Privacy Policy

Version française

Policy adopted on July 8, 2026

Introduction

AGENCE HÉLIUM INC. (also known as “Helium Agency Inc.”, hereafter “Gensy”, “we”, “our” or “us”) — Québec enterprise number (NEQ) 1177643112, Canada business number 722984804, with its head office at 1640 rue Guillaume-Renaud, Québec City, Québec G2K 0H7 — operates the platform available at gensy.email (the “Platform”), which allows its clients to create, manage and deploy email signatures and banner campaigns for their staff members (the “Service”).

Gensy attaches fundamental importance to privacy and to the confidentiality of personal information. This privacy policy (the “Policy”) is intended to inform the person concerned: (i) of Gensy’s governance rules and practices regarding the protection of personal information; (ii) of how personal information is collected, used, retained, disclosed and destroyed; (iii) of their rights with respect to their personal information; and (iv) of how to contact the Person in charge of the protection of personal information.

The Policy is intended to ensure compliance with applicable laws, in particular Québec’s Act respecting the protection of personal information in the private sector (“Law 25”), the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Canada’s Anti-Spam Legislation (“CASL”).

Gensy reserves the right to update the Policy periodically, in particular further to legislative changes or recommendations from the Commission d’accès à l’information du Québec (the “CAI”). Where changes are made to the Policy, Gensy will publish the amended Policy on the Platform and, where the changes are substantial, will notify Users by email or by a notice posted on the Platform.

1. Definitions

  • “Client” means any legal person, or its representative, that has subscribed to the Platform.
  • “Applicable Law” collectively means Law 25, PIPEDA, CASL and any other applicable law regarding the protection of personal information and electronic communications.
  • “Personal Information” has the meaning given in section 2.
  • “Officer” means the person in charge of the protection of personal information designated by Gensy in accordance with Law 25.
  • “User” means any person who accesses or uses the Platform, including representatives designated by a Client.
  • “Person concerned by processing on behalf of the Client” means any natural person whose Personal Information is processed by Gensy through the Service on behalf of a Client — in particular the members of its staff whose signatures are generated and deployed.

2. What is personal information?

Personal information means any information that concerns a natural person and that, directly or indirectly, allows that person to be identified (alone or in combination with other data) (“Personal Information”). Personal Information includes, without limitation, name, email address, telephone number, job title, employer, photograph, IP address, technical identifiers and any information relating to the professional activities of an identifiable natural person.

The Policy covers Personal Information concerning Users of the Platform as well as any other person whose Personal Information is processed by Gensy.

3. Personal information we collect

3.1. Information about Users

  • first and last name and professional contact details (email);
  • login credentials (passwords are stored hashed, never in clear text);
  • billing information (full credit card numbers are not retained by Gensy — see subsection 3.3);
  • content communicated to Gensy (support requests, questions to the assistant, comments);
  • account preferences and settings (language, theme, active workspace).

3.2. Information from a connected third-party account

To enable automatic signature deployment, the Client may authorize Gensy to access certain information from its Google Workspace or Microsoft 365 environment, in particular: the directory of its staff members (name, email, job title) and the signature settings of their mailboxes. Access tokens for these services are encrypted (AES-256-GCM) and used solely to operate the Service. The Client acknowledges that it is solely responsible for the compliance of this authorization with the terms of use of the third-party services concerned.

3.3. Payment information

Payments are processed by our payment service provider, Stripe, Inc. (“Stripe”), whose operations and processing servers are located in Canada and the United States. Gensy does not store full credit card numbers. Stripe may transmit certain information to us (card type, last four digits, expiry date, transaction success or failure) for billing and fraud prevention purposes. Stripe’s processing is governed by its privacy policy available at stripe.com/privacy.

3.4. Automatically collected information

When a User browses the Platform, certain technical information is processed: essential authentication cookies (see section 14) and short-lived infrastructure logs (IP address, browser type) kept by our host for security and abuse-prevention purposes. Audience measurement tools (Vercel Analytics, Speed Insights — cookieless) are only enabled with the User’s prior consent (see section 11).

3.5. Information processed on behalf of the Client

The Client imports into the Platform the Personal Information of its staff members required to generate their signatures: name, email, phone, job title, department and, where applicable, a photograph. This information may come from a file provided by the Client, manual entry, the self-service portal offered to the persons concerned, or the directory synchronization authorized in subsection 3.2. With respect to this information, the Client remains the controller and Gensy acts as a service provider: the Client warrants that it is authorized to entrust this information to Gensy and that it has informed the persons concerned.

3.6. Signature usage statistics

Where the Client enables this feature (disabled by default — see section 11), signatures may contain a measurement pixel and redirect links that count opens and clicks. This mechanism is deliberately minimized: no cookie is set on recipients, no IP address is retained and no data identifying the recipient is recorded — only the device type, mail client and timestamp are aggregated for the benefit of the sending Client.

