Purpose and scope
These data processing terms form part of the Terms of service. They apply when SlideMind processes personal information on behalf of a customer through the customer’s workspaces (“customer information”). They constitute the written mandate between the customer and SlideMind required by Québec’s Act respecting the protection of personal information in the private sector, and they serve the same purpose under any other privacy law that applies to the customer.
A data processing agreement signed separately with SlideMind prevails over these terms on the points it covers.
Roles
The customer, meaning the organisation or professional who holds the account, is responsible for customer information: it decides what is collected, for what purposes and for how long. SlideMind acts as its service provider and processes customer information only on its behalf.
SlideMind is responsible on its own account for the information it needs to run its business, such as account, billing, security and support information, as described in the Privacy policy.
Information covered
Depending on how the customer configures its activities, customer information may include:
- learner identifiers sent by a course or a learning platform;
- the values saved for each learner, such as answers, scores, roles, goals or reflections, and, where an activity is set up to save them, its conversations with the AI or their summaries;
- the messages learners send in AI activities, and the information the activity is set to include in its AI requests;
- the text of reference documents, where it contains personal information;
- the technical information recorded with each request, such as the IP address and the website that sent it.
The people concerned are mainly the customer’s learners, and the members of its workspaces.
Processing on instructions
SlideMind processes customer information only to provide the service described in the Terms of service. The customer’s instructions are those terms, the configuration of its workspaces and activities, and any other written instruction it gives us that the service can carry out.
SlideMind does not use customer information for its own purposes, does not sell it, does not use it for advertising and does not use it to train AI models. If the law requires SlideMind to process customer information otherwise, we inform the customer first, unless the law prohibits it.
Confidentiality
Only the people who operate the service, provide support or handle our legal obligations can access customer information, only when their task requires it, and they are bound to confidentiality. In the SlideMind portal, only the owners of a workspace can open a learner’s saved values, and each opening is recorded in the workspace’s activity log.
Security measures
SlideMind applies security measures suited to the sensitivity of customer information, including:
- encryption of all connections;
- encryption at rest of learner identifiers, saved learner values and provider API keys, with a separate key for each workspace;
- isolation of each workspace’s data in the database;
- encrypted backups whose decryption key is not kept on the production server;
- rate limits and monitoring of the public routes used by courses;
- access limited to what each task requires, and protected by two-factor authentication for the service’s administration.
Service providers
The customer authorises SlideMind to use the service providers listed in the Privacy policy to process customer information. SlideMind binds each of them by contract to protect the information it receives, to use it only to provide its service and to apply security measures suited to its sensitivity.
We announce any new service provider that will receive customer information at least 30 days in advance, by email to the account owners and on the Privacy policy. A customer that objects for a serious reason can tell us before the change takes effect. If we cannot offer a solution, the customer can end its subscription before the change takes effect and receive a prorated refund of the unused part of its subscription and of its unused purchased credits.
When a workspace uses its own AI provider API keys, that provider acts under the customer’s own agreement with it and is not a SlideMind service provider.
Communication outside Québec
The application, its database and its encrypted backups are hosted in Québec. Some service providers process customer information outside Québec, notably AI providers in the United States. Before communicating customer information outside Québec, SlideMind assesses the protection it will receive, including its sensitivity, the purposes of its use, the protection measures that will apply and the legal framework of the place where it will be processed. A summary of this assessment is available to customers on request.
Assistance to the customer
The console lets the workspace owner find, consult, export and delete a learner’s saved information, and set the retention periods of learner memory and interaction logs. If SlideMind receives a request from a person about customer information, we forward it to the customer without delay and do not answer it ourselves, unless the customer asks us to.
SlideMind provides the customer with the information it reasonably needs to meet its own obligations, such as answering a person’s request, carrying out a privacy impact assessment or answering a security questionnaire.
Confidentiality incidents
If SlideMind becomes aware of a confidentiality incident involving customer information, we notify the customer promptly, and in any case within 72 hours, with the information available at that time. We take reasonable measures to reduce the risk of injury and to prevent new incidents, keep a register of incidents and cooperate with the customer so that it can assess the risk and notify, where required, the people concerned and the Commission d’accès à l’information.
Retention, return and deletion
Customer information is kept according to the retention periods the customer sets and those described in the Privacy policy. The workspace owner can export customer information at any time from the console.
When a workspace is deleted, or when the customer closes its account, customer information is permanently deleted after the 30-day recovery period described in the Terms of service, then disappears from backups within 30 days. On request, SlideMind confirms in writing that the deletion was carried out. Information that a service provider has already received follows that provider’s retention rules, as described in the Privacy policy.
Information and audits
SlideMind provides on request the information reasonably needed to show that it meets these terms, such as a description of its security measures and answers to a security questionnaire. On-site audits are available only under a separate agreement.
Customer obligations
The customer is responsible for:
- collecting only the learner information its activities need and having a lawful basis for it;
- informing learners, in particular that an activity uses AI and what it saves, and obtaining the consents required, including a parent’s or guardian’s consent for a learner under 14;
- choosing learner identifiers suited to its activities, knowing that an email address directly identifies a person;
- setting retention periods suited to its purposes;
- not asking learners for sensitive information that its activities do not need.
Liability
The limits of liability in the Terms of service apply to these terms. On data protection matters, these terms prevail over any other provision of the Terms of service.
Technologies SlideMind
Sole proprietorship of David Guillemette
Québec enterprise number (NEQ): 2270629407
3891 rue Ethel
Montréal, Québec H4G 1S2
Canada
Phone: 514 688-6205
Person in charge of the protection of personal information: David Guillemette, privacy@slidemind.app
Support for customers: support@slidemind.app
General enquiries: info@slidemind.app or the contact form