My Edwin Privacy Policy

Version PC-2026-10-12-EN-1.0. Effective date: 12 October 2026. Last updated: 12 October 2026.

Holding AMR LLC, trading as My Edwin, acts as a controller for some of the personal data described here and as a processor for the rest.

This policy explains what personal data (also called personal information) we handle, why, how long we keep it, who receives it, and what rights you have. It is our privacy notice under Articles 13 and 14 of the GDPR and the UK GDPR, and our privacy policy for the purposes of Canadian and US state privacy laws. It is written for a business owner, not a lawyer.

In short

1. We have two separate roles. For your account, our website, creators and the waitlist, we are the controller. For the data about your customers and contacts that Edwin handles on your behalf, we are your processor and you are the controller (Section 3).
2. Edwin has a memory. It keeps what it handles for you. The exact text of sent or deleted drafts is kept for 30 days, then only the outline remains (Section 7).
3. Audio is never kept. Calls and meetings are transcribed. Only the transcript (for a limited time) and the summary are kept (Sections 8 and 9).
4. We do not use your data to train artificial intelligence models (Section 10).
5. We do not sell personal information and we do not run targeted advertising.
6. For any question or to use your rights: contact@myedwin.com.

---

1. Key terms

In this policy:

• "Edwin" or "the Service": the AI-assisted digital assistant for independent professionals and small and medium businesses, operated as My Edwin and reached through the website, the app and the channels you connect (phone, email, WhatsApp, calendar).
• "We", "us": Holding AMR LLC (Section 2).
• "You", "User": the business owner, company or representative who opens an Edwin account for business use. The Service is for businesses only.
• "Contact": anyone Edwin communicates with for you, or whose details appear in the tools you connect: your customers, prospects, suppliers, correspondents, callers, and people present at a meeting you ask Edwin to listen to.
• "Account Data": data about you as a User (Section 4).
• "Contact Data": personal data about your Contacts that Edwin handles on your behalf (Section 5).
• "Edwin's Memory": the space, specific to your account, where Edwin keeps what it has done and what it should remember (Section 7).
• "Outline": a short summary that keeps the essentials (who, what, when, what was decided) without the exact text.
• "Creator": a person who takes part in the My Edwin creator programme (Section 16).
• "GDPR": Regulation (EU) 2016/679. "UK GDPR": the GDPR as it forms part of UK law, together with the Data Protection Act 2018.
• "Controller": the party that decides why and how personal data is processed. "Processor": the party that processes it on the controller's behalf and on its instructions. "Sub-processor": a provider engaged by a processor.
• "Supervisory authority": the data protection regulator in your country (Section 20).

2. Who we are and how to reach us

2.1 Identity. The controller and publisher of the Service is Holding AMR LLC, a limited liability company organised under the laws of the State of Wyoming, USA, trading as My Edwin. Registered address: 30 N Gould St, STE R, Sheridan, WY 82801, USA. information being updated information being updated.

2.2 Single point of contact. For any question about your data or to use your rights: contact@myedwin.com. This is the same contact everywhere on the site.

2.3 Data protection officer. We have not appointed a data protection officer (DPO). Requests are handled at the address above.

2.4 EU representative (GDPR Article 27). We have no establishment in the European Union. Our EU representative is: information being updated. The representative is a point of contact for supervisory authorities and for individuals, in addition to our single point of contact.

2.5 UK representative (UK GDPR Article 27). Our UK representative is: information being updated.

3. Our two roles

Data protection law distinguishes the party that decides about the processing (the controller) from the party that carries it out for someone else (the processor). Both situations exist at Edwin.

3.1 If the two conflict. For Contact Data, the data processing agreement prevails over this policy.

3.2 Limited uses as controller. Even for Contact Data, we act as a controller for a few narrow purposes: securing the Service, keeping proof of what was done, preventing fraud and abuse, and meeting our legal obligations (Section 4, rows 6, 7 and 11).

4. Role A: data for which we are the controller

4.1 Purposes, data, lawful bases and retention

4.2 Is providing the data compulsory?

The data in rows 1 to 4 is needed to create your account, open your number and bill you. Without it we cannot provide the Service. Other data is optional or collected only when needed.

