Privacy Policy

01

Information We Collect

Account Information

When you create an account, we collect:

• Name, email address, and business name
• Phone number (if provided for agent communication)
• Account credentials (passwords are hashed and never stored in plaintext)

Business Data Processed by AI Agents

Our AI agents process data on your behalf as part of delivering our services. Depending on the agents you activate, this may include:

• Phone call transcripts and voice recordings
• Lead and customer contact information
• Online reviews and reputation data
• Invoices and financial records
• Appointment and scheduling information
• Social media content and engagement data
• Email campaigns and subscriber lists

Payment Information

Payment processing is handled entirely by Stripe. We do not store your credit card numbers, bank account details, or other sensitive financial data on our servers. Stripe collects and processes payment information in accordance with PCI-DSS standards. Please refer to Stripe's Privacy Policy for details.

Usage Analytics

We collect aggregated usage data to improve our platform, including:

• Pages visited and features used within the dashboard
• Agent activation and performance metrics
• Session duration and interaction patterns
• Device type, browser, and operating system

02

How We Use Information

We use collected information for the following purposes:

• Providing AI Services: To operate your AI agent team, process your business data, and deliver the autonomous workflows you have configured.
• Platform Improvement: To analyze usage patterns, fix bugs, and develop new features that improve the AI agent experience.
• Billing and Account Management: To process subscription payments, manage your account, and provide invoices.
• Communication: To send service-related notifications, respond to support inquiries, and (with your consent) deliver marketing updates about new agents or features.
• Security: To detect, prevent, and respond to fraud, abuse, or security incidents.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

03

AI Data Processing

AQTHEVISION operates autonomous AI agent teams that process your business data to perform tasks on your behalf. It is important to understand how this processing works:

How AI Agents Process Your Data

• Voice Agents process inbound and outbound phone calls, generating transcripts and extracting actionable information such as appointment requests and lead details.
• Lead Agents capture, qualify, and organize leads from your website, phone calls, and other sources.
• Review Agents monitor online reviews, analyze sentiment, and draft responses for your approval.
• Content Agents generate social media posts, email campaigns, and marketing content based on your brand guidelines.
• Operations Agents handle scheduling, invoicing, and workflow coordination.

Third-Party AI Providers

To power our AI agents, we send relevant data to third-party AI model providers for processing. These providers include Anthropic, OpenAI, and xAI. Data sent to these providers is used solely for generating responses and completing tasks. We select providers based on their data handling policies and do not permit them to use your data for training their models where such opt-out mechanisms are available.

Data Minimization

AI agents only access the data necessary to perform their specific function. A review monitoring agent, for example, does not have access to your invoicing data.

04

Data Sharing

We do not sell, rent, or trade your personal information. We share data only in the following circumstances:

• Payment Processing: Stripe receives payment-related information to process your subscription and transactions.
• AI Model Providers: Anthropic, OpenAI, and xAI receive business data as necessary to power AI agent processing, subject to their respective data processing agreements.
• Infrastructure Providers: Our hosting and database providers (Vercel and Railway) store your data as part of platform operations.
• Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or if necessary to protect the rights, property, or safety of AQTHEVISION, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. You will be notified of any such change.

05

Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Data stored in our PostgreSQL database (hosted on Railway) is encrypted at rest.
• Hosting Security: Our application is deployed on Vercel, which provides enterprise-grade infrastructure security, DDoS protection, and automatic HTTPS.
• Authentication: User sessions are secured with JWT tokens. Passwords are hashed using industry-standard algorithms.
• Access Controls: Tenant-level isolation ensures that your business data is accessible only to your account. AI agents operate within strict permission boundaries.

While we take commercially reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

06

Data Retention

• Active Accounts: Your data is retained for as long as your account remains active and your subscription is current.
• Cancelled Accounts: Upon cancellation, your account data and all associated business data processed by AI agents will be retained for 30 days to allow for reactivation. After 30 days, data is permanently deleted from our primary systems.
• Backups: Encrypted backups may retain data for up to 90 days after deletion from primary systems, after which they are purged.
• Legal Obligations: Certain records may be retained longer if required by law (e.g., billing records for tax purposes).

You may request early deletion of your data at any time by contacting us.

07

Your Rights

Under PIPEDA and, where applicable, the GDPR, you have the following rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Deletion: You may request that we delete your personal information, subject to legal retention requirements.
• Data Export: You may request a machine-readable export of your data.
• Opt-Out of Marketing: You may unsubscribe from marketing communications at any time. Service-related communications (e.g., billing notices, security alerts) are not optional.
• Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Lodge a Complaint: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada or, if applicable, your local data protection authority.

To exercise any of these rights, contact us at hello@aqthevision.ai. We will respond within 30 days.

08

Cookies and Local Storage

AQTHEVISION uses a minimal approach to browser storage:

• Authentication Tokens: We store JWT authentication tokens in your browser's localStorage to maintain your session. These are essential for the platform to function.
• No Tracking Cookies: We do not use third-party tracking cookies, advertising cookies, or analytics cookies that track you across other websites.
• No Cookie Banners: Because we do not use non-essential cookies, no cookie consent banner is required.

09

Children's Privacy

AQTHEVISION is a business-to-business platform and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us immediately.

10

International Data Transfers

AQTHEVISION is based in Montreal, Canada. Your data may be processed in both Canada and the United States through our cloud infrastructure providers (Vercel and Railway) and AI model providers (Anthropic, OpenAI, xAI).

Canada has been recognized by the European Commission as providing an adequate level of data protection. For transfers to the United States, we rely on our providers' compliance with applicable data transfer mechanisms, including Standard Contractual Clauses where required by GDPR.

By using our platform, you acknowledge that your data may be transferred to and processed in jurisdictions outside your country of residence.

11

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Notify you by email if the changes materially affect how we handle your data
• Post a notice on the platform dashboard

Your continued use of the platform after changes are posted constitutes acceptance of the updated policy.

12

Contact

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us:

For complaints regarding our privacy practices, you may also contact the Office of the Privacy Commissioner of Canada.