Privacy Policy

LightCI (“LightCI”, “we”, “us”) is an AI consulting firm and product studio headquartered in Toronto, Ontario, Canada, with a distributed team across North America. We design and deploy AI systems for enterprise and private-equity-backed software companies.

This Privacy Policy applies to personal information we collect and use as a controller, meaning when we decide why and how it is processed. That includes:

• Our website at lightci.com and its subpages, including the blog, case studies, PRISM, Activate, reports and password-protected pages we share with prospective clients.
• Our sales, marketing and business-development activity, including email, calls, events and scheduling.
• Business contact information about the people who work at our clients, prospects and partners.

It does not govern the business data, systems and records we access while delivering an engagement for a client. There, the client is the controller and we act on its instructions. That work is covered by our services agreement with the client and by our AI Data & Privacy Policy, which is the standing commitment for how we handle client data in AI work.

Information you give us directly

• Contact and request forms. When you request access to Activate, ask for a report, or reach out to us, we collect your name, work email address, company, role, company size, current AI tooling, and any notes you add.
• Scheduling. When you book time with us through Calendly, Calendly collects your name, email, time zone and any questions you answer, and shares them with us.
• Correspondence. Emails, messages, call notes and meeting recordings or AI-generated summaries where you have been told a call is being recorded or summarised.
• Events and content. Registration details for events, webinars, or gated content such as reports and proposals.

Information collected automatically

• Device and usage data. IP address, browser type, operating system, device identifiers, referring pages, pages visited, time on page, scroll depth and interactions with on-page elements.
• Approximate location. Derived from your IP address at country, region or city level. We do not collect precise geolocation.
• Company identification. We use a visitor-identification service (RB2B) that may match a business visitor to a company or a professional profile using IP address, cookie and device data combined with its own data network. This tells us, for example, that someone from a particular firm read our private-equity report. See the cookies section for how to opt out.
• Preferences. Small pieces of data stored in your browser to remember choices you have made on the site, such as dismissing a banner or unlocking a password-protected page.

Information from other sources

• Professional and public sources. Business contact details from professional networks such as LinkedIn, company websites, and business-data providers, used to reach people whose roles are relevant to our work.
• Referrals and partners. Introductions from clients, investors, technology partners and event organisers.

• To respond to your enquiries, schedule meetings and follow up on conversations.
• To scope, propose, contract and deliver our services, and to manage the client relationship.
• To send relevant business communications about our work, research, events and products, subject to your choices.
• To understand which companies and roles find our content useful, and to improve the site and what we publish.
• To secure the site and our systems, prevent abuse, and debug problems.
• To comply with legal obligations, enforce our agreements, and protect our rights and those of others.

We do not use personal information collected through this site to make automated decisions that have legal or similarly significant effects on you.

Where the GDPR, the UK GDPR or similar laws apply, we rely on one or more of the following bases for each processing activity:

• Legitimate interests. Running and improving our business, understanding our audience, contacting people in relevant roles about our services, and keeping our systems secure. We balance these interests against your rights and do not rely on this basis where your interests override ours.
• Contract. Taking steps at your request before entering a contract, and performing a contract with you or your organisation.
• Consent. Where the law requires it, for example for certain cookies or marketing emails. You can withdraw consent at any time.
• Legal obligation. Tax, accounting, and responding to lawful requests from authorities.

In Canada, we collect, use and disclose personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, relying on express or implied consent as the circumstances require.

We use cookies and similar technologies (local storage, pixels, scripts) on lightci.com. We do not run advertising pixels or retargeting on this site. The services below are active:

Your choices

• Browser controls. You can block or delete cookies in your browser settings. The site will keep working.
• Google Analytics. Install Google’s opt-out browser add-on.
• Visitor identification. Email privacy@lightci.com and we will remove any identification record we hold about you and suppress future matches where the provider supports it. You can also opt out directly with RB2B.
• Global Privacy Control. Where the law treats a GPC signal as an opt-out request, we honour it.

We share personal information only in the ways described here. We never sell it.

