Compliance & Data Residency

Privacy Policy

Effective Date: June 18, 2026

At Floapi (floapi.ca), based in Montreal, Quebec, Canada, we are dedicated to protecting the privacy and confidentiality of the personal information entrusted to us by P&C insurance brokerages and their clients. We align our data management practices strictly with Quebec's Law 25 (Loi 25), the federal PIPEDA (Personal Information Protection and Electronic Documents Act), and provincial insurance regulations (AMF, RIBO).

1. Transit-Only Infrastructure (No PII Retention)

Floapi provides AI-powered automation middleware that integrates with Broker Management Systems (BMS) such as Applied Epic. Our systems are engineered with security and data minimization at their core:

Zero Retention Principle

Floapi's automation model operates on a transit-only basis. We do not store or keep personal information (PII) of your policyholders. We temporarily retrieve data from your BMS, perform the automated workflow (e.g. generating commercial invoices, preparing requoting data, transcribing notes), write the results back into your BMS, and instantly purge the transmission data. Your BMS remains the sole custodian of your client data.

2. Data Residency and Canadian Infrastructure

All data processed by Floapi's automation systems is handled entirely within Canadian territory. Under no circumstances is brokerage or policyholder data routed, processed, or backed up in US-based cloud regions, ensuring protection from cross-border jurisdiction and foreign statutes (such as the Patriot Act or CLOUD Act).

Exception — website analytics: With your consent, our website uses Google Analytics 4, which is operated by Google LLC (US). Data collected is limited to anonymous browsing behaviour and does not include any brokerage or policyholder data. See Section 3 for full details.

3. Cookie Policy & Consent

We use essential cookies to keep our website running securely and smoothly. In compliance with Law 25, non-essential cookies are only loaded after you give your explicit consent via our cookie banner:

  • Consent Preference (localStorage): We store your cookie consent choice in your browser's local storage (not a cookie) so we do not ask again on return visits. This contains no personal information and never leaves your device.
  • Third-Party Widgets (Calendly): We embed Calendly to allow you to book live automation audits. Calendly may set functional cookies (such as session or security tokens) when you interact with the scheduler. We do not load tracking pixels or ad trackers.
  • Analytics (Google Analytics 4): With your consent, we use Google Analytics 4 to understand how visitors use our site. It collects data such as pages visited, session duration, device type, and approximate location (country/region). IP addresses are anonymized by Google before storage. This data is processed by Google LLC under their Privacy Policy. GA4 is only loaded after you explicitly accept cookies via our consent banner. You can withdraw your consent at any time by clearing your browser's local storage or contacting us at info@floapi.ca.

4. Your Rights

Under Law 25 and PIPEDA, you have the right to:

  • Access the personal information we hold about you
  • Correct any inaccurate or incomplete information
  • Withdraw consent for analytics at any time by clearing your browser's local storage or contacting us

5. Privacy Officer

Under Quebec's Law 25, we have appointed a Privacy Officer responsible for overseeing compliance. If you have any questions, concerns, or requests regarding your data, you can reach us at:

Privacy Compliance Officer
Floapi Inc.
6795 rue Marconi, Montreal, QC H2S 3J9, Canada
Email: info@floapi.ca

6. Updates to this Policy

We review and update this Privacy Policy periodically to reflect changes in our workflows or regulatory landscapes. Any updates will be posted directly to this page with an updated effective date.