1. Data controller (Law 25 art. 8)
Anynos Inc. operates the Anynos platform. The postal address + designated privacy officer contact are published at anynos.com.
For any question, access request, rectification, or consent withdrawal: privacy@anynos.com.
2. Purposes
Building, occupant, and consultant data is processed exclusively to (a) compute + export a BOMA BEST 4.1 (or other enabled framework) certification, (b) generate proposals and drafts that your consultants then dispose of, (c) meet contractual requirements.
No data is resold, shared for advertising, or used to train third-party models.
3. Legal basis
Explicit consent collected during onboarding (Law 25 art. 12-14). Consent can be withdrawn at any time via privacy@anynos.com.
4. Sub-processors (Law 25 art. 17)
Anynos relies on the sub-processors listed below. Each is bound by a signed Data Processing Agreement (DPA). This list is versioned in git (docs/SUB-PROCESSORS.md) — material changes are notified 30 days in advance via privacy@anynos.com.
• Supabase Inc. (PostgreSQL + Auth + Storage) — region West US (Oregon). Data: user profiles, building data, evidence documents, scores.
• Anthropic PBC (Claude — AI agents) — region US default, CA available (ANTHROPIC_RESIDENCY=ca). Data: document excerpts (PII pre-redacted) + BOMA credit text.
• OpenAI L.L.C. (text-embedding-3-small) — region US. Data: short excerpts of public BOMA guide chunks. NO PII or customer data.
• Resend Inc. (transactional email + alerts) — region US. Data: recipient addresses + email bodies (no building PII).
• Vercel Inc. (Next.js hosting) — us-east-1 default. Data: access logs. No PII.
• Fly.io (Python engine hosting) — iad default. Data: compute requests (codes + scores). No PII.
5. Cross-border transfers (Law 25 art. 17 §3)
Transfers to the United States are assessed before each deployment. Transfers of sensitive evidence (PII) always pass through our redaction agent (evidence_redactor), which strips PII spans before any LLM call.
You may require 100% Canadian processing by enabling ANTHROPIC_RESIDENCY=ca in your deployment.
6. Retention
Documents: retained while the mandate is active + 7 years after the last certification (BOMA audit requirement + Québec Civil Code art. 2925).
Audit logs: 7 years.
Sessions: expire after 1 hour of inactivity.
Deletion on request: within 30 days, subject to legal retention obligations.
7. Your rights
Access, rectification, deletion, portability, consent withdrawal. Request to privacy@anynos.com, response within 30 days.
Right to lodge a complaint with the Commission d'accès à l'information du Québec if you are not satisfied with our response.
8. Privacy incidents (Law 25 art. 28)
Any incident likely to present a serious risk is reported to the CAI + affected individuals within 72 hours. The incident runbook lives in docs/RUNBOOK.md.
9. Security measures
TLS encryption in transit + encryption at rest for uploaded files. Multi-tenant RLS on PostgreSQL. Immutable audit log. Annual external penetration tests. Public threat model in docs/THREAT-MODEL.md.