4.3 Legitimate interests

Where we rely on legitimate interests (rows 5, 6, 7 and 12), we have balanced them against your rights. You may object on grounds relating to your situation (Section 13). You may ask us for a summary of that balancing test.

4.4 What we do not do

We do not sell your data, rent it, use it for advertising or advertising profiles, or use it to train AI models (Section 10).

5. Role B: your Contacts' data, handled on your behalf

5.1 What Edwin handles for you

Text messages (SMS): Edwin does not send SMS for now. The feature is announced for later. Edwin makes no outbound phone calls.

5.2 Purpose and instructions

We process this data only to provide the Service to you, on your documented instructions: your settings, your requests to Edwin and our terms of service. We do not use it for our own purposes, apart from the limited uses in Section 3.2.

5.3 Our commitments as your processor

In line with GDPR Article 28, we commit to:

• process the data only on your instructions, and tell you if an instruction appears to us to breach the law;
• make sure that the people authorised to access the data are bound by confidentiality;
• apply the security measures in Section 17;
• use sub-processors only on the terms of 5.5;
• help you answer requests from your Contacts to exercise their rights (5.7) and meet your security, breach notification and impact assessment obligations;
• notify you of a data breach without undue delay (Section 18);
• delete or return the data when the Service ends (5.8);
• give you the information needed to show our compliance and allow audits on the terms of the data processing agreement.

The full terms are in the data processing agreement in our terms of service, which sets out the subject matter, duration, nature of the processing, categories of data and of people, and the security measures.

5.4 Your responsibilities as controller

You remain responsible for how you use Edwin. In particular you must:

• have a lawful basis to process your Contacts' data with Edwin and inform them (5.6);
• configure Edwin lawfully, especially for calls and meetings (Section 9);
• not use Edwin for unsolicited marketing or promotional messages without the consent or permission the law requires;
• not send Edwin data that does not belong there. We do not look for sensitive data (health, beliefs, origin and so on), but a Contact may mention some in a message. If so, it is processed only to provide the Service;
• respond to Contacts who exercise their rights.

5.5 Sub-processors

You give us general authorisation to use the sub-processors listed in Section 11. We impose data protection obligations on them that are equivalent to ours. We tell you about any addition or replacement by email and in the app at least 30 days before it takes effect. You may object in writing on reasonable data protection grounds. If we cannot agree, you may cancel at no charge before the change takes effect.

5.6 Informing your Contacts (GDPR Article 14)

You, as controller, are responsible for informing your Contacts. To help you, this is what your Contacts can read here:

• Who handles their data: the professional who uses Edwin is the controller. Holding AMR LLC (My Edwin) is its processor. Edwin identifies itself as an AI.
• Where the data comes from: the direct exchange with the Contact (call, message, email), the professional's calendar or contacts, or what the professional entered.
• Why: to answer the Contact's request and let the professional organise it (appointment, quote, order, follow-up).
• How long: for the periods in Section 7, set on behalf of the professional, who can also ask Edwin to forget.
• Rights: the Contact should contact the professional first. They may also write to contact@myedwin.com: we pass the request to the professional and do not reply in their place unless the law requires it. They may complain to their supervisory authority (Section 20).

We provide information being updated.

5.7 Requests from your Contacts

If a Contact writes to us directly, we forward the request to you without delay. We give you the means to carry it out (access, correction, erasure through "forget that" or deletion, export). You reply within the legal time limit of one month.

5.8 When the Service ends

Before you close your account you can ask for an export of your data (Section 13). On closure we erase the Contact Data, memory included, within information being updated, unless the law requires us to keep it.

6. Connected accounts: Google, Microsoft, Apple and mail accounts

6.1 Principle

You choose what you connect. Edwin looks at your tools at the moment it needs to. It does not sync or copy your mailbox, calendar or address book into a separate database. What Edwin handles for you can, however, be retained in its memory, as Section 7 explains.

