Privacy Policy
Last updated: April 9, 2026
Xerxes Systems (“we,” “us,” “our”) is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services, in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (Law 25), and Canada’s Anti-Spam Legislation (CASL).
1. Privacy Officer
We have designated a Privacy Officer who is accountable for our privacy practices and available to address inquiries, complaints, and access requests.
2. Information We Collect
We collect personal information through the following means:
Information you provide directly
- Contact information: name and email address provided via our waitlist, contact forms, or account registration.
- Account information: business name, professional credentials, and preferences when you subscribe to our services.
- Documents: files you upload to Mon Espace (our client portal) for professional purposes.
- Communications: messages you send through our platform or to our support team.
Information collected automatically
- Usage data: pages visited, features used, time spent, browser type, device information, and IP address.
- Cookies: see Section 5 below for full details on our cookie practices.
How to refuse collection
You may refuse to provide personal information. If you do, some services may be unavailable. You can browse our website without providing any personal information. See Section 5 for how to refuse cookies.
3. How We Use Your Information
- To provide, maintain, and improve our services.
- To process your registration and manage your account.
- To communicate product updates, service changes, or relevant information you have opted into receiving.
- To respond to your inquiries and provide customer support.
- To comply with legal obligations, including FINTRAC reporting where applicable.
- To detect and prevent fraud, security incidents, and unauthorized access.
4. Data Sharing and Service Providers
We do not sell, rent, or trade your personal information.
We may disclose personal information to the following categories of service providers, who process it on our behalf under written agreements:
- Hosting and infrastructure providers — to maintain platform availability and security.
- Email service providers — Postmark (Wildbit LLC) for transactional email delivery; Brevo for marketing communications.
- Analytics providers — to understand usage patterns and improve services.
- Payment processors (Stripe) — to process subscription payments.
All service providers are contractually bound to:
- Use personal information only for the purposes we specify.
- Maintain security standards comparable to ours.
- Not retain personal information longer than necessary.
- Comply with applicable privacy laws, including Law 25 and PIPEDA.
Data location
Personal information is primarily stored and processed in Canada. Some service providers may process data in the United States. When we engage processors outside Quebec or Canada, we maintain written agreements ensuring adequate safeguards as required by Law 25.
We may also disclose personal information to legal authorities when required by law or to protect our rights.
5. Cookies and Tracking Technologies
Essential cookies
Required for core functionality (authentication, security, session management). These are deployed automatically and cannot be declined without losing service access.
Analytics cookies
We may use analytics tools to collect usage data (pages visited, time spent, browser type). By default, non-essential analytics cookies are not enabled on your device. You may accept or decline them through our consent mechanism.
How to refuse cookies
You may refuse non-essential cookies by:
- Declining cookies when prompted by our consent banner.
- Adjusting your browser settings to block or delete cookies.
- Contacting our Privacy Officer to update your preferences.
Refusing analytics cookies will not affect your ability to use core service features.
6. Consent and Communications (CASL)
Xerxes Systems complies with Canada’s Anti-Spam Legislation (CASL).
Types of consent
- Express consent: you actively opted in via a form, checkbox, or signup.
- Implied consent: you have an existing business relationship with us (e.g., you created an account or provided contact information with reasonable expectation of communication).
Every commercial electronic message includes
- Our business name: Xerxes Systems
- Our contact information.
- A valid contact email address.
- A clear, easy-to-use unsubscribe mechanism.
- A statement that you may withdraw consent at any time.
How to unsubscribe
- Click the “Unsubscribe” link in any marketing email.
- Contact our Privacy Officer at [email protected].
- Reply to any message with “UNSUBSCRIBE.”
We process all unsubscribe requests within 10 business days. You may continue to receive transactional messages (account security alerts, service notifications) after unsubscribing from marketing.
7. Data Retention
We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law.
- Account data: retained for the duration of your account plus 30 days after closure, to address pending inquiries. You may request deletion at any time, subject to legal obligations.
- Waitlist emails: retained until you opt out or request deletion. Contacts with no interaction for 24 months are removed automatically.
