Privacy Policy

Who we are and what this covers

QuantumFlex AI Inc. ("we") is a custom software and automation business in Wetaskiwin, Alberta, Canada. This policy covers this website, quantumflexai.com: its pages, the contact form, the booking page, the visitor statistics we keep, the Meta Pixel, and the records we keep if you become a client. It does not cover the software products we operate, which have their own policies on their own sites.

We collect only what each part of the site needs, we say below how long each thing is kept, and we say plainly what we can and cannot delete on request.

When you send a message

The contact form asks for your name, your email address, your company (optional), what you are interested in, and your message. Sending it produces one email to us; nothing you type in the form is stored, apart from the keyed code described under "How we protect it". The reply-to address of that email is yours, so we can answer.

Two things travel with the message that you do not type. Google reCAPTCHA scores the submission to keep out bots, and that score is noted in the email we receive. And the IP address of your connection is kept for one hour as a keyed code, not as the address itself, so that no connection can send more than a handful of messages an hour.

Your message stays in our mailbox until we delete it. We delete it when you ask.

When you book a call

The booking page asks for your name, your email address, a phone number (optional), any notes you want us to read before the call (optional), and the time you choose. If you arrived from one of our ads, the link tells us which campaign source you came from, and we keep that word with the booking.

The notes field is free text and goes everywhere the booking goes, including into two calendars, so please keep health or other sensitive details out of it. Anything you need us to know that way, tell us on the call.

What happens with a booking:

• You get a confirmation email with a calendar invitation attached. The invitation carries your name, your email address, your notes and the time, and lands in your calendar and in ours.
• We get an alert email with the same details, so we can prepare.
• You get a reminder email a day before the call and another an hour before it.
• Every one of those emails carries a link to your booking. The link contains a private token: anyone who has it can view, cancel or reschedule the call, so keep it to yourself. The link stops working when the booking details are removed.
• On that page you can cancel, choose another time, or press "Remove my details". Removing them cancels a call that has not happened yet, then erases your name, email, phone, notes and the link from the booking. The date and its status stay behind as a calendar entry with no person attached.

90 days after the call — or 90 days after you cancel it — the same removal happens on its own. The IP address of your connection is kept for one hour as a keyed code, not as the address itself, for the same reason as on the contact form.

Our own visitor statistics

We keep our own count of how the site is used, on our own dashboard, and share it with no one. For each page you view we record the page, the referring site you came from (its host only, not the full address), the campaign source if you followed an ad link, how long the page took to load and respond, which buttons and links you clicked (by their label), how far down the page you scrolled, and how long you stayed.

To tell one visit from another we keep a random identifier in your browser for the session: it exists only while your browser stays open on this site and is gone when you close it. It is not linked to your name, your email address, or anything else about you, and because of that we cannot find your statistics rows if you ask us to — there is nothing in them that says they are yours.

The IP address of your connection is kept for one hour as a keyed code, not as the address itself, so that no single connection can flood the counters. The statistics themselves are deleted after 365 days.

The Meta Pixel and advertising measurement

This website uses the Meta Pixel to measure whether our advertising on Facebook and Instagram leads to visits and booked calls. The pixel sets a cookie named _fbp in your browser and sends Meta the pages you view on this site, the fact that a call was booked, and technical information about your browser, such as its screen size and time zone. It does not send the details you type into our forms. Meta may combine what it receives with information it already holds about you, under Meta’s own privacy policy.

The pixel runs on every page except our own administration pages, from the moment a page loads. You can opt out of advertising based on this data in your Meta ad preferences. Blocking the _fbp cookie in your browser stops Meta recognising your browser across sites; it does not stop the page view being sent, which a content blocker does. We cannot delete what Meta has already received; its ad preferences are the remedy Meta offers.

Cookies and browser storage

We set no cookies of our own. The only cookie set on this site is _fbp, by Meta’s script, described above. If you visited this domain before January 2026, your browser may still hold _ga cookies from the site that ran here then; nothing on this site reads, sets or refreshes them, and you can clear them in your browser.

Two things live in your browser’s own storage: the session identifier for our statistics, gone when you close the browser, and your dark-or-light choice, saved only if you use the theme switch in the header.

