Privacy Policy

1. Person in charge of the protection of personal information

The person in charge of the protection of personal information is the person with the highest authority within AMRI Consulting. You can reach them at vieprivee@amricanada.com, or by mail: Person in charge of the protection of personal information, AMRI Consulting, 1819 Jean-Talon Street East, Suite 150, Montreal, Quebec H2E 1T4, Canada.

2. Information we collect

• Identity and contact details: last name, first name, date of birth, email, phone number, mailing address.
• Immigration profile: education, work experience, language test results, family situation, available funds and answers to the eligibility test.
• Documents you upload (identity documents, diplomas, bank statements, employment letters, etc.).
• Exchanges with us: messages, appointments, follow-up notes on your file.
• Account and security: username, password (stored only in irreversibly encrypted form), passkeys, two-factor authentication.
• Technical data: truncated IP address, browser and device type, login logs, date of last activity in the client space.

We only collect what your project requires. If you send us information about a family member, you confirm you are authorized to do so and to inform them of this policy. For a person under 14, we collect their information with the consent of the person having parental authority.

3. Why we use it

• Assess your eligibility for study and immigration programs.
• Prepare, check and track your file, then submit it to the competent authorities with your agreement.
• Communicate with you (emails, notifications, appointments).
• Send you our advice and offers by email, only if you agreed; every message lets you unsubscribe.
• Manage the billing of our fees.
• Secure accounts and prevent fraud.
• Measure site traffic to improve it, only if you accept.

We never sell, rent or trade your personal information.

4. Artificial intelligence and automated decisions

We use Google's Gemini service for the client space assistant, automatic document checks (readability, document type, consistency), drafting help for our advisors, sorting messages received at our contact address (the sender's name is masked before sending) and preparing internal summaries without personal identifiers.

Your name, email and phone number are not sent to the assistant. However, a document that is checked automatically is sent as is to Google for analysis: the information it contains (for example on an identity document) is therefore shared with this provider. We use the paid tier of the Gemini API: under Google's terms, the content sent is not used to train its models and is kept only as long as needed to detect abuse.

You can refuse this in the Settings of your client space or of the app, under "Automatic document check": your documents are then checked only on our servers.

Two tools produce an automatic result: the eligibility test, which gives an indicative estimate later reviewed by an advisor, and the check of a job offer's criteria, which can screen out an application. In the second case, you are told the result and the unmet criteria at that moment; you can ask a member of our team to review your application again and submit your comments by writing to contact@amricanada.com.

5. Disclosure of your information and service providers

Depending on your project, we disclose your information, with your agreement, to immigration authorities (IRCC, Quebec's immigration ministry, provinces), educational institutions and the employers concerned. If a partner referred you to us, they see your name and the progress of your file, never your documents. Our Rabat (Morocco) team accesses the files it handles.

Your data is hosted in Canada, on OVHcloud servers. Our email service runs on these same servers. Some providers process data outside Quebec and Canada, notably in the United States:

• Google (Gemini): artificial intelligence described in section 4.
• Google (Analytics and Tag Manager): audience measurement, only after your consent.
• Google Maps: map of our offices on the Contact page, only if you choose to display it.
• Dropbox: daily backup copy, encrypted before upload and kept for 30 days.
• Sentry: technical error detection; reports may contain technical data such as the IP address.
• Expo and phone and browser notification services (Google, Apple, Mozilla): delivery of the notifications you have enabled.
• Jitsi Meet: video consultations, when an online appointment is scheduled.
• WhatsApp (Meta): if you choose to write to us or call us via WhatsApp.

These providers act only on our behalf, for the purposes described above and under their contractual data protection commitments. When processed abroad, your information is subject to the laws of that country and may be disclosed to its courts or public authorities in accordance with those laws.

6. Retention period

• Client file: for the full duration of our mandate, then for as long as our legal and professional obligations require, generally up to 7 years after it is closed.
• Deleted account: access closed immediately and information destroyed within 30 days, except the contract, invoices and documents the law requires us to keep; these are archived with restricted access, then destroyed at the end of the legal period (7 years).
• Eligibility test with no follow-up (refused or interrupted): 30 days. Without consent, the answers are not kept.
• Information request with no follow-up: deleted once no longer useful, or upon simple request.
• Job applications: 12 months.
• Technical and visit logs: 13 months.
• Backups: 14 days on our servers and 30 days at Dropbox; deleted data disappears from backups when this period expires.

After these periods, the information is destroyed or anonymized.

7. Security

All communications are encrypted (HTTPS). The documents you upload (identity documents, statements, contracts, attachments) are encrypted on our servers. Passwords are stored in irreversibly encrypted form, and two-factor authentication and passkeys are available. Only team members who need it to process your file can access it, according to their role, and access is logged.

In the event of a confidentiality incident presenting a risk of serious injury, we promptly notify the Commission d'accès à l'information and the persons concerned.

8. Your rights

• Access your information and obtain a copy, including in a structured, commonly used technological format.
• Have inaccurate, incomplete or ambiguous information corrected.
• Withdraw your consent, subject to our legal obligations.
• Request the deletion of your information or the de-indexing of any information that has been disseminated.
• Be informed of the information used for a decision made by automated processing and submit your comments (section 4).

Write to vieprivee@amricanada.com. We respond within 30 days. If you are not satisfied, you may contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

9. Cookies

Essential cookies handle client space login, language and remembering your consent choice. They cannot be disabled without preventing the site from working.

Audience measurement cookies (Google Analytics) are only set if you click "Accept" in the banner; no advertising cookies are used. You can change your mind at any time with the "Manage cookies" link at the bottom of every page; refusing deletes any measurement cookies already set.

Our internal visit counter uses no cookies: it records the page viewed, the truncated IP address, the browser type and, if you are logged in, your account, to measure traffic. These logs are kept for 13 months.

10. People in Morocco

When your information is collected by our Rabat office or from people residing in Morocco, its processing is also governed by Law No. 09-08 on the protection of individuals with regard to the processing of personal data. You have the right of access, rectification and objection, which you exercise with the person in charge (section 1).

This information is transferred to Canada, where it is hosted, and, for the services described in section 5, to the United States, with the express consent you give at the time of collection. You may refer a matter to the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP, www.cndp.ma).

11. Complaints and governance

Any complaint about your personal information can be sent to the person in charge (section 1). We acknowledge receipt within 5 business days and respond in writing within 30 days. Our retention schedule is summarized in section 6.

12. Changes

We may update this policy. The date of the last update appears at the top of the page; in the event of a significant change, we will inform you in your client space or by email.