6.2 Google user data

• What we access. With your explicit consent, Edwin accesses your Google Calendar and, read only, your Google Contacts, through the scopes https://www.googleapis.com/auth/calendar and https://www.googleapis.com/auth/contacts.readonly. We request no other Google scope. Edwin does not use Google's authorisation to read your Gmail messages. You can untick the contacts permission on Google's consent screen: Edwin then works with the calendar alone.
• Gmail. For Edwin to work with a Gmail mailbox, you create an app password in your Google Account and give it to Edwin. This is not a Google API authorisation. Edwin uses it only to reach your mailbox over IMAP and SMTP, for the purposes in Section 5.1. It is encrypted with a key specific to your account. You can revoke it at any time at myaccount.google.com/apppasswords.
• Why the calendar. Edwin needs to read your appointments to prepare your daily summary, to avoid disturbing you during an appointment, to check that a time is free, and to write an appointment when you ask it to book, move or cancel. It never writes to your calendar on its own initiative, and only after you have confirmed the title and time.
• Why contacts. When you say "call Mr Martin", Edwin looks up the number in your contacts. Access is read only. Edwin never creates, changes or deletes a contact, and never reads your address book in bulk.
• Limited use. Google user data is used only to provide the features you ask for. We do not sell it, use it for any advertising, build advertising profiles, or use it to develop, improve or train generalised AI or machine-learning models. No human at My Edwin reads it, except with your consent for a specific problem, where necessary for a security investigation, or where the law requires. Edwin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Withdrawing access. Disconnect your calendar in Edwin's settings: the token is deleted at once and revoked at Google. You can also revoke access at myaccount.google.com/permissions.

6.3 Microsoft accounts

If you connect an Outlook.com, Hotmail, Live, MSN or Microsoft 365 account, Edwin uses the Microsoft Graph API with the permissions you approve on Microsoft's own consent screen: read and manage mail (Mail.ReadWrite), send a message you have approved (Mail.Send), read and write the calendar (Calendars.ReadWrite), read contacts (Contacts.Read), and stay connected without asking you to sign in again (offline_access). We request nothing else. The rules on use, storage and limits are those in 6.2. To withdraw access: disconnect in Edwin's settings (the token is deleted at once), or revoke Edwin at account.live.com/consent/Manage (personal account) or myapps.microsoft.com (work or school account).

6.4 Apple iCloud

Apple does not offer a consent flow of this kind for iCloud Mail, Calendar and Contacts. You create an app-specific password in your Apple Account and give it to Edwin. Edwin uses it only to reach your mail, calendar and contacts over IMAP, SMTP, CalDAV and CardDAV, for the purposes in Section 5.1. It is encrypted with a key specific to your account. To withdraw access: disconnect in Edwin's settings (the password is deleted at once), then revoke the app-specific password at account.apple.com.

6.5 What is stored for connected accounts

We store the encrypted token or app password, the scope granted, the server address, and what Edwin's Memory contains (Section 7). We do not store a full copy of your mail, calendar or contacts.

7. Edwin's Memory

7.1 What it is for

To do its job well, Edwin remembers what matters in your business: your customers, your habits, what it has done. The memory belongs to your account, is kept apart from other users' memory by the database itself, and is encrypted with a key specific to you. It is never used to train a model.

7.2 What it holds and for how long

information being updated

7.3 What you can do

• Forget. Tell Edwin "forget that": the memory concerned is truly erased.
• Delete the account. Everything is erased, memory included, except what the law requires us to keep.
• Look at it. The memory is not yet shown as a panel in the interface: you ask Edwin what it remembers, in the conversation.
• Export. You can ask for a structured export of your data (Section 13).

7.4 Role

The memory contains data about your Contacts: for them, we are your processor (Section 5). The periods above are the Service defaults. You can ask for shorter retention at any time by asking Edwin to forget.

8. Channels: phone, WhatsApp, email

8.1 Phone. We open a number dedicated to your business with our telephony carrier, in the name of your company (Section 4, row 4). Edwin receives calls on that number. It makes no outbound calls.

8.2 WhatsApp. Edwin replies automatically to your customers' messages within your settings and offers free time slots only. Edwin tells your customers that it is an AI. Messages pass through our telephony carrier and Meta (Section 11).

