Privacy Policy
Effective date: September 11, 2026 · Version 1.0
Overview
- Effective date
- September 11, 2026
- Service provider
- Twinsen Inc., operating as PMO Pilot
1. Scope and accountability
This Privacy Policy explains how Twinsen Inc., operating as PMO Pilot (“PMO Pilot,” “we,” “us,” or “our”), handles personal information when you visit, register for, access, or use PMO Pilot, contact support, receive service communications, or interact with an organization using the service.
The person responsible for the protection of personal information is Samer Salameh. Questions and requests may be sent to privacy@twinsen.ca or the address in Section 15. If your organization controls a workspace, it may also act as the organization responsible for information it directs us to process.
2. Key privacy information
- What we collect
- Account, profile, authentication, project, usage, device, support, and billing information, depending on the features used.
- Why
- To provide, secure, administer, support, and improve PMO Pilot; comply with law; and communicate about the service.
- Who receives it
- Authorized organization users, service providers, integration providers at your direction, and authorities or transaction parties where legally justified.
- Your choices
- Access, correction, consent withdrawal where applicable, account settings, notification controls, and deletion requests subject to legal retention.
- Contact
- privacy@twinsen.ca
3. Personal information we collect
Information you provide
- Registration and identity information: name, username, email address, mobile number, birth date, country, gender, company, job title, department, requested platform role, and verification status. Optional fields should remain optional unless clearly identified otherwise.
- Profile and collaboration information: photo, display name, biography, strengths, development areas, interests, availability, and other profile details you choose to provide.
- Project and business information: projects, tasks, deliverables, RAID items, decisions, meetings, stakeholders, comments, files, approvals, timesheets, invoices, reports, and related records.
- Support and communications: messages, requests, feedback, attachments, and records of service communications.
- Billing information: plan, transaction, invoice, tax, and payment-status information. Full payment-card details should be processed by the payment provider where one is used.
Information collected automatically
- Usage information, such as pages and features used, actions taken, timestamps, configuration choices, and diagnostic events.
- Device and technical information, such as browser type, operating system, language, approximate location derived from IP address, identifiers, and network information.
- Authentication and security information, such as sign-in method, verification state, session metadata, failed sign-ins, role changes, access events, and security or audit logs.
- Cookies and similar technologies required for sign-in, security, preferences, and — only after you accept — optional analytics.
Information from others
We may receive information from your organization, authorized administrators, project members, identity providers, integrations you connect, invitation senders, payment providers, and service providers. The information received depends on the integration and permissions you authorize.
4. Why we use personal information
- Create, verify, approve, administer, and secure accounts.
- Provide project, collaboration, reporting, access-management, notification, and support functions.
- Authenticate users, enforce permissions, prevent misuse, investigate incidents, and maintain audit trails.
- Process subscriptions, payments, invoices, and contractual obligations where applicable.
- Communicate about verification, approvals, project access, security, service changes, support, and required notices.
- Understand performance and improve features using appropriately limited data.
- Comply with legal obligations, enforce agreements, establish or defend legal claims, and protect users, organizations, PMO Pilot, and the public.
We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate and on a lawful basis available under applicable law, including consent, contract, legitimate business operations recognized by law, and legal obligations.
5. Consent and choices
We seek meaningful consent where required and present key information at or before collection. You may withdraw consent for optional processing, subject to legal or contractual restrictions and reasonable notice. Withdrawal may prevent us from providing features that require the information. Essential service, security, legal, and audit processing may continue where permitted without consent.
Optional Google Analytics cookies load only after you accept the cookie banner (or later in Privacy Settings). You can switch to essential cookies only at any time. Essential cookies for authentication and security do not require this extra consent.
You can update many profile fields and notification choices in settings. Organization administrators may control information and communications associated with organization-managed workspaces. Service and security messages are not marketing and may continue while an account is active or where legally required.
