Privacy Policy

QuickHalo is a sole proprietorship registered in Ontario, Canada. This policy explains how we handle personal information when a business subscribes to QuickHalo and when that business uses QuickHalo to communicate with its own customers.

There are two distinct roles, and the difference matters:

• Information about our subscribers. When your business signs up, we decide why that information is collected. This policy governs it.
• Information about your customers. When your business uses QuickHalo to book appointments, answer enquiries or send reminders, your business decides why that information is collected. We process it on your instructions. Your own privacy policy governs your relationship with those individuals.

Account and business information:

• name, email address and password credentials for each user;
• business name, industry, address, contact details, hours and service configuration;
• plan selection, subscription status and billing history.

Information your business puts into the product about its customers:

• contact details such as name, email address and phone number;
• conversation content from the website chat widget, email, and — where enabled — SMS and calls;
• appointment details including service, time and any notes recorded;
• knowledge sources and business content you upload for the AI to draw on.

Operational information:

• authentication session cookies;
• application and security logs, including timestamps, request identifiers and error diagnostics;
• message and call delivery records generated by our providers.

To provide and operate the service; to authenticate users and keep accounts separate; to process subscriptions and payments; to send transactional email such as confirmations, reminders and receipts; to generate AI-assisted drafts and responses; to deliver messages your business sends; to investigate security incidents and abuse; to provide support; and to meet our legal and accounting obligations.

We do not sell personal information, and we do not use your business’s customer conversations to advertise to anyone.

To produce AI-assisted replies and summaries, conversation content and the knowledge sources you configure are sent to a third-party AI provider over an encrypted connection, processed, and returned. AI output is generated text and can be inaccurate; the product provides approval and human-handoff controls, and how you configure them is your decision.

You control what goes into your knowledge sources. Do not upload information that should not be processed by a third-party AI provider — for example government identifiers, payment card numbers or detailed health records.

We use the following providers to operate QuickHalo:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and delivery.
• Stripe — subscription billing and payment processing.
• Resend — transactional email delivery.
• OpenAI-compatible AI provider — generating AI-assisted responses.
• Twilio — phone numbers, SMS and calls, where a business has that capability provisioned.

These providers process information on our behalf under their own agreements and privacy terms. They operate infrastructure in several countries, including the United States, which means personal information may be stored or processed outside Canada and may be accessible to courts and authorities in those countries. We do not currently offer Canadian data residency and do not claim it.

Payments are processed by Stripe. Card details are entered directly with Stripe and QuickHalo never receives or stores your full card number. We retain subscription status, plan, billing period and invoice history so we can operate your account.

We use cookies that are strictly necessary to run the service: a session cookie that keeps you signed in, and a separate short-lived cookie used only during password recovery so the reset form can tell a genuine recovery link from an ordinary session.

We do not currently run advertising or third-party analytics cookies. If that changes we will update this policy and put appropriate consent controls in place before any such cookie is set.

We keep account and business information for as long as your subscription is active. After termination you may request a copy of your business data within 30 days, after which we may delete it.

Billing records are kept as long as tax and accounting law requires. Security and application logs are kept for a limited operational period and then discarded. Backups are retained on a rolling basis by our database provider, so deleted information may persist in a backup for a period after deletion from the live system.

We do not currently commit to a fixed deletion timeframe beyond what is described here.

We protect information with measures including encryption in transit, encryption at rest by our database provider, hashed passwords managed by our authentication provider, database-level tenant isolation so one business cannot read another’s records, signature verification on payment and telephony webhooks, and restricted administrative access with an auditable record of support access to a business’s account.

No system is completely secure, and we do not hold any third-party security certification at this time. If a breach affecting personal information occurs, we will act in line with our obligations under applicable Canadian privacy law.

Because your business decides what to collect from its own customers, you are responsible for having a lawful basis to collect and use it, for your own privacy notice, for obtaining the consent required to contact people by email, SMS or phone under CASL and other applicable law, for honouring unsubscribe and stop requests, and for responding to privacy requests from your customers. We will assist you where we reasonably can.

Under Canadian privacy law, including PIPEDA and applicable provincial legislation, you may ask to access the personal information we hold about you, to have it corrected if it is inaccurate, to withdraw a consent you previously gave, and to have information deleted where we are not required to keep it.

Email support@quickhalo.com and describe your request. We may need to verify your identity before acting. We aim to respond within 30 days.

If an individual whose information was entered by a QuickHalo subscriber contacts us directly, we will normally refer them to that business, because it is the business that decides how the information is used.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

QuickHalo is a business product and is not directed to children. We do not knowingly collect personal information from children. If you believe a child’s information has been provided to us, contact us and we will look into it.

We may update this policy. When we do, we will change the “last updated” date above, and for material changes we will give reasonable notice.

Privacy questions and requests: support@quickhalo.com. This is the monitored contact for privacy matters as well as general support.