Canadian Privacy Notice

1. Who this notice applies to and how it relates to our Privacy Policy

This Canadian Privacy Notice supplements and forms part of our Privacy Policy. It applies to residents of Canada and provides the additional disclosures and rights required by:

• the federal Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) ("PIPEDA");
• Quebec's Act respecting the protection of personal information in the private sector (CQLR c P-39.1, as amended by Law 25) ("Law 25");
• the Personal Information Protection Act (Alberta) (S.A. 2003, c. P-6.5) ("AB PIPA");
• the Personal Information Protection Act (British Columbia) (S.B.C. 2003, c. 63) ("BC PIPA"); and
• Canada's Anti-Spam Legislation (S.C. 2010, c. 23) ("CASL") for commercial electronic messages.

The Service is provided by ZeroEnd Technology AB (Sweden), doing business as QuantCAD. We are the organization responsible for personal information about Canadian users in our custody and under our control (PIPEDA Principle 4.1.3); for Quebec residents we are the enterprise responsible under Law 25.

If you are a resident of Canada, the rights described in Section 4 apply to you. The general rights described in Privacy Policy §12 also apply to you.

2. Privacy Officer designation (PIPEDA Principle 4.1; Quebec Law 25 art. 3.1)

In accordance with PIPEDA Principle 4.1 (Accountability) and section 3.1 of Quebec Law 25, we have designated a Privacy Officer who is responsible for our compliance with Canadian privacy law and who handles inquiries, requests, and complaints from individuals.

• Privacy Officer: Privacy Officer, ZeroEnd Technology AB. Contact via Support Ticket → Privacy & Compliance (preferred).
• Mail: ZeroEnd Technology AB, Privacy Officer, Järpvägen 41B, 75653 Uppsala, Sweden.

The Privacy Officer's title and contact information are also published on our Legal Notices page (Quebec Law 25 art. 3.1: "the title and contact information of the person in charge of the protection of personal information must be published on the enterprise's website").

3. The PIPEDA Fair Information Principles — how we apply them

PIPEDA is built on ten Fair Information Principles in Schedule 1. Below we map our practices to each.

Principle	How we comply
4.1 — Accountability	Privacy Officer designated (Section 2). We use written agreements with subprocessors that bind them to comparable protection (PIPEDA Principle 4.1.3).
4.2 — Identifying purposes	We identify the purposes for which personal information is collected at or before the time of collection — see Privacy Policy §5.
4.3 — Consent	We obtain consent appropriate to the sensitivity of the information and the reasonable expectations of the individual. Express consent is used for marketing newsletters, analytics cookies/local-storage analytics on the marketing site, and secondary uses where express consent is required. Vercel Web Analytics is described by Vercel as cookieless and aggregated/anonymized; we use it where permitted and will gate it behind consent if our configuration or applicable law requires that. For Quebec residents, consent must be clear, free, informed, specific, requested separately from unrelated information where required, and capable of withdrawal. Implied consent is used only where the purpose is obvious and reasonably necessary to provide the Service you requested. Free-tier public showcasing is disclosed in the Terms and Privacy Policy and, where applicable law requires it, handled through a separate consent or opt-in disclosure. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice (Principle 4.3.8).
4.4 — Limiting collection	We collect only what is necessary for the identified purposes.
4.5 — Limiting use, disclosure, retention	We use personal information only for the identified purposes (and any others consistent with them or for which we have obtained consent). Retention follows Privacy Policy §11.
4.6 — Accuracy	We take reasonable steps to keep personal information accurate, complete, and up to date. You may correct inaccurate information — see Section 4(b).
4.7 — Safeguards	Administrative, technical, and physical safeguards described in Privacy Policy §15.
4.8 — Openness	This notice and the Privacy Policy describe our practices. The Privacy Officer is the point of contact for questions.
4.9 — Individual access	You may request access to your personal information — see Section 4(a).
4.10 — Challenging compliance	You may challenge our compliance with the Privacy Officer; if you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (Section 8).

4. Your rights under Canadian law

The rights described below derive from PIPEDA, Law 25, AB PIPA, and BC PIPA. Where a statute imposes a stronger or more specific right, we apply it; where multiple statutes apply, we apply the rule most favorable to you.

