Law 25 Compliance Disclosure — SENTINEL OS

Version 1.0 — Last updated: May 11, 2026 Master document: French version (legal authority in Quebec). This English version is a courtesy translation.

Preamble

This disclosure is published by SENTINEL OS ("the enterprise", "we") to fulfil its obligations as a private-sector enterprise (entreprise) under the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as modernized by the Act to modernize legislative provisions as regards the protection of personal information ("Law 25", assented to on September 22, 2021).

This document is separate from our general Privacy Policy. Its sole purpose is to detail Quebec-specific obligations and serves as the priority reference for any Quebec resident and for the Commission d'accès à l'information du Québec.

If there is any discrepancy between the French and English versions, the French version prevails.

1. Identification of the Person in Charge (s. 3.1)

The Person in Charge is the official contact for any request for access, rectification, withdrawal of consent, portability, cessation of dissemination, or any complaint prior to recourse to the Commission.

2. Exhaustive List of Personal Information Collected

2.1 Waitlist (public site)

Full name; business email; role; affiliated company; fleet size (declared range); optional free-form message.

2.2 SaaS user account

Identifiers (email, hashed password, auth tokens); language/notification preferences; connection IP, device type, auth log.

2.3 Transport operational data

VINs (treated as personal information when linkable to an identified or identifiable driver); GPS positions in service; photographs; voice recordings of the in-cab voice copilot.

2.4 Payment data

Tokenized via Stripe (we never store the full card number); billing details; transaction history.

2.5 Customer communication

Email, SMS, telephony exchanges (Twilio); generated voice synthesis (ElevenLabs).

2.6 Cookies

See section 11.

3. Purposes of Collection (s. 8, as amended)

No use for other purposes without separate free, informed and specific consent.

4. Basis for Communication and Processing

• Free, informed and specific consent (s. 14)
• Contractual necessity — operational data
• Serious and legitimate commercial interest (s. 12, para. 1) — security, fraud prevention, logging
• Legal obligation — tax records, authority orders

Consent may be withdrawn at any time (section 9).

5. Retention and Destruction (s. 23)

Anonymization-vs-destruction: anonymization preferred where technically irreversible, per the 2024 Criteria for the Anonymization of Personal Information.

6. Communication to Third Parties (Sub-processors)

Each sub-processor is bound by a contract imposing protections equivalent to those required by Law 25 (adapted SCCs, confidentiality, use restrictions, incident-notification).

7. Communication Outside Quebec (s. 17)

A Privacy Impact Assessment is conducted prior to any communication to a US-located sub-processor.

Criteria evaluated

1. Nature of the information — variable sensitivity
2. Purpose — strictly tied to the contracted service
3. Protection measures — TLS 1.3, AES-256, RBAC, logging, SCCs, SOC 2 / ISO 27001
4. Applicable legal regime — acknowledged as not materially equivalent on every point; compensated by reinforced contractual undertakings

Conclusion

Communication is authorized because contractual, technical, and organizational measures provide a level of protection equivalent to that required in Quebec, per s. 17. The assessment is documented, dated, kept by the Person in Charge, and updated annually or upon substantial change.

8. Automated Decisions (s. 12.1)

Identified

• Bid suggestions on vehicles
• Margin predictions and profitability alerts
• Dispatch routing and A/B/C options
• Driver reputation scoring

Rights

• Be informed of the information used, the principal factors, parameters, and consequences
• Submit observations to an employee able to review
• Request rectification of the information used
• Human review by the Person in Charge or delegate, within 30 days

Send requests to privacy@sentinel-os.ca with subject "Automated decision — s. 12.1".

9. Rights of Data Subjects

How to exercise rights

• Channel: privacy@sentinel-os.ca or postal mail
• Identity: reasonable proof required
• Response deadline: 30 days from receipt
• Cost: free, unless manifestly abusive
• Refusal: justified in writing with available recourse

10. Confidentiality Incidents (ss. 3.5–3.8)

1. Detection and containment — automated Sentry and Supabase alerts
2. Risk assessment within 72 hours
3. Notification to the Commission if risk of serious harm
4. Notification to data subjects if risk of serious harm
5. Incident register kept for 5 years (mandatory under s. 3.8)

11. Solicitation and Cookies

11.1 Commercial solicitation

No waitlist information is sold. Commercial messages include an unsubscribe mechanism.

11.2 Cookies

Refusal is as easy as acceptance, per Commission guidance.

12. Biometrics and Digital Identity

The enterprise does not currently collect biometric characteristics within the meaning of CQLR c. C-1.1, ss. 44–45. The voice copilot transcribes voice content and does not perform voice-print identification. Any future biometric function would require prior declaration to the Commission, express separate consent, and a policy update.

13. Minors

Service not directed at persons under 16. No intentional collection from minors under 14. If discovered, destroyed without delay.

14. Complaint to the Commission d'accès à l'information du Québec

It is recommended, though not mandatory, to first submit the request internally to the Person in Charge.

15. Version History

Reviewed at least annually and upon any substantial change. Material changes are notified by email and persistent banner for 30 days.

Document approved by the Person in Charge of the Protection of Personal Information — Yaovi Houndenou, May 11, 2026.