If you become a client

When we quote and invoice work, we keep your name, your company, your billing address and your email address, and the invoices and payment records themselves. Invoices are paid by Interac e-Transfer; we never collect card details and use no payment processor. Where an invoice recurs, it is generated and emailed to you automatically on its date.

Invoices and the records behind them are kept for the period the Income Tax Act requires, stated under "How long we keep things" below. That is the one thing we cannot delete on request while the period runs. Everything else about you as a client can be corrected at any time, and is deleted when the relationship ends and the period has run.

Who handles the data for us, and where

These are the companies whose systems the site runs on, what each does, and where it keeps what it holds:

• Vercel — hosts this website and runs its code, including the request logs that record your IP address and browser. Location: Canada (Montréal, region yul1).
• Supabase — the database, the file storage and our own sign-in. Location: Canada (Central), region ca-central-1.
• Amazon SES — sends every email this site sends. Location: United States (Northern Virginia, region us-east-1).
• Web Hosting Canada — our mailboxes, where your messages and booking notices arrive. Location: Canada.
• Google reCAPTCHA — bot protection on the two forms. Its servers are wherever it operates them.
• Meta — the Meta Pixel, described in its own section below. Its servers are wherever it operates them.

The site’s code runs in Canada, in the same region as its database, and the file storage and our mailboxes are in Canada too, so the application itself moves nothing across the border. The one processor outside Canada is Amazon SES: every email the site sends leaves through a server in the United States and is subject to its laws while there.

Each of them publishes its own privacy policy: Vercel, Supabase, Amazon Web Services, Web Hosting Canada, Google and Meta.

How long we keep things

• Visitor statistics: 365 days, then deleted.
• Booking details: 90 days after the call, or 90 days after a cancellation, then removed from the booking on their own — or sooner, when you press "Remove my details".
• The keyed record of your connection’s IP address, on the forms, the statistics and our sign-in page: one hour, then deleted.
• Your messages and booking emails in our mailbox: until we delete them, which we do when you ask.
• Client invoices and the records behind them: six years after the end of the tax year they belong to, as the Income Tax Act requires.

These are the periods the site enforces in code. If we change one, this page changes with it.

Access, correction and deletion — and their limits

You can ask us what we hold about you, ask us to correct it, or ask us to delete it, by writing to info@quantumflexai.com. We answer within 30 days. For a booking you do not need to write: the link in your confirmation email removes your details on the spot.

What we can do: remove your details from a booking; delete your messages and booking emails from our mailbox; correct or delete what we hold about you as a client, subject to the tax period above.

What we cannot do, said plainly so the promise is one we can keep: we cannot find your statistics rows, because nothing in them identifies you; we cannot delete what Meta has received, and its ad preferences are the way to limit how Meta uses it; we cannot reach the invitation once it is in your own calendar, though we remove it from ours; and the companies listed above keep their own logs and delivery records for their own periods under their own policies.

How we protect it

• Every connection to the site, to the database and to the email service is encrypted in transit.
• The database can be reached only by the site’s own server code; nothing in your browser talks to it.
• Our administration pages open only to one allowlisted address, by a one-time code sent to it, and the session ends after thirty minutes without activity.
• A connection that asks that page for a code, or tries one, is counted for one hour by the same keyed record of its IP address, to limit repeated attempts.
• Both forms are protected by reCAPTCHA and by ceilings on how many submissions a connection or an address can make in an hour.
• To count those submissions, the email address you give on the contact form or the booking form, and the address on a booking you reschedule, is kept for one hour only as a keyed code, not as the address itself, then deleted.
• The site is audited against a written engineering standard; the audits of 2026 covered reliability, security, and data and privacy.

Who is responsible

The person responsible for personal information at QuantumFlex AI Inc. is David Strick, Privacy Officer, QuantumFlex AI Inc.. Write to info@quantumflexai.com, or to us at Wetaskiwin, Alberta, Canada.

If you are not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta.

Changes to this policy

When the site changes what it collects or who handles it, this page changes in the same release, and the date at the top moves. There is no mailing list to notify; this page is the record.