Privacy Policy

Last updated: April 3, 2026

Xerxes Systems Inc. (“we,” “us,” “our”) is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services, in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (Law 25), and Canada’s Anti-Spam Legislation (CASL).

1. Privacy Officer

We have designated a Privacy Officer who is accountable for our privacy practices and available to address inquiries, complaints, and access requests.

2. Information We Collect

We collect personal information through the following means:

Information you provide directly

• Contact information: name and email address provided via our waitlist, contact forms, or account registration.
• Account information: business name, professional credentials, and preferences when you subscribe to our services.
• Documents: files you upload to Mon Espace (our client portal) for professional purposes.
• Communications: messages you send through our platform or to our support team.

Information collected automatically

• Usage data: pages visited, features used, time spent, browser type, device information, and IP address.
• Cookies: see Section 5 below for full details on our cookie practices.

How to refuse collection

You may refuse to provide personal information. If you do, some services may be unavailable. You can browse our website without providing any personal information. See Section 5 for how to refuse cookies.

3. How We Use Your Information

• To provide, maintain, and improve our services.
• To process your registration and manage your account.
• To communicate product updates, service changes, or relevant information you have opted into receiving.
• To respond to your inquiries and provide customer support.
• To comply with legal obligations, including FINTRAC reporting where applicable.
• To detect and prevent fraud, security incidents, and unauthorized access.

4. Data Sharing and Service Providers

We do not sell, rent, or trade your personal information.

We may disclose personal information to the following categories of service providers, who process it on our behalf under written agreements:

• Hosting and infrastructure providers — to maintain platform availability and security.
• Email service providers — to send transactional and marketing communications.
• Analytics providers — to understand usage patterns and improve services.
• Payment processors (Stripe) — to process subscription payments.

All service providers are contractually bound to:

• Use personal information only for the purposes we specify.
• Maintain security standards comparable to ours.
• Not retain personal information longer than necessary.
• Comply with applicable privacy laws, including Law 25 and PIPEDA.

Data location

Personal information is primarily stored and processed in Canada. Some service providers may process data in the United States. When we engage processors outside Quebec or Canada, we maintain written agreements ensuring adequate safeguards as required by Law 25.

We may also disclose personal information to legal authorities when required by law or to protect our rights.

5. Cookies and Tracking Technologies

Essential cookies

Required for core functionality (authentication, security, session management). These are deployed automatically and cannot be declined without losing service access.

Analytics cookies

We may use analytics tools to collect usage data (pages visited, time spent, browser type). By default, non-essential analytics cookies are not enabled on your device. You may accept or decline them through our consent mechanism.

How to refuse cookies

You may refuse non-essential cookies by:

• Declining cookies when prompted by our consent banner.
• Adjusting your browser settings to block or delete cookies.
• Contacting our Privacy Officer to update your preferences.

Refusing analytics cookies will not affect your ability to use core service features.

6. Consent and Communications (CASL)

Xerxes Systems Inc. complies with Canada’s Anti-Spam Legislation (CASL).

Types of consent

• Express consent: you actively opted in via a form, checkbox, or signup.
• Implied consent: you have an existing business relationship with us (e.g., you created an account or provided contact information with reasonable expectation of communication).

Every commercial electronic message includes

• Our business name: Xerxes Systems Inc.
• Our mailing address.
• A valid contact email address.
• A clear, easy-to-use unsubscribe mechanism.
• A statement that you may withdraw consent at any time.

How to unsubscribe

• Click the “Unsubscribe” link in any marketing email.
• Contact our Privacy Officer at privacy@xerxessystems.com.
• Reply to any message with “UNSUBSCRIBE.”

We process all unsubscribe requests within 10 business days. You may continue to receive transactional messages (account security alerts, service notifications) after unsubscribing from marketing.

7. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law.

• Account data: retained for the duration of your account plus 30 days after closure, to address pending inquiries. You may request deletion at any time, subject to legal obligations.
• Waitlist emails: retained until you opt out or request deletion. Contacts with no interaction for 24 months are removed automatically.
• Analytics data: retained for up to 24 months, then deleted.
• Support correspondence: retained for up to 3 years, then securely deleted.
• Payment and transaction records: retained for 7 years as required by Canadian tax and commercial law, then securely destroyed.
• Documents uploaded to Mon Espace: retained for the duration of your subscription plus 60 days. You may export and delete at any time.

7.1 Data Residency

Your personal information is stored and processed within Canada. Our primary database infrastructure is hosted in Montreal, Quebec (AWS ca-central-1 region) through our sub-processor Supabase, Inc. Payment processing is handled by Stripe, Inc. with data centers in Canada and the United States. Email communications are processed by Postmark (for transactional emails) and Brevo (for marketing communications). No personal data is transferred outside of Canada and the United States. All sub-processors maintain SOC 2 Type II compliance or equivalent security certifications.

8. Your Rights

Under PIPEDA and Quebec Law 25, you have the following rights:

Right of access

You may request access to personal information we hold about you. Email our Privacy Officer with subject line “Access Request” and provide your name and account details. We will respond within 30 days. Access is provided at no charge.

Right of correction

You may request correction of inaccurate or incomplete information. Contact our Privacy Officer with details. We will verify and correct records within 30 days.

Right of deletion

You may request deletion of your personal information, subject to legal retention obligations (e.g., tax records). Contact our Privacy Officer with subject line “Deletion Request.” We will confirm within 30 days.

Right to data portability (Law 25)

You may request a copy of your personal information in a machine-readable format (CSV, JSON). Contact our Privacy Officer with subject line “Portability Request.” We will provide a copy within 60 days.

Right to withdraw consent

You may withdraw consent for communications or specific uses of your personal information at any time. Click “unsubscribe” in any email or contact our Privacy Officer. Withdrawal is effective immediately.

Right to lodge a complaint

There is no fee to exercise any of these rights.

9. Data Breach Notification

In the event of a security breach involving personal information that poses a risk of serious injury, Xerxes Systems Inc. will:

1. Investigate promptly to determine scope and impact.
2. Notify the Commission d’accès à l’information du Québec (CAI) as required by Law 25.
3. Notify affected individuals without unreasonable delay, providing:
   • A description of the personal information involved.
   • Likely consequences of the breach.
   • Measures taken to mitigate harm.
   • Recommendations for self-protection.
   • Contact information for our Privacy Officer.

We maintain a record of all security incidents for compliance and accountability.

10. Security

We implement industry-standard security measures including:

• Encryption of data in transit (TLS) and at rest.
• Access controls and authentication.
• Regular security assessments.
• Secure backup and recovery procedures.
• Incident response procedures.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page with a new date and, where possible, notify you by email at least 30 days before the change takes effect.

12. Accessibility

This policy is written in plain language. If you need it in an alternative format (large print, screen reader compatible, or another language), contact our Privacy Officer. We will provide an accessible version at no cost within 5 business days.

13. Contact Us