8.3 Email. Drafts prepared by Edwin are submitted to you for approval. Edwin never sends an email from your mailbox without your explicit approval of the complete message (recipient, subject, text). There is no automatic-sending mode. If a single word changes, a new approval is required. Edwin does not send marketing.

8.4 System emails. Messages such as a password reset or a confirmation are sent from Edwin's server by our system email provider (Section 11).

8.5 SMS. No text message is sent for now. If the feature opens, this policy will be updated before launch (Section 21).

9. Calls, meetings and recording: who is responsible for what

9.1 Calls received by Edwin

• Edwin answers by identifying itself as an AI. It tells the caller that the call is being transcribed.
• Speech is turned into text by our transcription provider. Edwin does not keep the audio anywhere.
• What is kept is the transcript and the summary, for the periods in Section 7.2.
• A caller who does not want to be transcribed can end the call and contact the professional another way.
• Edwin does not identify people by their voice.

9.2 Meeting listening

• You decide to start listening in the app (PWA) during a meeting with a customer. Edwin produces a summary. The audio is stored nowhere; the transcript is deleted when the summary is saved.
• The app displays and announces the recording before it begins.
• A monthly cap on hours applies according to your plan.

9.3 Your responsibilities

When you use Edwin to answer calls or to listen to a meeting, you are responsible for:

1. telling the people concerned before it starts (callers, attendees) and, where the law requires, obtaining their consent: several countries and US states require the consent of everyone recorded or transcribed, and attach criminal penalties;
2. complying with the rules of your country and of the person you are speaking to;
3. meeting your own professional secrecy or confidentiality duties, if any;
4. not using the Service to monitor anyone without their knowledge;
5. not enabling or using these features where they are prohibited.

Edwin's announcement does not replace your own duty to inform. Country-specific requirements are in the Country Annex.

9.4 Our side

We do not transcribe anything for our own purposes. We handle this data as your processor (Section 5), and we give you the means to inform the people you speak to.

10. Artificial intelligence

10.1 Edwin is an AI. Edwin identifies itself as an AI to anyone it communicates with (Regulation (EU) 2024/1689, Article 50). It can make mistakes. Its output is not legal, tax, medical or financial advice.

10.2 Models used. Edwin relies on model providers: a language model to understand and answer, a transcription service and a synthetic voice service. These providers are specialist companies, most of them established in the United States. The named list is given to any customer who asks for it in writing, subject to confidentiality. When a request needs your data (your calendar, an email), the relevant part is sent to the model only to produce the answer.

10.3 No training on your data. We do not use your data or your Contacts' data to train AI models.

10.4 Human oversight. Emails, quotes, prices and payment links prepared by Edwin are submitted to you before they go out. For channels you automate (phone, WhatsApp), you set the scope through your settings and you supervise them.

10.5 No decisions with legal effect. Edwin makes no decision that has a legal effect on a person (Section 14).

11. Processors and recipients

11.1 Providers

We use the providers below. The "Role" column shows whether the provider is our processor (or sub-processor) or a separate controller.

11.2 Other recipients

• Our advisers (accountant, lawyers), bound by confidentiality.
• Carriers and authorities for registration of a number (Section 4, row 4).
• Administrative, tax or judicial authorities, where the law requires.
• In a reorganisation or sale of our business, the successor, under the same safeguards.

11.3 Who does not receive your data

Creators never receive the email address or identity of a customer they referred: they see only a pseudonymous reference (Section 16).

12. International transfers outside the EU and UK

12.1 Where your data is

Edwin's application and database run on servers in the European Union (Frankfurt). But Holding AMR LLC is established in the United States and several of our providers process data in the United States. Data coming from the European Economic Area (EEA), the United Kingdom or Switzerland may therefore be transferred to a country that does not automatically offer the same level of protection.

