Privacy Compliance

Our commitment

NextDoer is built to meet Canada's private-sector privacy laws: the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for personal information collected in British Columbia, the BC Personal Information Protection Act (PIPA). Our privacy program follows the ten fair information principles of PIPEDA Schedule 1.

This is our own assessment against those principles. PIPEDA has no official certification, and we do not claim one. How we handle personal information day to day is set out in our Privacy Policy.

Our role

• For the customers of the businesses we serve (a renter writing to a landlord, a caller to a clinic, a patient whose document reaches a physician), the business is responsible for that information. NextDoer is its service provider: we handle it only on the business's instructions, under a written agreement.
• For the people who use NextDoer on behalf of a business (Business App users, billing contacts), NextDoer is responsible for that information.

The ten principles and how we meet them

1. Accountability. A named Privacy Officer, Mo Kaam, is accountable for our compliance (info@nextdoer.com). Our written privacy program is reviewed every year. Each business we serve signs a data processing agreement, and we keep a register of every service provider that receives personal information.
2. Identifying purposes. We state why we use information in our privacy policy and in each business's agreement. Every process the system runs is written down as a defined process before it runs.
3. Consent. The business obtains its customers' consent; we process only on its instructions. When a customer says they want to stop, the conversation process sends them no further automated messages. For health information, the physician obtains consent as custodian of the records.
4. Limiting collection. Each process collects only the fields declared for it. Every database table and column we hold is classified in a data register, and an automatic check fails any change that adds one without classifying it.
5. Limiting use, disclosure and retention. We do not sell personal information, use it for advertising, or use it to train AI models. Before text is sent to an AI model, phone numbers, email addresses and identity numbers are replaced with placeholders and access credentials are removed. Data shown to our own developers for support and debugging is masked first, and every such access is logged. Each business has its own retention periods; where the business has switched it on, a daily job erases records once their period has passed. Encrypted backups are kept for up to one year.
6. Accuracy. Details a customer gives (dates, phone numbers, names) are checked field by field before they are used. The business can correct or replace any reply from its app, and anyone can ask us to correct their information.
7. Safeguards. Our servers and backups are in Canada (Amazon Web Services, Canada (Central) region). Stored data is encrypted at rest, backups are encrypted before they leave the server, and every connection is encrypted. Sign-in uses one-time codes, each person sees only what their role allows, and a person removed from a business's account loses access at once. A business's website logins stay in the browser on its own computer; we never ask for its passwords.
8. Openness. Our privacy policy and this statement are public, and the service providers that receive personal information are listed below.
9. Individual access. Anyone can ask to see, correct or delete the personal information we hold about them. We answer within 30 days. A request about a business's customer is passed to that business within two business days, and we help the business answer it.
10. Challenging compliance. Questions and complaints go to our Privacy Officer at info@nextdoer.com. If you are not satisfied with our answer, you may complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

Privacy breaches

We record every privacy breach and assess whether it creates a real risk of significant harm. Where it does, we report it to the Privacy Commissioner and notify the people affected. When a breach involves a business's customer data, we tell the business without unreasonable delay, with a target of 72 hours.

How we protect information sent to AI models

Before any text leaves our servers for an AI model, our own software — running on our servers in Canada, without any AI — finds personal details such as phone numbers, email addresses, health and identity numbers, card numbers and login credentials, and replaces them with placeholders. The model works only with the placeholders; the real values are put back on our servers after it answers. Health records go further: in Sealed Mode they are de-identified on the clinic's own computer before anything reaches us. Some content cannot be masked this way — images, text converted to speech, and call audio sent for transcription.

Health information and Sealed Mode

For businesses with especially sensitive records, such as a clinic's patient files, we offer Sealed Mode. The records are read and personal identity is removed on the business's own computer; our servers can only request a short, fixed list of named operations and receive their de-identified results. The business can see every operation, switch any of them off, and keeps a log of everything that ran. We have no remote access to that system unless the business opens a time-limited window itself.

Security in depth

Beyond the safeguards above, several protections are built into the system itself rather than left to procedure:

• An audit trail that cannot be rewritten. Every action the system takes is recorded in an append-only log; the database itself refuses any edit or deletion of a past entry.
• No duplicate actions. Every write to an outside system carries a deterministic idempotency key, so a retried action can never happen twice.
• Keys stored only as hashes. API keys are kept as cryptographic hashes — the plaintext is shown once and never stored; webhook deliveries are signed (HMAC) and sent over https.
• Defence against prompt injection. Text from customers and outside websites is wrapped in a data fence inside every AI prompt, so the model treats it as content to analyse, never as instructions to follow.
• Outbound-only connections from your machines. The NextDoer Connector reaches us through an encrypted tunnel it opens itself; it needs no inbound opening on the business's network or firewall.
• Card details never reach us. In-call payments are collected directly by Twilio (PCI DSS Level 1); we keep only the result and the processor's confirmation code.

Where information is processed

Our servers and backups are in Canada. Some of the service providers below process information outside Canada, mainly in the United States, where it may be accessible to authorities under local law.

For businesses

Before we start, we sign a data processing agreement with you. For sensitive data we complete a privacy impact assessment with you and recommend Sealed Mode. Our agreement template, privacy impact assessment and control matrix are available on request from info@nextdoer.com.

Contact

Privacy Officer: Mo Kaam, info@nextdoer.com.