Skip to content
ENFR
Back to home

Terms of Service & Privacy Policy

Last updated: 2026-09-29

These terms govern access to and use of the QSAI platform and its mobile applications (together, the “Service”), operated by QSnxt (“we”, “us”). They form an agreement between us and the organisation that subscribes to the Service (the “Customer”), together with the signed quote that sets out the Customer’s plan, users and price. By creating an account or using the Service, on the web or on a mobile device, you accept these terms on behalf of your organisation.

1. The Service

The Service is a business management platform, available in a web browser and through our mobile applications for iOS and Android, that may include, depending on the modules enabled in the Customer’s quote: customer relationship management (CRM), project management, calendar, team communication and video calls, document cloud, notes, knowledge base, toolbox utilities, artificial-intelligence assistants, and operational or ERP modules such as inventory, delivery, human resources, payroll records, e-signature and marketing.

We improve the Service continuously. We may add, change or retire features, and we will give reasonable advance notice before removing or materially changing a feature the Customer depends on.

2. Accounts, organisations and users

Each Customer works inside its own organisation on the platform, and access is granted per user. Administrators designated by the Customer create users, assign module access and manage permissions. The Customer is responsible for the accuracy of the account information it provides, for the activity of its users, and for keeping credentials confidential. Accounts are personal — they must not be shared between individuals.

Sessions expire after a period of inactivity. We may require additional authentication measures where necessary to protect the Service.

3. Mobile applications

The QSAI mobile applications give access to the same organisation, the same account and the same permissions as the web platform: a user signs in with their QSAI credentials and sees only the modules their organisation has granted them. We grant each authorised user a personal, non-exclusive, non-transferable and revocable licence to install and use the applications on devices they own or control, for the Customer’s business purposes and for the duration of the subscription.

Where the applications are obtained from the Apple App Store or Google Play, the terms of that store also apply to the download. These terms are between the Customer and us only: Apple and Google are not parties to them, are not responsible for the applications or their support, and have no obligation to provide maintenance. Apple and its subsidiaries are third-party beneficiaries of these terms as they relate to the iOS application.

The applications ask for a device permission only when a feature needs it, and each permission can be refused or withdrawn at any time in the device settings, at the cost of that feature only:

  • Camera and microphone — for video calls and, when you choose to, to take a photo to share in a conversation.
  • Photo library and files — only to let you pick the picture or document you decide to share.
  • Notifications — to alert you of messages, mentions and incoming calls. On Android, keeping notifications working in the background shows a permanent, low-priority system notification.
  • Bluetooth — only to route call audio to your headset or car.

The applications do not access your contacts, your location, or your messages from other apps, and they contain no advertising and no third-party analytics or tracking tools.

On the device, the applications keep only what they need to work: the sign-in credentials, stored in the operating system’s secure storage (the iOS Keychain or Android’s encrypted keystore), your display preferences, and a temporary copy of an attachment while you are viewing it. Your organisation’s data stays on our servers. Signing out erases the credentials from the device, and uninstalling the application removes everything it stored.

If a device is lost or stolen, sign out from another device or contact your administrator or us so the session can be revoked. Some updates may be required to keep using the applications, for example to fix a security issue.

4. Acceptable use

The Service must be used lawfully. The Customer and its users agree not to: upload content they have no right to use; attempt to access another organisation’s data; probe, scan or interfere with the security or integrity of the Service; use the Service to send unlawful, harassing or unsolicited bulk communications; reverse-engineer the platform; or resell access without a written agreement.

We may suspend access without prior notice where use threatens the security, legality or availability of the Service, and we will inform the Customer promptly when we do.

5. Quotes, fees and billing

There is no free tier and no payment is processed inside the application. Every engagement begins with a written quote that states the plan, the number of users, the enabled modules, the storage and artificial-intelligence allowances, and the price. Subscription fees are stated in Canadian dollars, are charged per user per month unless the quote says otherwise, and are exclusive of applicable federal and provincial taxes.