12.2 Our safeguards

1. EU-US Data Privacy Framework (DPF). Where a US recipient is certified under the DPF, the transfer can rely on the European Commission's adequacy decision (and, for UK data, the UK Extension). Certified providers: .
2. Standard Contractual Clauses (SCCs) in parallel. Even where a provider is DPF-certified, our contracts include the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and, for the United Kingdom, the ICO's International Data Transfer Addendum or Agreement (IDTA).
3. Between you and us. For Contact Data, the SCCs (controller to processor module) form part of the data processing agreement in our terms of service. For our own transfers to Holding AMR LLC, we rely on the SCCs. information being updated
4. Supplementary measures. Hosting in Frankfurt, encryption in transit and at rest, an encryption key specific to each account, data minimisation, no retention of audio.

12.3 If the DPF is annulled or suspended

The European Commission's DPF adequacy decision was upheld by the EU General Court on 3 September 2025, and an appeal has been lodged with the Court of Justice. If the DPF were annulled, invalidated or suspended, our transfers would continue to rest on the Standard Contractual Clauses, already signed in parallel, supported by a transfer impact assessment and the measures in 12.2. We would update this policy and the list in Section 11.

12.4 Copy of the safeguards

You can get a copy of the safeguards that apply to your data by writing to contact@myedwin.com. We may redact confidential commercial information.

12.5 Access by foreign authorities

Data processed in the United States may be requested by US authorities under US law. The safeguards in 12.2 and encryption aim to limit that risk.

13. Your rights and how to use them

13.1 Your rights

Depending on the law that applies to you (GDPR, UK GDPR, national laws), you have the right to:

• access: know whether we process your data and get a copy, with the information in this policy;
• rectification: have inaccurate or incomplete data corrected;
• erasure: ask for your data to be deleted in the cases the law provides;
• restriction: ask for the processing to be paused while a challenge is checked;
• object: object, on grounds relating to your situation, to processing based on legitimate interests, and at any time to direct marketing;
• portability and export: receive your data in a structured, commonly used, machine-readable format and pass it to another service. We act on any request to export your account and memory data, including under the EU Data Act (Regulation (EU) 2023/2854);
• withdraw consent: at any time, without affecting what happened before, where processing rests on your consent (waitlist, newsletter, non-essential cookies);
• complain: to your supervisory authority (Section 20).

13.2 How to use them

Write to contact@myedwin.com, or to our representative (Sections 2.4 and 2.5). Say which right you are using and the email address of your account. If we have reasonable doubts, we may ask for proof of identity, only to check that the request comes from you. You can also delete your account or ask Edwin to forget in the app.

13.3 Time limit and cost

We reply within one month, extendable by two months for complex or numerous requests, with an explanation. Using your rights is free. For a manifestly unfounded or excessive request we may charge a reasonable fee or refuse, giving reasons.

13.4 If you are a Contact

If your data is handled by Edwin on behalf of a professional, contact them first (Section 5.6). If you write to us, we forward the request to them.

13.5 Residents of Canada and the United States

Canada. If you are in Canada, you may ask for access to and correction of your personal information, withdraw consent (subject to legal or contractual restrictions), and complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information. Your information may be processed in the European Union and the United States, where courts, law enforcement and national security authorities may be able to access it under local law.

United States. We do not sell personal information and we do not "share" it for cross-context behavioural advertising, as those terms are defined by US state privacy laws. We do not use sensitive personal information to infer characteristics about you. Depending on your state (for example California, Virginia, Colorado, Connecticut, Texas, Oregon), you may have the right to know, access, correct, delete, and obtain a portable copy of your personal information, to opt out of sale, sharing and targeted advertising (which we do not do), and not to be discriminated against for using your rights. We treat a Global Privacy Control signal as a refusal of measurement and marketing cookies. Where we act as a processor or "service provider" for a business (for example for your Contacts' data), we process the data only on that business's instructions. You may use your rights at contact@myedwin.com. If we refuse, you can appeal by replying to us, and then contact your state attorney general.

14. Automated decisions

14.1 We make no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (GDPR Article 22), except as described below.

14.2 For creators, an automatic match of identifiers (email address, payment method and so on) can lead to a creator code being refused at checkout. A refusal is not an accusation of fraud: you can ask for a review by a person by writing to contact@myedwin.com. No suspension or sanction is decided without human review.