4. Purposes of collection and use

  • create and administer the User’s account;
  • provide, operate, improve and personalize the Service (signature and campaign generation and deployment);
  • process payments, manage billing and collection;
  • communicate with the User (technical notices, support, service notifications);
  • send, subject to applicable consent, commercial electronic messages in accordance with CASL;
  • prevent fraud, abuse and uses contrary to the terms of use;
  • ensure the security of the Platform and the protection of Personal Information;
  • perform statistical and performance analyses, using de-identified or aggregated data where possible;
  • comply with Applicable Laws and respond to any lawful request.

5. Legal basis and consent

By creating an account and using the Platform, the User consents to the collection, use and disclosure of their Personal Information in accordance with the Policy. The User may withdraw consent at any time, subject to applicable legal or contractual restrictions and to the need to retain certain Personal Information to allow Gensy to provide the Service or comply with its obligations.

6. Disclosure of personal information to third parties

  • Service providers and subprocessors: cloud hosting, payment processing (Stripe), transactional email delivery, artificial intelligence features, error monitoring, security and fraud prevention. These third parties are contractually bound to preserve the confidentiality of Personal Information and to use it only for the purposes for which it was disclosed to them.
  • Third-party platforms authorized by the Client: services to which the Client connects its account (Google Workspace, Microsoft 365), governed by their own privacy policies.
  • Public authorities and law enforcement, where disclosure is required by Applicable Law, a court order or a valid legal request.
  • Professional advisors (lawyers, accountants, auditors), within their respective mandates.
  • Acquiring third parties, in the context of a business transaction involving all or part of Gensy’s business or assets (merger, acquisition, reorganization), subject to appropriate confidentiality undertakings.

Gensy undertakes to limit the Personal Information it discloses to third parties to what is reasonably necessary for them to perform their functions. Gensy maintains an up-to-date list of its main service providers and subprocessors, available on the Subprocessors page or on request to the Officer, and undertakes to update this list within a reasonable time when a provider with access to Personal Information is added or removed.

7. Communication outside Québec

Personal Information may be communicated outside Québec, in particular where Gensy’s hosting servers or service providers are located elsewhere in Canada or in the United States. In accordance with Law 25, before communicating Personal Information outside Québec, Gensy carries out a privacy impact assessment (PIA) that takes into account: the sensitivity of the Personal Information concerned; the purposes for which it is used; the contractual, technical and organizational protection measures that apply to it; and the legal framework applicable in the receiving jurisdiction. Where the PIA shows that the Personal Information would receive adequate protection, Gensy enters into a written agreement with the recipient providing confidentiality and protection undertakings that comply with Law 25.

8. Use of artificial intelligence and automated decisions

Gensy uses artificial intelligence systems for certain optional features, in particular to: (i) extract contact details from content provided by the User (smart import); (ii) suggest corrections to staff records (data cleaning); (iii) generate or modify signature templates; and (iv) process images. Content submitted to these features is transmitted to the AI providers identified on the Subprocessors page solely to perform the requested function; Gensy configures these services so that Personal Information is not used to train the models [TO CONFIRM: effective once Vertex AI is enabled].

The Service makes no decision based exclusively on automated processing that produces effects on the persons concerned. Should such a decision ever be introduced, in accordance with Law 25, Gensy would inform the persons concerned, who would then have the right to obtain the information provided for by Law 25 and to submit observations to a member of Gensy’s staff in a position to review the decision.

The User acknowledges that content generated or suggested by artificial intelligence tools may contain errors or biases. Verifying the content before any use remains the exclusive responsibility of the User.

9. Retention and destruction

Gensy retains Personal Information only for as long as necessary to fulfil the purposes for which it was collected, to perform the Service or to comply with its legal, accounting and tax obligations. Gensy has adopted a retention schedule, whose main periods — applied automatically by the Platform — are:

  • signature usage statistics: 13 months, automatic daily purge;
  • technical and audit logs, notifications: 90 days, automatic daily purge;
  • account data and Client staff data: until deleted by the Client or with the account;
  • support requests and AI assistance logs: 12 months;
  • billing data: statutory accounting and tax periods.

When a User deletes their account, the Personal Information of the workspaces they own is immediately and permanently destroyed (databases, files and photographs) and the subscription is cancelled. Infrastructure backup copies are purged according to our host’s cycle, within a maximum of 30 days. Upon expiry of the retention periods, Personal Information is destroyed, deleted or anonymized according to industry best practices.

10. Security and protection

Gensy implements and maintains reasonable physical, technical and organizational security measures to protect Personal Information against loss, theft and unauthorized access, disclosure, copying, use or modification, including:

  • encryption of data in transit (TLS/HSTS) and at rest, plus application-level encryption (AES-256-GCM) of integration tokens;
  • strict isolation of data between client organizations (row-level security policies);
  • cryptographic signing of measurement links and access tokens;
  • strict access management under the least-privilege principle;
  • logging of access and sensitive actions, with automatic purge;
  • request rate limiting and anti-bot protection;
  • periodic security reviews of the code and dependencies.

As no method of electronic transmission or storage is perfectly secure, Gensy cannot guarantee the absolute security of Personal Information. The User is responsible for preserving the confidentiality of their credentials and API keys and for notifying Gensy without delay of any unauthorized use.

