Privacy Policy

01Who we are

This Privacy Policy is issued by Spare Technology Inc. (French legal name Technologie Spare inc.), a corporation incorporated under the Québec Business Corporations Act, with its head office in Montréal, Québec, Canada (“Spare”, “we”, “us”).

For the personal information described in this Policy, Spare decides why and how the information is processed. Spare is therefore the organization responsible for it under Canadian and Québec law, and the controller under the EU and UK General Data Protection Regulation (GDPR) and comparable laws.

Our person in charge of the protection of personal information is identified in Contact us.

02Scope

This Policy applies to personal information we process when you:

• visit spareaige.com, spareaige.ai and their regional mirrors hk.spareaige.com and hk.spareaige.ai (the “Website”);
• submit a workflow, demo or contact request;
• use the question assistant on the Website;
• communicate with us by email or in meetings, or act for a customer, prospect, supplier or partner.

Customer data in the Service. When an organization uses Spare AIGE under a signed agreement, Spare processes the files, prompts, outputs, operation logs and account information of that organization (“Customer Data”) on the customer’s behalf and on its instructions, as its service provider or processor. That processing is governed by the customer agreement and, where applicable, a data processing agreement, which prevail over this Policy. Requests about Customer Data should be sent to the customer that controls it; we will assist the customer as required by law.

This Policy does not apply to third-party websites or services linked from the Website.

03Information we collect

Your name, business email address and company are required for us to respond to a request; without them we cannot follow up. Other fields are optional. Website analytics do not record what you type into forms. We do not request sensitive personal information such as health, biometric or government identification data. Please do not include it in forms, emails or assistant questions.

04How we use information

We use personal information only for the purposes below. The last column states the legal basis we rely on where the GDPR or a similar law requires one.

We do not make decisions based exclusively on automated processing that produce legal or similarly significant effects on you. We do not sell personal information collected through our forms, emails or the Service.

05Confidentiality of engineering data

Customers and prospects entrust us with information that often represents their core know-how. We apply the following commitments to it, in addition to any non-disclosure or customer agreement.

What we treat as confidential

Drawings, 2D and 3D models, CAD, CAM, CAE, EDA, BIM and GIS files, toolpaths and NC programs, schematics and PCB layouts, source code, bills of materials, process parameters, test and simulation results, specifications, standards used internally, pricing, and any other information that is marked as confidential or that a reasonable person would understand to be confidential, including information shared before a contract is signed.

How we limit its use

• Used only to perform the evaluation or service you requested.
• Not used to train or fine-tune artificial intelligence models, whether ours or those of our providers.
• Not sold, rented or disclosed, except to providers bound by confidentiality obligations and needed to deliver the service, or where disclosure is required by law.
• Accessible only to personnel who need it for the engagement and who are bound by written confidentiality obligations.

Where it stays

The AI model provider is chosen by region and deployment, and can be a local model. Before a cloud deployment we tell you which providers process your data.

Before you share files

• Do not upload confidential files through the Website form or assistant. For an evaluation, we sign a non-disclosure agreement with you first and agree on a transfer method.
• Do not provide export-controlled technical data (for example under the U.S. ITAR or EAR, or Canada’s Export Control List) or classified information unless an offline deployment has been agreed in writing.

Return and deletion

At the end of an evaluation or agreement, we return or delete files you provided within 30 days of your request or as set out in the agreement. Copies in backups are deleted on the normal backup cycle, and records we must keep by law are retained only for that purpose.

06Security measures

We protect personal information and Customer Data with measures proportionate to their sensitivity:

Organizational measures

• Access on a need-to-know basis; personnel and contractors bound by written confidentiality obligations.
• A designated person in charge of the protection of personal information, accountable for this Policy.
• Assessment of the privacy and security practices of providers before we engage them, and contracts requiring them to protect the information.
• A procedure for handling and recording confidentiality incidents (see Confidentiality incidents).

Technical measures

• All Website and Service traffic encrypted with TLS 1.2 or TLS 1.3; older protocols are refused.
• API keys and credentials stored only on servers with access restricted to administrators; never embedded in web pages.
• Server logs readable only by administrators and deleted automatically after 30 days.
• Rate limiting and request size limits on forms and the assistant.

Controls available to customers

• Integration with company accounts and role-based permissions, so each member accesses only the applications granted.
• Exportable operation logs recording, for each step, the software, the action and the file concerned.
• Step-level rollback and re-execution of tasks.
• Private and offline deployment, with offline update packages for isolated networks.

On request, we answer customer security questionnaires and can agree on additional contractual security measures. No method of transmission or storage is completely secure, but we work to correct weaknesses promptly.

07Confidentiality incidents

If we become aware of unauthorized access to, use, disclosure or loss of personal information or Customer Data, we act promptly to reduce the risk of harm and prevent recurrence. We record every incident in an incident register.