14.3 Edwin sorts and summarises messages and proposes replies or time slots. These functions have no legal effect by themselves, and you stay in control (Section 10.4). Automatic reply rules (phone, WhatsApp) are set by your settings.

15. Website cookies and trackers

This Section describes the myedwin.com website at the date of this version. We declare only what exists. information being updated

15.1 Principle

We ask for your permission before using any cookie or similar technology that is not strictly necessary. On your first visit, a banner lets you reject all, accept all or choose by purpose. Refusing is as easy as accepting, nothing is switched on beforehand, and the site works the same whatever you choose. You can change or withdraw your choice at any time with the "Cookie settings" link at the bottom of every page. Your choice is kept for 6 months, then we ask again. We also treat a Global Privacy Control signal from your browser as a refusal of measurement and marketing cookies until you choose otherwise.

15.2 Cookies and storage in use

15.3 Measurement and marketing

At the date of this version, the site uses no analytics cookie and no marketing (advertising) cookie. If we add one, it will be listed in the table, with its provider and purpose, before it is switched on, and it will run only after you accept it. The lawful basis is your consent (GDPR Article 6(1)(a); the ePrivacy rules, in the UK the Privacy and Electronic Communications Regulations (PECR)). Necessary cookies do not need consent.

15.4 Proof of your choice

When you make a choice, we keep one line: the time, a random identifier, the banner version, what you accepted or refused and the site language. It holds no IP address, no browser details and no name. It is deleted after 3 years. We keep it to show that the banner works as described (legitimate interests).

15.5 Your country and technical data

To suggest the right country site on your first visit, our hosting network tells our server the country your connection comes from. We do not store your IP address and do not send it to any third party. Fonts are served from our own server, so loading a page makes no request to a third party.

15.6 Payment with Paddle

When you subscribe, you leave our site for Paddle's checkout, which applies its own privacy policy and cookies.

16. Creator data

16.1 Who this covers

People who join the creator list or take part in the My Edwin creator programme. We are the controller. This Section complements the Creator Agreement, which contains the same information. information being updated

16.2 Table

16.3 Recipients

Paddle, PayPal and banks (payouts), identity and sanctions screening providers information being updated, hosting and infrastructure, the email provider, our advisers, and tax authorities (including the US Internal Revenue Service) where the law requires.

16.4 Data about your own audience

You are the controller of your own audience's data. We give you neither the identity nor the contact details of referred customers. You must not collect their data in our name.

16.5 Rights

All the rights in Section 13 apply. You can leave the programme and ask for your data to be deleted, subject to what the law requires us to keep.

17. Security

We apply technical and organisational measures appropriate to the risk:

• encryption of exchanges; encryption of the memory, history and connection tokens with a key specific to each account, derived from a master key that is never stored in the database;
• passwords stored in hashed form;
• separation of each customer's data at the database level itself, not only in application code;
• access limited to people who need it and are bound by confidentiality;
• no payment card number at Edwin;
• creators' tax numbers encrypted and kept outside Edwin's memory;
• audio never kept;
• providers chosen for their security guarantees and bound by data processing terms.

Our team does not access the content of your data, except with your consent for a specific problem, for a security investigation, or where the law requires. No system is infallible: for your part, protect your credentials and tell us of any unauthorised access.

18. Data breaches

18.1 Data for which we are the controller. If a breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours where feasible, and we tell you without undue delay where the risk is high.

18.2 Contact Data. We notify you of any breach without undue delay after becoming aware of it, with the information you need for your own notification duties information being updated.

18.3 Other laws. National and state laws (United States, Canada) set their own notification rules (Country Annex).

19. Minors

The Service is for adult professionals acting for their business. It is not directed at minors and we do not knowingly collect data from minors. If we learn that an account or creator application concerns a minor, we delete it. A minor Contact who deals with a professional using Edwin is the responsibility of that professional (Section 5.4).

20. Supervisory authorities

You may at any time lodge a complaint with the supervisory authority of the country where you live, where you work, or where the alleged infringement took place, without prejudice to any other remedy. We invite you to contact us first.

21. Changes to this policy

We may change this policy, for example if the law changes, if we change a provider or if the Service evolves. We tell you by email and in the app at least 30 days before any change that affects how your data is used takes effect. The update date and the version identifier at the top change each time. We keep earlier versions. If you do not accept a change, you may cancel before its effective date.

22. Language and governing version

This policy is published in the language of each country served. The version written in the language of the user's country (the country of the site version from which the user signs up or which the user consults) prevails over any other version, which is provided for information only. For the United States, the United Kingdom and Canada outside Quebec, the English version prevails; in Quebec, the French version prevails and is provided first. A user established in a European country who reads the English version may rely on the version in the language of that country, which prevails. If a user has chosen another language in the language selector of the site, the version accepted at sign-up is the one recorded as accepted, without prejudice to the mandatory law of the user's country.

23. Version and date

Version PC-2026-10-12-EN-1.0. Effective date: 12 October 2026. Last updated: 12 October 2026. Earlier versions: policy of 6 October 2026 (replaced).

Part 2. Privacy Policy: Annex K, Part 1 (Canada outside Quebec)

CA.PC1 Canada (outside Quebec). We handle personal information of people in Canada in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Alberta and British Columbia, the Personal Information Protection Act of that province. The person accountable for our privacy practices is: information being updated. Contact: contact@myedwin.com. You can ask us how we handle your information and how to challenge our compliance.

Consent. We ask for your consent in clear terms when the law requires it, for example for the waitlist. For account and billing data, the information you give us when you open an account is the basis for providing the Service. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, and we explain what that means for the Service.

Where your information goes. Your information is processed in Germany and in the United States, and by sub-processors listed in Section 11. Courts, law enforcement and national security authorities in those countries may be able to access it under their local law. Our safeguards are described in Section 12.

Your rights. You may ask for access to your personal information and for its correction. We reply within 30 days, which may be extended as the law permits, and we explain any refusal.

Breaches. If a breach of security safeguards creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada (or the provincial commissioner) and notify the people concerned, and we keep a record of the breach for 24 months.

Complaints. Write to us first. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca; 1-800-282-1376; 30 Victoria Street, Gatineau, Quebec K1A 1H3), or in Alberta and British Columbia to the Office of the Information and Privacy Commissioner of that province .

CA.PC2 Your contacts in Canada. Where Edwin handles information about your customers and contacts in Canada, you are accountable for it and we act on your behalf. You are responsible for obtaining the consent that Canadian privacy law requires and for telling your customers that an artificial intelligence assistant handles their messages and calls and that service providers outside Canada are involved. Business contact information used only to communicate with a person about their work may fall outside the federal law, but you should treat it with the same care.

CA.PC3 Calls and meetings in Canada. Under the Criminal Code, recording a private communication is lawful where one of the people taking part agrees, but privacy law and provincial law still require that people be told and that you have a lawful purpose. Before Edwin answers calls or listens to a meeting for you, you must tell the people concerned and, where the law requires it, obtain their agreement. Edwin's announcement does not replace your own duty to inform. Do not use the Service to record a conversation to which you are not a party.

CA.PC4 Automated decisions. Section 14 applies. If a decision with a significant effect on you is based on automated processing, you can ask for an explanation and for a person to review it.

CA.PC5 Cookies and emails in Canada. Section 15 applies. Our emails to the waitlist and to creators are sent with your consent, identify us as the sender with our address, and carry an unsubscribe link, as Canada's anti-spam legislation requires.

Canada (outside Quebec) | Office of the Privacy Commissioner of Canada; in Alberta, the Office of the Information and Privacy Commissioner of Alberta; in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia | priv.gc.ca; oipc.ab.ca; oipc.bc.ca |

Partie 2. Confidentialité : Annexe K, partie 2 (Québec)

QC.PC1 Responsable de la protection des renseignements personnels. Au Québec, la personne responsable de la protection des renseignements personnels de Holding AMR LLC est : information en cours de mise à jour. Contact : contact@myedwin.com, objet « Protection des renseignements personnels ». Cette personne veille au respect de la loi et traite vos demandes.

