Document 13: Pilot and Experimental Features Framework
Pilot register. Nothing in this document is running today. This framework exists so that a pilot can begin for enrolled organizations under proper, specific consent, without re-papering every customer. A capability governed here is never described as current processing in the Privacy Policy.
Plain-language summary: Relae plans to trial some significant new capabilities as pilots with a small number of organizations before offering them generally. This document is the rulebook for those pilots: every pilot needs your organization's specific, informed opt-in; pilots are labelled experimental; you can leave a pilot at any time; and the highest-risk capabilities run in restricted, human-approved modes during any pilot.
1. How pilots work
A pilot is an experimental capability offered only to organizations that enrol. Enrolment requires a distinct, specific, informed consent for that pilot, given by the organization as Controller through a dedicated enrolment surface; a general acceptance of these terms or of the Master Subscription Agreement is not enrolment in any pilot, and a blanket consent to experimentation is not sufficient. Each pilot has its own pilot notice describing what it does, what data it touches, any new sub-processor, where processing occurs, what is collected for evaluation, and how long evaluation data is kept.
2. Rules that apply to every pilot
- Per-pilot opt-in by the organization as Controller, through a dedicated enrolment surface; withdrawal at any time, with the capability switching off for that organization and a clean rollback of any pilot-specific configuration.
- Experimental labelling: pilot features are marked as experimental in the product, and their behaviour and quality may change.
- Human in the loop preserved: no pilot introduces a decision producing legal or similarly significant effects about a Donor made by automated means alone.
- A privacy assessment under Quebec Law 25 before any pilot introduces a new transfer of personal information outside Quebec, and updated disclosures for any new cross-border flow.
- Sub-processor list updated before a pilot adds a new Sub-processor, with the DPA's objection right applying.
- Bounded evaluation data: what a pilot collects for evaluation and feedback is disclosed in the pilot notice, kept no longer than stated there, and de-identified where possible.
- Nothing a pilot does appears in the present-tense Privacy Policy as current processing until it becomes generally available, at which point the policy and DPA are updated first.
3. Capability-specific guardrails
The capabilities below are the ones Relae currently expects to pilot. Each carries a specific legal surface, and each has a containment rule that applies during any pilot of it. Tax-receipt issuance is deliberately not in this table: it is not an experiment, and it is governed by its own enablement framework in Document 11, with per-organization authorization and the issuer-of-record allocation stated there.
-------------------- --------------------------- --------------------------
**Capability** **Why it needs care** **Pilot containment rule**
CRM write-back / Writing into a customer's Explicit per-pilot write
bidirectional sync CRM creates a new outbound authorization from the
flow, makes the CRM vendor organization; writes go to
relevant to the DPA, and a sandbox, preview, or
risks the integrity of the reversible and audited
Controller's own records. path first, never silently
into live records.
Active Under Law 25, de-identified Pooling only under a
cross-organization data is still personal documented anonymization
benchmark pooling information; only genuinely method meeting the
anonymized data may be standard in the Shared
pooled, and Definitions, with minimum
re-identification among cohort sizes and
small organizations is a small-cell suppression;
real risk. pilot organizations
consent to contribution;
Document 8 governs.
Automated donor If Relae sends messages, Human-approved sending
communications CASL applies to Relae as only during any pilot: a
sender: identification, person at the charity
consent tracking, and approves each message or
unsubscribe. The batch before it goes, the
registered-charity relief consent basis for each
under CASL is partial and recipient is tracked, and
cannot be assumed. This sender identification and
containment is a hard legal unsubscribe are included.
constraint, not a Fully automated sending
product-caution preference. would be a separate,
deliberate decision made
with counsel, outside this
framework.
Machine-learning Scores that influence Scores are suggestions a
based scoring decisions about donors person confirms; where a
engage Quebec Law 25's score influences a
rights around automated decision about a donor,
decisions (information, the organization is
observations, human equipped to provide the
review). Law 25 disclosure and a
human-review path.
Donor-facing Donors interacting directly A collection notice at the
surfaces (portal with the Platform are new point of interaction; the
chat, voice capture) direct collection from data donor-facing surface sees
subjects, needing notice only what the pilot notice
and consent at the point of scopes it to see.
interaction.
Research learning Using research results and The secondary use is
and feedback loop feedback to improve the disclosed in the pilot
feature is a secondary use notice, evaluation data is
of data derived from donor retention-bounded, and it
records, with its own is de-identified where
retention questions. possible.
-------------------- --------------------------- --------------------------4. Reusable pilot consent
Each pilot's enrolment surface presents, at minimum: the pilot's name and what it does; the data it touches and any new data it collects; where processing occurs and any new cross-border flow; any new Sub-processor; what is collected for evaluation and its retention period; the experimental status; and how to withdraw. The organization's administrator confirms enrolment expressly. This structure is the reusable consent template for all pilots, so each new pilot needs a completed notice, not a new legal framework.