• Where an incident presents a risk of serious injury, we notify the Commission d’accès à l’information du Québec and the persons concerned, as required by Québec law, and report to the Office of the Privacy Commissioner of Canada where required.
• Where the GDPR applies, we notify the competent supervisory authority within 72 hours of becoming aware of a notifiable breach.
• We notify affected customers without undue delay and no later than 72 hours after confirming an incident affecting their Customer Data, with the information they need to meet their own obligations.

08Governance and accountability

Spare’s governance of personal information, approved by the person in charge of the protection of personal information, provides that:

• Roles. The person in charge oversees compliance with this Policy, approves retention periods, handles requests and complaints, keeps the incident register and conducts privacy impact assessments. Personnel access personal information only as needed for their duties and are trained on these rules.
• Privacy impact assessments. An assessment is carried out before any project to acquire, develop or overhaul an information system that involves personal information, and before personal information is communicated outside Québec.
• Retention and destruction. Each category of information has a defined retention period (see Retention). At the end of that period, electronic records are securely deleted or anonymized; backups are overwritten on their normal cycle.
• Service providers. Providers receive only the information needed for their service, under a written agreement that requires them to protect it, use it only for that service, and notify us of any incident.
• Complaints. Complaints about our handling of personal information can be sent to the person in charge. We acknowledge them promptly, respond in writing within 30 days, and explain how to escalate to the competent authority.

09Cookies and similar technologies

Off by default. Analytics and advertising cookies, and any technology that could identify, locate or profile you, are deactivated until you accept them. You can accept or reject each category separately, and change your choice at any time with the “Cookie settings” link at the bottom of each page. Without consent, the Website records only the server logs described in Information we collect.

Advertising. If you accept advertising cookies, third-party vendors, including Google, use cookies to serve ads based on your prior visits to this Website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and other sites, and to track your browsing across websites over time. You can opt out of personalized advertising at Google Ads Settings or aboutads.info.

Browser signals. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of personalized advertising and only non-personalized ads are requested. Because there is no common standard for Do Not Track signals, we do not respond to them otherwise.

You can also delete or block cookies in your browser. Google’s use of data is described at policies.google.com/technologies/partner-sites.

10Website assistant

The assistant answers questions about Spare using a large language model. Your messages are sent through Spare’s AI gateway to OpenAI (United States). For visitors in mainland China served by our Hong Kong mirror only, DeepSeek (People’s Republic of China) is used if OpenAI is unavailable. Spare does not use these messages to train models.

• The Website does not keep a transcript of your conversation after the answer is delivered.
• Model providers process messages to generate answers and may retain them for a limited period for security and abuse monitoring under their own terms.
• Answers are generated automatically and may be inaccurate. They are not an offer, quotation or engineering advice.
• Do not enter personal information about other people, or confidential business or technical information.

11How we share information

We disclose personal information only to the recipients below, only to the extent needed, and under contracts requiring them to protect it and use it solely to provide services to us.

We may also disclose information to professional advisers under a duty of confidentiality; to authorities where required by law or a valid legal order, after verifying the request and disclosing only what is required; to a successor in a merger, acquisition or sale of assets, subject to equivalent protections; or to others with your consent.

12International transfers

Spare is based in Canada and stores Website data in Canada. As shown in How we share information, some providers process information in Hong Kong SAR, the United States and the People’s Republic of China, where privacy laws may differ from those in your jurisdiction. Information processed in another country may be accessible to the courts, law enforcement and national security authorities of that country.

• Before communicating personal information outside Québec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purpose, the safeguards and the legal framework of the destination, and we put a written agreement in place.
• The European Commission recognizes Canada as providing adequate protection for organizations subject to Canada’s federal private-sector privacy law.
• For onward transfers from the EEA, the UK or Switzerland to countries without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents, together with supplementary measures where needed.

13Retention

When a retention period ends, we delete or anonymize the information.

14Your rights

Depending on where you live, you may have the right to:

• know whether we hold personal information about you, and access it;
• have inaccurate, incomplete or outdated information corrected;
• have information deleted, or stop its dissemination or de-index it where the law provides;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• restrict certain processing, and object at any time to processing based on our legitimate interests, and to direct marketing;
• receive information you provided in a structured, commonly used technological format, and have it transferred to another organization;
• be informed of the personal information used to make a decision based exclusively on automated processing, and have it reviewed;
• file a complaint with a data protection authority.

To exercise these rights, write to the contact in Contact us. We may ask for information to verify your identity. We respond within 30 days, or within the shorter period required by your local law, free of charge unless a request is manifestly excessive. If we refuse a request, we explain why and how you can challenge the decision.

15Information for specific regions

The following supplements apply in addition to the rest of this Policy where the laws of your place of residence apply.

Overseas recipients

This table provides the information on cross-border transfers required by several laws, including the laws of the People’s Republic of China, South Korea and Japan. Transfers take place over encrypted connections (TLS) at the time you submit a form or send a question, or continuously for hosting.