11. Privacy settings by default

In accordance with Law 25, Gensy ensures that the Platform’s privacy settings provide, by default, the highest level of privacy, without any intervention required from the person concerned. This obligation does not apply to login cookies.

In particular: website audience measurement is disabled by default and only enabled with the User’s consent (changeable below); and signature usage statistics (subsection 3.6) are disabled by default for every new organization — a Client that enables them is informed of its obligation to inform the persons concerned, and may disable them at any time in its settings.

12. Confidentiality incidents

If Gensy has reason to believe that a confidentiality incident within the meaning of Law 25 has occurred (unauthorized access, use or disclosure, or loss of Personal Information), it will without delay take reasonable measures to reduce the risk of injury and prevent recurrence.

If the incident presents a risk of serious injury, Gensy will diligently notify the CAI and any person whose Personal Information is affected, subject to the exceptions provided by Law 25. The notice to the persons concerned contains at minimum: (i) a description of the Personal Information affected or, if unknown, the reason why it cannot be provided; (ii) a brief description of the circumstances; (iii) the date or period of the incident or an approximation; (iv) the measures Gensy has taken or intends to take to reduce the risk of injury; (v) the measures the person can take to reduce or mitigate that risk; and (vi) the contact information of the Officer.

Gensy keeps a register of confidentiality incidents in accordance with Law 25.

13. Rights of the person concerned

13.1. Right of access

The person concerned may ask Gensy to confirm whether it holds Personal Information about them and to access it.

13.2. Right of rectification

The person concerned may request the rectification of any inaccurate, incomplete or ambiguous Personal Information concerning them.

13.3. Right to portability

The person concerned may request that computerized Personal Information they provided to Gensy be communicated to them in a structured, commonly used technological format, or communicated to a third party they designate. The Platform offers a self-service export in the account settings for this purpose.

13.4. Right to withdraw consent

The person concerned may withdraw their consent to the collection, use or disclosure of their Personal Information, subject to applicable legal or contractual restrictions.

13.5. Right to de-indexing

The person concerned may ask Gensy to cease disseminating Personal Information or to de-index any hyperlink giving access to it where the conditions of Law 25 are met.

13.6. How to exercise these rights

Requests must be addressed in writing to the Officer designated in section 16. Gensy will respond within 30 days of receipt. Requests are processed only if made by a person establishing their identity and, where applicable, their authority. Transcription, reproduction or transmission may give rise to reasonable fees, of which the applicant will be notified in advance. Where a request concerns Personal Information processed on behalf of a Client (subsection 3.5), Gensy relays it to the Client concerned, which remains responsible for it, and provides assistance.

13.7. Right to complain

If the person concerned believes that Gensy has not met its obligations, they may file a complaint with the CAI (www.cai.gouv.qc.ca) or, as applicable, with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

14. Cookies and similar technologies

  • Essential cookies: required for the Platform to operate (authentication, security, active workspace). They cannot be disabled without making the Platform unusable.
  • Functional local storage: remembers preferences (language, theme) and the consent choice, without transmission to third parties.
  • Audience measurement: cookieless tools (Vercel Analytics, Speed Insights) enabled only after consent (see section 11).

Users can manage their preferences through their browser settings or the consent management tool in section 11.

15. Direct marketing and CASL

In accordance with CASL, Gensy sends commercial electronic messages (newsletters, promotional offers) to a User only to the extent that the User has consented, except where CASL provides for implied consent or an exemption. Any User may withdraw consent at any time using the unsubscribe mechanism provided in each communication or by contacting Gensy at the address in section 16. Withdrawal is processed as soon as possible and no later than within 10 business days.

16. Person in charge of the protection of personal information

Gensy has designated, in accordance with Law 25, a person in charge of the protection of personal information responsible for ensuring compliance with Applicable Law within the organization. For any question, concern, complaint or request to exercise rights:

Person in charge of the protection of personal information
Vincent Paradis
1640 rue Guillaume-Renaud, Québec City, Québec G2K 0H7
vincent@gensy.email

17. Children and minors

The Platform is intended for professional (B2B) use by adults (18 or older). Gensy does not knowingly collect Personal Information about minors. Anyone who believes that a minor’s Personal Information has been communicated to Gensy is invited to contact the Officer, who will take the necessary steps to delete it.

18. Changes to the policy

Gensy reserves the right to amend the Policy at any time. Amendments take effect upon publication on the Platform. In the event of substantial changes, Gensy will notify Users by email or by a notice posted on the Platform before they take effect. Continued use of the Service after the changes take effect constitutes acceptance of the amended Policy.

19. Governing law and language

The Policy is governed by the laws applicable in the Province of Québec and the federal laws of Canada applicable therein. In accordance with the Charter of the French language (CQLR, c. C-11), the Policy is drawn up and published in French. This English version is made available after the French version has been provided; in case of discrepancy, the French version (Politique de confidentialité) prevails.

Policy adopted on July 8, 2026.