Invoices are issued according to the schedule in the quote and are payable on the terms it sets. Adding users, storage, modules or custom development changes the quote and is agreed in writing before it takes effect. Either party may decline to renew a subscription term by giving the notice stated in the quote; fees already paid for a term in progress are not refundable except where the law requires it.

The mobile applications are free to download and are included in the subscription; they contain no in-app purchases.

6. Customer data and ownership

The Customer owns the data it and its users put into the Service, including client records, projects, documents, messages and files (“Customer Data”). We claim no ownership of it. We process Customer Data only to provide, secure and support the Service, and on the Customer’s instructions.

We do not sell Customer Data, and we do not use it for advertising. Aggregated, de-identified technical metrics that cannot identify the Customer or any individual may be used to monitor and improve the platform.

The Customer may request an export of its data at any time during the subscription. On termination, we make the data available for export for a reasonable period and then delete it from active systems, with backups expiring on their normal cycle.

7. Privacy — what we collect and why

We collect only what the Service needs to function:

  • Account information: name, work email, organisation, language and theme preferences, profile picture, and role or permission assignments.
  • Content you create: records, documents, messages, notes, calendar entries and files you choose to store in the Service.
  • Technical data: authentication events, IP address, browser type, and application logs used for security, troubleshooting and abuse prevention.
  • Mobile devices: the device model, operating-system and application versions, a random identifier generated for each installation, and the notification token issued by Apple or Google, used to manage sign-in sessions and to deliver notifications to the right device.
  • Usage measurement: module activity and artificial-intelligence consumption per organisation, used for support, capacity planning and billing accuracy.
  • Enquiries: the name, email and message you send through the contact form on this website, kept to answer you and to follow up commercially.

Where a module handles sensitive personal information — for example human-resources records, payroll data or signed contracts — that information is encrypted at rest and access is limited to the users the Customer authorises.

We keep personal information only as long as it is needed for the purposes above or as required by law, and we act as a service provider (processor) with respect to the personal information the Customer places in the Service.

The Service is designed for businesses and their staff. It is not directed at children, and we do not knowingly collect personal information from anyone under the age of 14.

8. Data security

Protecting Customer Data is built into how the Service is designed and operated:

  • Hosting on our own infrastructure: the platform, its databases and its file storage run on servers we operate ourselves in Canada — Customer Data is not stored with a public-cloud provider.
  • Encryption at rest: every file stored in the Service — documents, chat attachments, profile pictures and other uploads — is encrypted with AES-256-GCM before it is written to storage. Sensitive fields in the database, such as human-resources and e-signature data, are encrypted as well.
  • Encryption in transit: traffic between your browser or mobile application and the Service is encrypted, and video calls travel encrypted through a media server we host ourselves.
  • Passwords: we never store passwords in readable form; they are kept only as salted Argon2 hashes. Password-reset and invitation links work only once.
  • Isolation between organisations: each Customer’s files are kept in a storage space dedicated to its organisation, and every request is checked against the organisation and the permissions of the signed-in user.
  • Access control: role-based permissions set by the Customer’s administrators, per-module access checks enforced on the server, and restricted, audited administrative access on our side.
  • Sessions: hardened session cookies that expire after inactivity; on mobile, short-lived access tokens with refresh tokens that are replaced on every use and revoked automatically if reuse is detected. Signing out ends the session’s real-time connections and notifications.
  • Resilience: regular backups and monitoring of the platform’s availability and security.

No system is absolutely secure. If a confidentiality incident involving personal information occurs, we act promptly to reduce the risk of harm, record the incident, notify the Customer without undue delay, and — where there is a risk of serious injury — notify the Commission d’accès à l’information, the Office of the Privacy Commissioner of Canada and the affected individuals as the law requires, or assist the Customer in doing so.

