Privacy

Chi Mino Ozhitoowin LP
724 A City Rd, Fort William First Nation, ON P7J 1K4
(807) 577-8033 · cmo-fn.ca

Questions about this notice, or a request to see, correct or withdraw your information, can go to the address or number above.

IRIS exists so a First Nation controls its own record. Information about a Nation belongs to that Nation. We hold it to operate the platform the Nation is using; we do not sell it, we do not use it to train models, and we do not disclose it to industry except where a Chief or Council has made an explicit disclosure decision. This position is set out at length in the platform's data governance document, which is public.

Only what a surface actually needs:

• To sign in — your email address. IRIS uses a one-time code; we do not store a password because there isn't one.
• Your profile — the display name you choose, and which community or organization you hold standing in. Standing is never self-asserted: it comes from a claim or an invitation someone with authority issued.
• What you contribute — land-use markers you place, contributions you make in a facilitated engagement session, questions you ask the assistant, and documents uploaded to a room you belong to.
• Audio, where a session is recorded — see §5.
• Public-record information about Nations — leadership, band office contact details, treaty affiliation and population figures, drawn from Indigenous Services Canada and Nations' own published websites. This is published information republished; each field carries its source.

There is no analytics vendor, no advertising network and no tracking script on this platform.

In a facilitated engagement session, every contribution is given one of three fates by the person who said it:

• Open — may travel, unattributed, if the Chief later decides to disclose a report. Choosing open is choosing to be heard.
• Sealed — encrypted at rest; counted, never carried.
• Withheld — counted, never carried, never stored as text.

You may withdraw your participation at any time. Withdrawal clears your contributions from the record and is a real state change, not a flag.

Engagement sessions are sometimes recorded so that what was said is not lost to a note-taker's speed. Where they are:

• Recording requires an attestation from the facilitator that consent was gathered from everyone in the room. The system will not file a recording without it.
• Audio is stored in a private location with no public access path; playback is by short-lived link only.
• Transcripts are encrypted at rest.
• Recordings in an Indigenous language are never sent to automated transcription. No speech model supports Anishinaabemowin, and the available ones invent fluent English where they cannot understand. Those recordings route to human transcription.

The database and file storage run in Amazon's Canadian region (ca-central-1). The code that reads them — including the code that decrypts sealed testimony — is pinned to Montreal (yul1), so processing happens on Canadian soil rather than defaulting to a US region. Outbound email sends from Canada as well.

Said plainly, because it would be easy to oversell: this covers what IRIS itself processes and stores. If you read your mail at an address hosted outside Canada, the message arrives there regardless of where it was sent from, and that is outside anyone's control here.

The complete list, not a representative sample:

• Supabase / Amazon Web Services — database, file storage and sign-in, in ca-central-1.
• Vercel — application hosting, pinned to Montreal.
• Amazon SES (ca-central-1) — outbound email.
• Mapbox — map tiles. Your browser requests tiles for the area you are viewing.
• OpenAI — where the assistant runs on the hosted path, document text and your question are sent to OpenAI to build the search index and compose an answer. IRIS also operates its own inference hardware in Canada, and answer generation runs there when it is available; the search index is still built with OpenAI today.

Enforced in the database, not only in the interface: member identities; questions you asked the assistant; sealed and withheld engagement contributions; exact land-use coordinates; a Chief's own notes; and any other community's data. What a proponent can see is an aggregate a Chief chose to disclose, and every view of it is recorded.

This is not yet settled, and we would rather say so than state a period we have not decided. IRIS holds engagement recordings and encrypted testimony that may concern sacred sites, and a retention period for those is a decision that should be made with the Nations whose material it is — not chosen unilaterally by the operator and published as a fact.

Until it is set: nothing is deleted on a schedule, a community may request deletion of its material at any time, and withdrawal of participation takes effect immediately rather than waiting on a retention clock.

Under Canadian federal privacy law you may ask what personal information we hold about you, ask for it to be corrected, and withdraw consent. Contact us at the address in §1. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada.