B2B / Data Processor Compliance

Data Processing Agreement

Last Updated: May 18, 2026 (Version 1.0)

Important Context for Union Locals

Under Canadian privacy laws (including PIPEDA), the Union Local acts as the Data Controller. You hold the direct relationship with union members and are responsible for obtaining appropriate consent to represent them.

Virtual Steward acts as the Data Processor (Service Provider). We only process member and inquiry data at your strict direction to provide and optimize the software platform. We never sell, share, or monetize member data.

1Scope of Processing

Virtual Steward provides an AI-powered helper, grievance tracking, and member communication tool for union representatives. In providing this service, stewards may upload personal member details, collective agreements, inquiry descriptions, and associated evidentiary files.

All processing activities are conducted solely to operate the dashboard, power case-specific RAG (Retrieval-Augmented Generation) query matching, and send notifications at the instruction of authorized stewards.

2Data Residency & AI Safeguards

Canadian Residency

Your data is housed in Canadian regional data centers. Every Local's data is strictly compartmentalized via database-wide Row-Level Security (RLS). We do not aggregate query data or member lists across different Locals.

Zero-Retention AI

Virtual Steward operates under strict zero-data-retention agreements for AI processing. Member data and grievance contexts are never used to train foundational AI models, preserving absolute confidentiality.

3Approved Sub-Processors

To deliver a secure, high-performance platform, Virtual Steward utilizes industry-leading enterprise cloud infrastructure. As your Data Processor, we manage these technical relationships under strict confidentiality agreements:

Hosting & Edge Compute: Vercel Inc. and Amazon Web Services (AWS)
Database & Authentication: Supabase
AI Processing: Google Cloud / Google AI (Gemini) via enterprise API agreements.

While physical data residency is maintained in Canada, clients acknowledge that these sub-processors operate globally and are subject to the overarching statutory frameworks of their respective corporate jurisdictions.

4Union Local (Controller) Obligations

As the Data Controller, the Union Local represents and warrants that:

You have collected, and will continue to collect, all member information in compliance with PIPEDA and any applicable provincial laws.
You have obtained necessary consents or hold appropriate legal authorization (e.g., representation cards, collective bargaining rights) to process member inquiries and files.
You will ensure only authorized representatives (stewards, dispatchers, admins) are provisioned access to the Virtual Steward dashboard.

5Data Removal & Deletion (End of Purpose)

PIPEDA mandates that personal data must be purged once its original operational purpose ends.

Steward Action: Authorized Local Admins and Lead Stewards have direct capabilities within the platform to permanently purge case files, chat timelines, and RAG embeddings.
Irreversible: When a steward triggers a deletion, the record is immediately purged from active search databases and cascading constraints cleanly erase all associated digital items.
Member Requests: Since members do not hold individual Virtual Steward accounts, any member requests for data deletion must be handled by the Local Steward, who can execute the purge within the admin dashboard.

6Contact & Privacy Inquiries

For any questions regarding this Data Processing Agreement, technical safeguards, or security posture, please reach out to our team at:

Email: privacy@virtualsteward.ca