(a) Right of access (PIPEDA Principle 4.9; Law 25 art. 27; AB PIPA s. 24; BC PIPA s. 23). You may request access to your personal information, the categories of third parties to whom it has been disclosed, and an account of the use and disclosure of your information. We will respond within the timeframe required by the law that applies to your request (for example, generally 30 days under PIPEDA and Quebec Law 25, 45 days under Alberta PIPA, and 30 business days under British Columbia PIPA, subject to permitted extensions).

(b) Right to correction (PIPEDA Principle 4.9.5; Law 25 art. 28; AB PIPA s. 25; BC PIPA s. 24). You may request correction of inaccurate, incomplete, or out-of-date personal information. If we agree, we will correct it and, where appropriate, notify any third party to whom it has been disclosed. If we do not agree, we will note your disagreement.

(c) Right to withdraw consent (PIPEDA Principle 4.3.8). You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal may affect our ability to provide the Service to you (for example, withdrawing consent to billing processing means we cannot maintain a paid subscription).

(d) Right to data portability (Law 25 art. 27, in force since September 22, 2024; PIPEDA does not yet provide this right at the federal level). You may request a copy of your computerized personal information in a structured, commonly used technological format, and ask that we transmit it to another person or organization, where technically feasible.

(e) Right to cessation of dissemination, de-indexing, and re-indexing (Law 25 art. 28.1). You may request that we cease the dissemination of your personal information, or that we de-index any hyperlink that allows access to that information, in the conditions set out in Law 25 (typically where dissemination contravenes the law or causes serious injury to your reputation or privacy).

(f) Right to information and to object regarding automated decision-making (Law 25 art. 12.1). Where we make a decision based exclusively on automated processing of your personal information that produces legal or similarly significant effects, you have the right to be informed of: (i) the personal information used to make the decision, (ii) the reasons and the principal factors and parameters that led to the decision, and (iii) your right to have the personal information used to make the decision corrected. You may also submit observations for consideration by a person in a position to review the decision. See Privacy Policy §8.5 — material decisions affecting your account are subject to human review before they take effect.

(g) Right to know subprocessors and their locations (Law 25 art. 8). You have the right to know whether your personal information will be communicated outside Quebec, the categories of recipients, and the reasons. We disclose this in Section 5 below and in Annex 3 of our Data Processing Agreement.

(h) Right to file a complaint (PIPEDA Principle 4.10; Law 25 art. 56). See Section 8.

4.1 How to exercise your rights

Submit your request via Support Ticket → Privacy & Compliance, with subject line indicating the right (e.g., "PIPEDA Access Request", "Law 25 Portability Request", "Right to De-indexing"). You may also write to us by mail at the address in Section 2.

Identity verification. To protect your information, we may verify your identity (or your authorized representative's authority) before fulfilling certain requests, in line with PIPEDA's reasonable-effort standard and Law 25's verification requirements.

Response time. 30 days under PIPEDA and Law 25 (extendable in limited circumstances with notice), 45 days under AB PIPA, and 30 business days under BC PIPA, or another timeframe if required by the law that applies to your request.

Fees. No fee for reasonable requests. We may charge a minimal cost-recovery fee for high-volume copying or for requests requiring conversion of records, after notifying you in advance.

Right to non-discrimination. We will not deny you the Service, charge a different price, or provide a different level of service because you exercised a privacy right.

5. Cross-border data transfers (PIPEDA Principle 4.1; Quebec Law 25 art. 17)

5.1 Where your personal information goes

If you are a Canadian user, your personal information may be transferred to and processed in:

• the European Union (our primary data stores: managed PostgreSQL in the EU; private object storage in EU — Frankfurt; rate-limit / Redis in the EU; PostHog Cloud — EU; error monitoring where configured);
• the United States and global edge locations (certain service providers — currently Vercel for application hosting/CDN/edge routing and Vercel Web Analytics, Clerk for authentication, Inngest for workflow orchestration, E2B for sandbox compute, Stripe for payment processing, Resend/Loops email providers, OpenAI and Anthropic for AI processing, and Sentry where configured outside the EU).

