AI Usage & Data Governance Policy – SturdyCloud IT Ltd.

Effective Date: April 2, 2026

Last Updated: July 6, 2026

Legal Entity

For this policy, SturdyCloud IT Ltd. is the company legal name and the responsible legal entity unless a separate written agreement states otherwise.

Where this policy uses “SturdyCloud,” “we,” “our,” or “us,” it refers to SturdyCloud IT Ltd. and its websites, platforms, services, AI-enabled workflows, and client-facing systems.

1. Purpose

This AI Usage & Data Governance Policy outlines how SturdyCloud IT Ltd. ("SturdyCloud") designs, deploys, and manages artificial intelligence (AI) systems responsibly.

Our goal is to ensure AI is used in a way that is:

Secure
Transparent
Accountable
Human-centred
Privacy-aware
Accessible

This policy applies to all AI-powered tools, platforms, workflows, and services provided by SturdyCloud.

2. Scope of AI Systems

This policy applies to:

AI-powered applications, including ProposalZen or similar systems
AI Office Setup and AI Office Support workflows
AI Office Extension call-answering, support, booking, lead qualification, payment reminder, and logistics workflows
AI Operations Partner systems
AI-native B2B SaaS products and client-specific AI software
AI agents and assistants
Workflow automation systems with AI components
Content generation, summarisation, and decision-support tools
Retrieval-augmented generation, document analysis, and knowledge-base workflows
Integrations with third-party AI providers or self-hosted AI models

3. Core Principles

a. Human Oversight

AI is designed to support—not replace—human decision-making.

Human review is required before any material action is taken.
Users retain full responsibility for decisions.
High-risk workflows require clearer review, escalation, and approval points.

b. Transparency

Users are informed when AI is used where practical and appropriate.
Limitations of AI systems are disclosed.
Client-specific workflows should document where AI is used and what data it processes.

c. Accountability

AI systems include safeguards and guardrails.
Outputs and workflows are monitored for misuse or unintended behaviour where support scope allows.
Prompt, configuration, and workflow changes should be tracked where appropriate.

d. Privacy & Data Protection

AI systems are designed to minimise and protect data usage.

Data collection is limited to what is necessary.
Processing aligns with applicable laws, including PIPEDA.
Where applicable, processing should be GDPR-aware and documented for client-specific requirements.
Sensitive or regulated data should not be submitted unless approved under a secured engagement.

e. Security

Secure infrastructure
Controlled access
Monitoring and logging
Secrets management
Least-privilege access
Separation between public demo data and client data

f. Fairness & Responsible Use

Avoid harmful, misleading, or discriminatory outputs.
Promote lawful and ethical use of AI.
Avoid using AI systems to create deceptive, manipulative, harassing, discriminatory, or unlawful content.

g. Accessibility

AI-enabled experiences should be designed with WCAG 2.2 AA as the development target where applicable.

4. AI Risk Classification

SturdyCloud categorizes AI use cases based on risk level.

Low Risk

Content drafting
Internal summaries
Productivity tools
Internal brainstorming
Non-sensitive prompt libraries

Medium Risk

Client-facing outputs
Workflow recommendations
Automated suggestions requiring review
Customer support drafts
Lead qualification support
Scheduling or routing suggestions

High Risk

Regulated workflows
Sensitive data processing
Actions with financial, legal, employment, health, safety, procurement, or operational impact
Voice or call-answering systems that collect sensitive information
Automated customer-impacting decisions

Higher-risk use cases require stricter controls, validation, and human oversight.

5. AI Use Case Review & Approval

Before deployment, AI use cases are evaluated to ensure:

appropriate use of data
alignment with privacy and security expectations
suitability for the intended business purpose
presence of human review checkpoints
accessibility considerations for users who interact with the system
CASL-aware consent and unsubscribe handling for outreach or messaging workflows
GDPR-aware handling where EU/EEA, UK, or international personal data may be in scope

Use cases may be adjusted, restricted, or declined if they introduce unacceptable risk.

6. Data Handling & Usage

a. User Data

Users may submit:

Business data
Documents and workflows
Structured or unstructured content
Support requests and customer communications
Call, booking, or scheduling details where applicable

Users are responsible for ensuring they have the right to use and submit this data.

b. Data Processing

Data is processed only to:

deliver services
generate outputs
improve system reliability and performance where appropriate and lawful
troubleshoot and secure workflows
maintain records required for support, billing, auditability, or compliance

c. Sensitive Data

Unless explicitly agreed under a secured engagement:

users should not submit highly sensitive or regulated data
SturdyCloud does not assume responsibility for unauthorised sensitive data input
AI workflows should be designed to minimise exposure of sensitive data

d. Data Retention

Data is retained only as necessary.
Users may request deletion or export of their data, subject to legal, contractual, technical, backup, security, and operational obligations.