7. International and interprovincial processing
Service providers or systems may process information in Canada and, where required for hosting or analytics infrastructure, in the United States (Render, Neon, and Google Analytics). When information is processed outside Quebec, it may be subject to the laws of that location and accessible to courts, law enforcement, or authorities there. Before communicating personal information outside Quebec, we conduct any assessment required by applicable law and use appropriate contractual, organizational, and technical safeguards.
8. Retention and deletion
We retain personal information only as long as needed for the identified purposes, contractual obligations, security, audit, dispute resolution, and legal requirements. Retention varies by record type and organization policy. Before launch, document and publish the applicable retention schedule rather than inserting unsupported time periods.
- Account closure stops sign-in, active project access, and account-related notifications but does not automatically erase project or audit history.
- Project records may remain to preserve ownership, decisions, approvals, financial records, and organizational auditability.
- Security, confidentiality-incident, billing, legal, and backup records may be retained for required periods.
- When retention is no longer justified, information is securely destroyed or anonymized in accordance with applicable requirements.
- Legal, security, investigation, or audit holds may delay deletion. Access remains restricted while a hold applies.
9. Security safeguards
We use administrative, technical, and physical safeguards appropriate to the sensitivity, amount, format, and use of information. These may include role-based access, authentication controls, encryption in transit and at rest where supported, logging, monitoring, backups, secure development, vendor review, incident response, and workforce confidentiality obligations. No safeguard eliminates all risk.
10. Confidentiality incidents
We maintain processes to assess, contain, investigate, document, and respond to confidentiality or security incidents. Where an incident creates the legally defined level of risk, we will notify affected individuals and the appropriate regulator as required. We retain incident records for the period required by applicable law.
11. Your privacy rights
Subject to applicable law and limited exceptions, you may request:
- Confirmation of whether we hold personal information about you and access to that information.
- Correction of inaccurate, incomplete, or ambiguous information.
- Information about categories of persons who may access your information and applicable retention periods.
- Withdrawal of consent for optional processing.
- Deletion of eligible personal information or de-indexation where the legal conditions are met.
- A copy of computerized personal information in a structured, commonly used technological format where portability rights apply.
- Information about significant automated decision-making, if PMO Pilot later uses such a system in a manner covered by law.
Submit requests to privacy@twinsen.ca. We may verify identity before responding. We will respond within the period required by applicable law, explain any refusal, and identify available complaint or review mechanisms. Organization-controlled project information may need to be handled with the relevant organization.
12. Automated decisions and artificial intelligence
PMO Pilot does not currently make decisions based exclusively on automated processing that produce legal or similarly significant effects. If this changes, we will update this Policy to explain the decision, information used, principal factors, consequences, review rights, and how to submit observations.
14. Children
PMO Pilot is designed for professional and organizational use and is not intended for children. We do not knowingly collect personal information from children below the age requiring parental or guardian consent under applicable law. If you believe a child has provided information, contact us so we can assess and take appropriate action.
15. Contact and complaints
- Privacy officer
- Samer Salameh
- Legal name
- Twinsen Inc.
- Business address
- Montréal, Québec, Canada
- Privacy email
- privacy@twinsen.ca
- Support email
- support@pmopilot.ca
You may also contact the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada where applicable. We encourage you to contact us first so we can try to resolve the concern.
16. Changes to this Policy
We may update this Privacy Policy to reflect service, legal, operational, or security changes. We will post the updated version and effective date and provide additional notice or obtain consent where required for material changes. Previous versions will be retained where appropriate.
Official references used for this draft
- Office of the Privacy Commissioner of Canada — PIPEDA overview: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/
- Office of the Privacy Commissioner of Canada — Guidelines for obtaining meaningful consent: https://www.priv.gc.ca/en/privacy-topics/privacy-for-businesses/appropriate-handling-of-personal-information/collecting-personal-information-and-consent/consent/gl_omc_201805/
- Office of the Privacy Commissioner of Canada — Fair information principles: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/
- Quebec — Act respecting the protection of personal information in the private sector: https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1
- Commission d’accès à l’information du Québec: https://www.cai.gouv.qc.ca/english
Your privacy choices remain available after registration.