• Service providers. Companies that process data on our behalf and under contract: hosting (Vercel), analytics and visitor identification (Google, Pendo, RB2B), scheduling (Calendly), form handling, email and productivity tools, CRM, document storage, and AI-powered meeting notes. They may use the information only to provide the service to us.
• Technology partners. When you ask us for an introduction, or when we deliver work jointly with a partner (for example a model provider’s partnerships team), we share the minimum contact information needed and tell you first.
• Professional advisers. Lawyers, accountants, auditors and insurers under duties of confidentiality.
• Legal and safety. Where required by law, court order or regulator, or where reasonably necessary to protect the rights, property or safety of LightCI, our clients or others.
• Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to the acquirer honouring this policy or telling you otherwise in advance.

We are based in Canada and our team and service providers operate in Canada and the United States, with some providers operating globally. If you are in the European Economic Area, the United Kingdom or Switzerland, your information may be transferred to countries whose laws differ from yours.

Where we do so, we rely on recognised safeguards: the European Commission’s adequacy decision for Canada (for PIPEDA-governed organisations), Standard Contractual Clauses or the UK International Data Transfer Addendum with providers, and providers’ participation in the EU-U.S. Data Privacy Framework where applicable. You can ask us for a copy of the relevant safeguard.

We keep personal information only as long as we need it for the purposes above, then delete or anonymise it. As a guide:

• Enquiries and business contacts: for the life of the relationship and up to three years after the last meaningful interaction, unless you ask us to delete it sooner.
• Client contract records: for the term of the agreement plus seven years, to meet tax, accounting and legal requirements.
• Site analytics: according to each provider’s retention setting. Google Analytics is set to fourteen months.
• Server logs: a short rolling window, typically under thirty days.

Backups are overwritten on a rolling schedule, so deleted data may persist in backups for a limited period before it ages out.

We protect personal information with technical and organisational measures appropriate to its sensitivity: encryption in transit and at rest, single sign-on and multi-factor authentication on our systems, named accounts with least-privilege access, managed and encrypted devices, and vendor review before we adopt a tool. Access to client information is limited to the people working on that client.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy.
• Correct information that is inaccurate or incomplete.
• Delete your information, subject to legal exceptions.
• Object to, or ask us to restrict, certain processing, including processing based on legitimate interests.
• Receive your information in a portable format.
• Withdraw consent where processing is based on consent.
• Opt out of marketing communications at any time.
• Not be discriminated against for exercising any of these rights.

To exercise any right, email privacy@lightci.com. We may need to verify your identity, which we will do with the least information necessary. An authorised agent may make a request on your behalf with evidence of authority. We respond within the timeframe the applicable law requires, and in any case within thirty days.

California and other U.S. states

We do not sell personal information and do not share it for cross-context behavioural advertising as those terms are defined in the California Consumer Privacy Act. We have not sold or shared personal information in the preceding twelve months. The categories of information we collect, our purposes, and the categories of recipients are described above. You have the right to know, correct, delete and opt out, and to be free from retaliation for exercising those rights.

Europe and the United Kingdom

You have the right to lodge a complaint with your local data protection authority, or with the UK Information Commissioner’s Office. We would appreciate the chance to address your concern first.

Canada

You have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual restrictions. You may also complain to the Office of the Privacy Commissioner of Canada.

We contact people in business roles about our services, research and events. We do this under Canada’s Anti-Spam Legislation (CASL) and equivalent laws elsewhere, relying on express consent, an existing business relationship, or a conspicuously published business contact address, as the law permits.

Every marketing email includes an unsubscribe link. You can also reply to any message or email us to opt out, and we will action it within ten business days. Opting out of marketing does not stop transactional messages about a live engagement.

Our work puts us inside client systems: CRMs, finance stacks, support queues, product databases, document stores. The personal information in those systems belongs to the client and its customers. In that context we are a processor or service provider acting on documented instructions, and the client’s agreement with us and applicable data processing terms govern.

If you are a customer or employee of one of our clients and have a question about data we processed on the client’s behalf, please contact the client first. We will help them respond.

Our site and services are for businesses and are not directed to anyone under eighteen. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time as our practices, tools or the law change. When we do, we will post the revised policy on this page. For material changes, we will post a notice on the site or contact you directly where we have a relationship with you. Continued use of the site after a change means the updated policy applies.

Questions, requests and complaints about privacy can be sent to us at any time.