You can refuse these transfers by not submitting forms or using the assistant and by rejecting cookies; in that case we may be unable to respond to a request.

Canada and Québec

We comply with the Act respecting the protection of personal information in the private sector (Québec) and the Personal Information Protection and Electronic Documents Act (Canada). You may send a written request to access or correct your information, to obtain it in a structured, commonly used technological format, or to have its dissemination stopped or a hyperlink de-indexed; we respond within 30 days. You may file a complaint with the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

European Economic Area, United Kingdom and Switzerland

Spare Technology Inc. is the controller. The legal bases for each purpose are listed in How we use information. You have the rights of access, rectification, erasure, restriction, objection and data portability, and the right to withdraw consent. Transfers are described in International transfers; you can obtain a copy of the safeguards by contacting us. You may lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement, including the UK Information Commissioner’s Office and the Swiss Federal Data Protection and Information Commissioner.

United States

Categories of information, sources, purposes and recipients are described above. We do not sell personal information for money. Advertising cookies, if you accept them, may be considered “sharing” for targeted advertising under some state laws; you can opt out by rejecting advertising cookies or by sending a Global Privacy Control signal. You may request access, correction or deletion as described in Your rights, and we will not discriminate against you for exercising them.

Japan

Personal information is used only for the purposes stated in How we use information. Security control measures are described in Security measures. Personal information is provided to recipients in the countries listed in Overseas recipients; information on the personal information protection systems of those countries is published by the Personal Information Protection Commission of Japan. You may request disclosure, correction, suspension of use or deletion, and disclosure of records of provision to third parties, by contacting us; no fee is charged.

South Korea

• Items, purposes and retention: as described in Information we collect, How we use information and Retention.
• Provision to third parties and entrustment: we do not provide personal information to third parties for their own purposes; processing is entrusted to the recipients in Overseas recipients.
• Overseas transfer: the items, destination countries, time and method of transfer, recipients, purposes and retention periods are listed in Overseas recipients. Transfers are based on your consent given when you submit the form. You may refuse by not submitting the form; we will then be unable to respond to your request.
• Destruction: when the retention period ends, electronic files are permanently deleted using methods that prevent recovery.
• Cookies: see Cookies and similar technologies. You can refuse cookies in the cookie settings or in your browser.
• Rights and remedies: you may request access, correction, deletion or suspension of processing. You may also seek assistance from the Personal Information Protection Commission, the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
• Privacy officer: Privacy Officer, Spare Technology Inc., privacy@spareaige.com.

People’s Republic of China

We process personal information of individuals in mainland China on the basis of consent. When you submit the form or use the assistant, you give separate consent to the transfer of your information to the recipients outside mainland China listed in Overseas recipients, for the purposes and in the manner described there. You may exercise your rights to know, decide, access, copy, correct, delete and withdraw consent, and to request an explanation of these rules, by contacting us. You can turn off personalized advertising by rejecting advertising cookies.

Brazil

You have the rights provided in article 18 of the Lei Geral de Proteção de Dados (LGPD), including confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing and about the possibility of refusing consent, and withdrawal of consent. Our data protection officer (encarregado) can be reached at privacy@spareaige.com. You may petition the Autoridade Nacional de Proteção de Dados (ANPD).

Mexico, Argentina, Chile, Colombia and Peru

You may exercise your rights of access, rectification, cancellation and objection (ARCO rights) and the other rights provided by your local law by writing to privacy@spareaige.com, indicating your name, the right you wish to exercise and a means of contact. In Argentina, the Agencia de Acceso a la Información Pública, as the supervisory authority under Law No. 25,326, has the power to hear complaints and claims filed by anyone whose rights are affected by non-compliance with the rules on personal data protection. You may also contact the competent authority in your country, including the Superintendencia de Industria y Comercio (Colombia) and the Autoridad Nacional de Protección de Datos Personales (Peru).

Australia

We handle personal information consistently with the Australian Privacy Principles. Overseas recipients are listed in Overseas recipients. You may request access or correction, and complain to us; if you are not satisfied, you may contact the Office of the Australian Information Commissioner.

16Children

The Website and the Service are intended for businesses and are not directed to children. We do not knowingly collect personal information from persons under 16. If you believe a child has provided information to us, contact us and we will delete it.

17Changes to this Policy

We update this Policy when our practices or the law change. The effective date appears at the top of this page. If a change materially affects how we use personal information already collected, we will inform you by a notice on the Website and, where we have your contact details, by email before it takes effect, and obtain your consent where the law requires it.

18Contact us

Person in charge of the protection of personal information
Privacy Officer, Spare Technology Inc.
Email: privacy@spareaige.com
Montréal, Québec, Canada

For other questions: contact@spareaige.com.

If you are not satisfied with our response, you may contact the data protection authority where you live or work, including the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) and the Office of the Privacy Commissioner of Canada (priv.gc.ca).