- Analytics data: retained for up to 24 months, then deleted.
- Support correspondence: retained for up to 3 years, then securely deleted.
- Payment and transaction records: retained for 7 years as required by Canadian tax and commercial law, then securely destroyed.
- Documents uploaded to Mon Espace: retained for the duration of your subscription plus 60 days. You may export and delete at any time.
7.1 Data Residency
Your personal information is stored and processed primarily within Canada. The register below lists our subprocessors and their jurisdiction.
- Anthropic — AI reasoning (Claude API) — United States.
- Supabase — managed PostgreSQL database — Canada (AWS ca-central-1).
- Google Cloud / Workspace — Gmail, Drive and Calendar APIs — United States.
- Google LLC (Gemini API) — AI-assisted extraction of uploaded document content (Mon Espace), broker-triggered — United States.
- Cloudflare — content delivery and access tunnel — global (edge).
- Backblaze B2 — object storage (client-document copies and signed consent PDFs) — United States.
- Postmark — transactional email delivery — United States.
- Stripe — billing (Mon Espace) — United States.
- AssemblyAI — phone-call transcription — United States.
- Deepgram — real-time transcription (standby) — United States.
- Plausible — cookieless showcase-site analytics — European Union.
- Brevo (Sendinblue SAS) — marketing email and Mon Espace transactional email — European Union (France, Germany); data sent to Brevo is limited to email addresses, names and message content.
For every transfer of personal information outside Quebec — to the United States or to the European Union — we have entered into written contractual agreements with providers selected for their recognized security practices. Destinations located in the European Union offer a level of protection substantially equivalent to Quebec’s requirements under the European Union’s General Data Protection Regulation (GDPR). For any questions about these transfers or the safeguards applied, contact our Privacy Officer (§1).
8. Your Rights
Under PIPEDA and Quebec Law 25, you have the following rights:
Right of access
You may request access to personal information we hold about you. Email our Privacy Officer with subject line “Access Request” and provide your name and account details. We will respond within 30 days. Access is provided at no charge.
Right of correction
You may request correction of inaccurate or incomplete information. Contact our Privacy Officer with details. We will verify and correct records within 30 days.
Right of deletion
You may request deletion of your personal information, subject to legal retention obligations (e.g., tax records). Contact our Privacy Officer with subject line “Deletion Request.” We will confirm within 30 days.
Right to data portability (Law 25)
You may request a copy of your personal information in a machine-readable format (CSV, JSON). Contact our Privacy Officer with subject line “Portability Request.” We will provide a copy within 60 days.
Right to withdraw consent
You may withdraw consent for communications or specific uses of your personal information at any time. Click “unsubscribe” in any email or contact our Privacy Officer. Withdrawal is effective immediately.
Right to lodge a complaint
There is no fee to exercise any of these rights.
9. Data Breach Notification
In the event of a security breach involving personal information that poses a risk of serious injury, Xerxes Systems will:
- Investigate promptly to determine scope and impact.
- Notify the Commission d’accès à l’information du Québec (CAI) as required by Law 25.
- Notify affected individuals without unreasonable delay, providing:
- A description of the personal information involved.
- Likely consequences of the breach.
- Measures taken to mitigate harm.
- Recommendations for self-protection.
- Contact information for our Privacy Officer.
We maintain a record of all security incidents for compliance and accountability.
10. Security
We implement industry-standard security measures including:
- Encryption in transit (TLS) and storage-level encryption at rest (AES-256, Supabase / AWS ca-central-1 infrastructure). Application-level tokenization of personal identifiers is in development.
- Access controls and authentication.
- Regular security assessments.
- Secure backup and recovery procedures.
- Incident response procedures.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page with a new date and, where possible, notify you by email at least 30 days before the change takes effect.
12. Accessibility
This policy is written in plain language. If you need it in an alternative format (large print, screen reader compatible, or another language), contact our Privacy Officer. We will provide an accessible version at no cost within 5 business days.
13. Contact Us