QC.PC2 Avis à la collecte et consentement. Au moment de la collecte, nous vous indiquons les fins pour lesquelles nous recueillons vos renseignements personnels, les moyens utilisés, les catégories de personnes qui y ont accès, vos droits d'accès, de rectification et de retrait du consentement, et le fait que vos renseignements peuvent être communiqués à l'extérieur du Québec (articles 4, 11 et 12). Lorsque votre consentement est nécessaire (liste d'attente, infolettre, pièces d'identité des créateurs), nous le demandons séparément, en termes simples, pour une fin précise. Vous pouvez le retirer à tout moment. Nous ne recueillons que les renseignements nécessaires aux fins indiquées.

QC.PC3 Communication à l'extérieur du Québec. Vos renseignements sont hébergés à Francfort (Allemagne) et traités aux États-Unis et dans d'autres pays par Holding AMR LLC et par nos sous-traitants (article 11). Avant toute communication de renseignements personnels à l'extérieur du Québec, nous évaluons les facteurs relatifs à la vie privée et nous nous assurons qu'ils bénéficieront d'une protection adéquate, notamment par des ententes écrites (clauses contractuelles types et autres garanties de l'article 12). Les autorités de ces pays peuvent avoir accès à ces renseignements selon leur droit. Vous pouvez demander une copie des garanties à contact@myedwin.com.

QC.PC4 Vos droits au Québec. Vous pouvez demander l'accès à vos renseignements personnels, leur rectification, le retrait de votre consentement, leur destruction ou leur anonymisation lorsque la fin pour laquelle nous les avons recueillis est accomplie, et leur communication dans un format technologique structuré et couramment utilisé. Vous pouvez aussi demander que nous cessions de diffuser un renseignement ou que nous le désindexions, dans les cas prévus par la loi. Écrivez à contact@myedwin.com. Nous répondons dans les 30 jours. Si vous êtes en désaccord avec notre réponse, vous pouvez vous adresser à la Commission d'accès à l'information (cai.gouv.qc.ca).

QC.PC5 Décisions automatisées. Si une décision vous concernant est fondée exclusivement sur un traitement automatisé, comme le refus d'un code créateur à l'étape du paiement, nous vous en informons. Sur demande, nous vous indiquons les renseignements utilisés, les raisons et les principaux facteurs de la décision, nous rectifions les renseignements inexacts et nous vous permettons de présenter vos observations à une personne en mesure de réviser la décision (article 14).

QC.PC6 Incidents de confidentialité. Nous tenons un registre des incidents de confidentialité. Lorsqu'un incident présente un risque de préjudice sérieux, nous avisons sans délai la Commission d'accès à l'information et les personnes concernées. Pour les renseignements que nous traitons pour votre compte, nous vous avisons sans délai pour que vous puissiez remplir vos propres obligations (article 18.2).

QC.PC7 Témoins et technologies. Le site n'utilise aucun témoin de mesure d'audience ni de marketing et aucune technologie d'identification, de localisation ou de profilage. Si nous en ajoutons, nous vous en informerons et la fonction sera désactivée par défaut jusqu'à votre consentement (article 15).

QC.PC8 Appels et rendez-vous au Québec. Si vous utilisez Edwin pour répondre à vos appels ou pour écouter un rendez-vous, vous êtes responsable d'informer vos interlocuteurs avant le début et d'obtenir leur accord lorsque la loi l'exige. L'annonce d'Edwin ne remplace pas votre devoir d'information. Pour les renseignements de vos clients qu'Edwin traite, vous êtes l'entreprise responsable et nous agissons comme votre mandataire (article 5 et article 18.3 des CGV). Vous devez les informer qu'un assistant fondé sur l'intelligence artificielle traite leurs messages et leurs appels, que des fournisseurs sont en cause et que leurs renseignements peuvent être traités hors du Québec.

QC.PC9 Langue. Cette politique vous est remise d'abord en français. La version française prévaut au Québec (article 22).

Québec | Commission d'accès à l'information du Québec (CAI) | cai.gouv.qc.ca | information en cours de mise à jour