7. AI Model & Vendor Governance

SturdyCloud may use third-party AI providers or self-hosted AI models.

We:

evaluate providers based on security, reliability, and data handling practices
decline participation in model training on client data whenever possible
prioritise Canadian data residency where feasible
notify Canadian clients when data residency outside Canada is required for a given service or provider where appropriate
consider provider terms, retention settings, logging, and training practices where relevant
document client-specific restrictions where agreed

8. CASL-Aware AI Communications

AI and automation may be used to help draft, personalize, route, schedule, or send electronic communications.

Where CASL applies, AI-assisted commercial electronic messages should include:

appropriate consent or another lawful basis
accurate sender identification
contact information
unsubscribe functionality where required
suppression of contacts who have opted out
human review for higher-risk or sensitive campaigns

Clients remain responsible for ensuring their contact lists, consent records, campaign instructions, and message content comply with applicable law.

9. GDPR-Aware AI Processing

Where GDPR or similar international privacy laws apply, AI workflows should consider:

lawful basis for processing
transparency and notice
data minimisation
retention limits
international transfer safeguards
processor/controller roles
data subject rights
human review of material automated outputs

Client-specific GDPR obligations should be documented in the applicable agreement, statement of work, or data processing terms.

10. AI Output Validation & Testing

SturdyCloud implements reasonable validation practices, including:

testing with representative prompts and use cases
human review of outputs before use
iterative improvement of prompts and workflows
ongoing monitoring of output quality and reliability where support is included
review of accessibility and usability issues for user-facing workflows

AI outputs are not guaranteed to be accurate or complete.

11. AI Output & Decision-Making Limitations

SturdyCloud does not use AI systems for fully automated:

legal decisions
financial or investment decisions
employment or hiring decisions
medical or health-related decisions
other material decisions without human review

All material actions require human review and approval.

AI outputs may be useful for drafting, summarisation, recommendations, and operational support, but they are not a substitute for professional judgment or final human approval.

12. AI Office Extension and Voice/Call Workflows

AI Office Extension and similar voice or call-answering workflows may support:

tier-1 customer support
booking and scheduling
sales and lead qualification
after-hours inquiry capture
payment reminder support
field logistics, dispatch intake, maintenance requests, and post-service feedback

These workflows should include:

approved scripts or call flows
escalation rules
human handoff for sensitive or complex issues
clear limits on what the AI can decide or promise
call recording or transcript handling rules where applicable
client review of workflow configuration
privacy, consent, and retention practices appropriate to the use case

13. AI Incident Handling

AI-related issues may include:

harmful or incorrect outputs
data exposure concerns
workflow or automation errors
hallucinated statements
incorrect customer routing or escalation
accessibility barriers in AI-enabled interfaces
inappropriate or non-compliant outreach

When identified, SturdyCloud will:

review and assess the issue
contain and mitigate impact where possible
improve safeguards and workflows
apply learnings to prevent recurrence

14. Logging & Auditability

Where appropriate, SturdyCloud maintains:

system and access logs
workflow activity records
output and interaction tracking where applicable
change tracking for prompts or configurations
records of key approvals, escalations, and handoffs

This supports monitoring, troubleshooting, and accountability.

15. Security & SOC 2 Readiness Alignment

SturdyCloud aligns its practices with SOC 2 Trust Services Criteria:

Security
Availability
Confidentiality

Controls include:

access management
encryption where applicable
monitoring and logging
incident awareness practices
controlled vendor and integration review

16. Accessibility & Inclusive Design — WCAG 2.2 AA

AI-enabled systems are designed with accessibility in mind, using WCAG 2.2 AA as the development target where applicable.

We aim to ensure AI-supported interfaces are usable and inclusive for a broad range of users by considering:

keyboard access
visible focus states
readable layouts
properly labelled forms and controls
accessible error messages
sufficient contrast
text alternatives for meaningful visuals
captions or transcripts for audio/video where practical
accessible chat, booking, signing, and support flows

17. Client-Specific Requirements

Where a client agreement, statement of work, or regulatory requirement imposes stricter obligations:

those requirements take precedence over this policy
SturdyCloud adapts controls to meet client-specific needs where agreed
requirements should be documented before implementation

18. Continuous Improvement

We continuously:

monitor AI system performance
improve prompts, workflows, and safeguards
refine accuracy, usability, accessibility, and reliability
update policies as services, laws, and client needs evolve

19. Changes to This Policy

This policy may be updated periodically.

Updates will be reflected with a revised "Last Updated" date.

The effective date of this policy remains April 2, 2026. The July 6, 2026 update reflects CASL, GDPR-aware, WCAG 2.2, AI, automation, and service-delivery clarifications.

20. Contact Information

SturdyCloud IT Ltd.

Email: contact@sturdyiq.ca

Website: https://sturdyiq.ca

Location: Ontario, Canada