9. Artificial intelligence features

Assistants and generative features operate on the content the Customer explicitly makes available to them, and cite the sources they used where the feature supports it. The artificial-intelligence models, including transcription of recorded calls, run on our own servers: Customer Data is not sent to third-party artificial-intelligence providers and is not used to train publicly available models. Prompts governing these features can be reviewed and edited by the Customer’s administrators, and consumption is metered per organisation so it stays visible.

Generated output can be inaccurate or incomplete. It is a draft for a human to review, not professional, legal, financial or medical advice, and the Customer remains responsible for what it does with it.

10. Hosting and subprocessors

Customer Data is stored and processed on our servers in Canada. We rely on a small number of subprocessors only where a service cannot be provided otherwise:

  • Transactional email delivery, for invitations, password resets and notification emails.
  • Apple Push Notification service and, where enabled, Google Firebase Cloud Messaging, which deliver notifications to mobile devices. They receive the device’s notification token and the notification itself — typically a title and a short preview — and may process it outside Canada. Notifications can be turned off at any time in the device or profile settings.
  • A weather service for the optional weather widget, which receives only the approximate coordinates saved in the user’s profile, never their identity.

Each subprocessor is bound by confidentiality and data-protection obligations. Before any personal information is communicated outside Québec, we assess whether it will receive adequate protection, as Québec law requires. We provide the current list of subprocessors on request.

11. Your privacy rights

Under Canadian federal privacy law (PIPEDA) and Québec’s Law 25, individuals may request access to the personal information we hold about them, ask that it be corrected, ask that it be deleted or that its communication be restricted, request it in a portable format, and withdraw a consent previously given. Where the information was placed in the Service by an employer or client organisation, we refer the request to that organisation and assist it in responding.

A user who wants their account deleted can ask their organisation’s administrator, who can deactivate or remove it, or write to us directly.

To exercise a right, or to reach the person accountable for privacy at QSnxt, write to contact@qsai.app. We respond within the timelines set by applicable law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.

12. Cookies and local storage

We use only the cookies the platform needs: a session cookie to keep you signed in, and preference cookies that remember your language and theme. We do not use advertising cookies and we do not track visitors across other websites. Blocking the session cookie prevents signing in.

The mobile applications do not use cookies for tracking; what they keep on the device is described in section 3.

13. Availability and support

We aim to keep the Service available at all times and perform maintenance outside business hours where practical, announcing planned interruptions in advance. Support is included in every subscription and is provided in English and French; response targets, dedicated contacts and any service-level commitments are those stated in the Customer’s quote.

14. Suspension and termination

Either party may terminate for material breach that is not remedied within thirty (30) days of written notice. We may suspend access for non-payment after notice, or immediately where required to protect the Service or comply with the law. On termination, the Customer’s right to use the Service, including the mobile applications, ends and the export period described in section 6 begins.

15. Warranties and liability

We provide the Service with reasonable skill and care and warrant that it will perform substantially as described in the quote and documentation. Apart from that, and to the extent permitted by law, the Service is provided without other warranties. Neither party is liable for indirect, incidental or consequential damages, or for lost profits or lost data that could have been avoided by the Customer’s own retention practices. Our total liability arising out of the agreement is limited to the fees paid by the Customer for the twelve (12) months preceding the event giving rise to the claim. Nothing in these terms limits liability that cannot be limited by law.

16. Changes to these terms

We may update these terms as the Service and the law evolve. The date at the top of this page always reflects the current version, and we will notify the Customer of material changes by email or in the application at least thirty (30) days before they take effect. Continuing to use the Service after that date constitutes acceptance; if the Customer does not accept a material change, it may terminate before the change applies.

17. Governing law

These terms are governed by the laws of the Province of Québec and the federal laws of Canada applicable therein, and the courts of the judicial district of Québec have exclusive jurisdiction, without prejudice to any consumer-protection rights that cannot be waived.

18. Contact

QSnxt, Canada — questions about these terms, about privacy, or about a quote: contact@qsai.app.