator or a joint-venture partner unless the client has instructed us to in writing.

Where information is stored

Contact records, form submissions and our correspondence with you are kept in our Microsoft 365 account, stored in Canada. We prefer service providers that store data in Canada, and we choose Canadian storage where it is offered. Some of our service providers may store or process information in the United States or other countries. Information held outside Canada is subject to the laws of that country and may be accessed by its courts, law enforcement or national security authorities. Storing information in Canada also does not, on its own, place it beyond the reach of foreign laws that apply to the provider.

You can ask us which service providers outside Canada handle personal information for us, and our policies about them, by contacting the person named in section 15. We tell clients where each tool stores and processes data, for the client's exact plan, before we build with it. Our current list is on our Tools and Data Locations page.

How we handle client data in an engagement

This section describes our standard practice for the data clients entrust to us. The written agreement and data commitment with each client sets the final terms.

• Your account, your data. We build inside the client's own Microsoft 365 or Google Workspace account (the "tenant"). Records stay there. We do not copy client data into our own systems unless the client agrees to it in writing for a specific purpose.
• Access only as granted. We use accounts the client gives us, with the least access needed, and the client can remove our access at any time.
• Work accounts only. We never paste client records, rate sheets, bids or personal information into personal or consumer AI accounts, and we never use client data to train AI models.
• A person approves. AI drafts; a named person at the client approves invoices, forms and reports before they leave the building. Safety outputs are always approved by the client's qualified safety staff.
• Least data. We work with the fewest fields the job needs, and aggregate personal data before it goes into any report shared with a partner or operator.
• Hand-over and exit. At the end of an engagement, or whenever the client asks, we return or securely delete any copies we hold, remove our access, and confirm it in writing. The client keeps everything we built, along with the instructions to run it.
• Confidentiality. We never name a client, or use a client's data, examples or results in our marketing without the client's prior written approval.

Indigenous data sovereignty

We recognize that First Nations, Métis and Inuit peoples have the right to govern information about their communities, members, lands and businesses.

First Nations clients and OCAP®

For First Nations-owned clients, we work in a way aligned with the First Nations principles of OCAP®: Ownership, Control, Access and Possession. In practice this means:

• Ownership: member, employment, community and business information belongs to the Nation or its business, not to us.
• Control: the Nation decides how its data is collected, used, shared, kept and deleted, and who may approve each step. Those decisions are written into a Data Governance Agreement that the Nation's leadership or board approves before anything is built. Our public commitments are set out in our Data Sovereignty Commitment.
• Access: the Nation decides who can see its data, including us, joint-venture partners and operators, and can change that at any time.
• Possession: the data stays in the Nation's own account, under its stewardship, and the Nation can switch the system off and export everything.

OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC). We describe our practice as aligned with OCAP® principles. We are not certified by FNIGC, and we do not describe any tool or system as "OCAP compliant".

Métis and Inuit clients

OCAP® is a First Nations framework. For Métis- and Inuit-owned clients, we ask which data principles and governance the client follows, and we work to those principles as set out in our agreement with the client.

What we will not do

• use Indigenous community or member data for any purpose other than the work the client asked for;
• share member-level data with an operator, a joint-venture partner or anyone else without the client's written instruction;
• use a Nation's, community's or client's name, data or story to market our services without written permission; or
• speak for any Nation or community.

How we use AI tools ourselves

We use AI assistants in our own work, for example to draft documents and summarize our own notes. We use them only through business accounts, with settings that keep inputs from being used to train the provider's models where the provider offers that choice. We do not put client confidential information or personal information into any AI tool outside the client's own account unless the client has approved that tool in writing.

How long we keep information

• Inquiries and contacts that do not become clients: 24 months after our last contact, then deleted, unless you ask us to delete them sooner.
• Assessment results emailed to you: 24 months after our last contact, then deleted.
• Client business records (contracts, invoices, correspondence): as long as the law requires, usually 6 years for tax and accounting records.
• Client data inside a client's account: kept and deleted by the client under its own policies. Any copies we hold are returned or deleted at the end of the engagement.

Where we used your personal information to make a decision that directly affects you, we keep it for at least one year after that decision, as Alberta law requires.

Browser storage and cookies

The site does not set advertising or analytics cookies. It uses your browser's local storage for a few conveniences. These stay on your device, and you can clear them at any time in your browser settings.

The site loads fonts from Google Fonts, and the home page loads page styling from a content delivery network. Those services receive your IP address and browser details when the page loads, under their own privacy policies.

How we protect information

We protect personal information with reasonable security arrangements suited to how sensitive it is. These include business accounts with multi-factor authentication, access limited to people who need it, encrypted connections, service providers with recognized security practices, and confidentiality obligations for anyone who works with us. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Information and Privacy Commissioner of Alberta (and the Privacy Commissioner of Canada where it applies), as the law requires.

Your rights

You may ask us to:

• tell you what personal information we hold about you, how we have used it and to whom we have disclosed it;
• correct information that is wrong or incomplete;
• stop sending you marketing; and
• withdraw your consent to our using your information.

Email [email protected] with your request. We may ask you to confirm your identity. We will respond within 45 days, as Alberta's Personal Information Protection Act requires, and tell you if we need more time and why. There is no charge for a reasonable request.

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta, or, where federal law applies, the Office of the Privacy Commissioner of Canada.

Contact and changes

Our Privacy Officer is responsible for our compliance with this policy and answers questions about our privacy practices, including our use of service providers outside Canada.

Farai Kufakwedu, Privacy Officer, Oil Patch AI Systems Inc.
Email: [email protected]
Calgary, Alberta, Canada

This website is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children.

We may update this policy as our business and the law change. We will post the new version here with a new "last updated" date, and where a change is significant we will tell clients and contacts directly before it takes effect.