Subprocessor categories and selected named providers are published in Annex 3 of our Data Processing Agreement; a full named vendor list is available to enterprise prospects/customers during due diligence and to Canadian individuals where required by applicable law.

5.2 Safeguards

Personal information transferred outside Canada is processed by entities that operate under their own jurisdiction's laws. The legal regime of the recipient country (EU GDPR for EU recipients; US federal and state law for US recipients) may differ from Canadian law and may permit access by foreign courts, law-enforcement agencies, national-security authorities, or regulators in ways that Canadian law would not. We mitigate these risks with:

• Contractual safeguards with each subprocessor binding them to a level of protection comparable to that under PIPEDA and Law 25, including security obligations, confidentiality, breach notification, processing limited to documented instructions, and limits on secondary use;
• Technical safeguards including encryption in transit (TLS) and at rest where supported, least-privilege access controls, and security monitoring;
• For Quebec residents, a privacy-impact assessment (Law 25 art. 17) that takes into account the sensitivity of the information, the purpose of the transfer, the safeguards in place, and the legal regime applicable in the recipient state. A summary is available on request via the Privacy Officer (Section 2).

5.3 Your acknowledgment

By submitting information through the public site, joining the waitlist, contacting us, consenting to cookies, subscribing to marketing, or (if/when Canadian sign-up later opens) creating an account or using the authenticated Service, you acknowledge that we will transfer your personal information outside Canada as described above where those transfers are necessary for the relevant interaction. If you do not want your personal information transferred outside Canada for necessary operations, please do not submit it. For optional processing that is not necessary to provide the relevant interaction (for example marketing newsletters or analytics cookies), we obtain the consent required by Canadian law and provide a way to withdraw it. We provide this disclosure in compliance with PIPEDA Principle 4.8 (Openness) and OPC guidance on transborder dataflows, and for Quebec residents in compliance with Law 25 art. 17.

6. Quebec — Law 25 specifics

In addition to the general PIPEDA-style disclosures above, the following disclosures are required for Quebec residents:

• Privacy Officer (art. 3.1): designated in Section 2.
• Governance policies and practices: we maintain internal governance rules for the collection, use, disclosure, retention, destruction, incident handling, access controls, roles and responsibilities, complaint handling, and privacy impact assessment of personal information. Public-facing summaries are provided in the Privacy Policy, Cookie Policy, this notice, and the Data Processing Agreement.
• Notice at collection: when collecting personal information by technological means, we must provide clear information about the purposes and means of collection, your rights of access and correction, your right to withdraw consent, the third parties or categories of third parties for whom collection is carried out or to whom disclosure is necessary, and the possibility that information may be communicated outside Quebec.
• Use of personal information for purposes of identifying, locating, or profiling (art. 8.1): if we use cookies or similar technologies that enable us to identify, locate, or profile a Quebec resident, we (a) inform you that the function exists and (b) give you the means to deactivate it. Our marketing-site analytics using cookies or local storage (Google Analytics, PostHog) require express consent through CookieYes; the functions are deactivated by default until you consent, and can be deactivated at any time via the Cookie Settings link in the footer. Vercel Web Analytics is described by Vercel as cookieless and aggregated/anonymized; if our configuration or applicable Quebec guidance requires consent, we will deactivate it by default until consent is given.
• Sensitive personal information (art. 12 para. 4): "sensitive personal information" must be processed only with your express consent. We do not collect sensitive personal information for any purpose beyond what is necessary to provide the Service; please do not submit sensitive personal information in your inputs.
• Privacy impact assessments (art. 3.3, art. 17): we conduct PIAs for any project that involves the acquisition, development, or substantial transformation of an information system or service involving personal information of Quebec residents, and for cross-border transfers (Section 5).
• Confidentiality incidents (art. 3.5): if a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec (CAI) and affected persons without delay, and keep a register of incidents (art. 3.8). We maintain the register for the period required by Quebec law and make it available to the CAI upon request. See Privacy Policy §15.
• Right to be forgotten / cessation of dissemination (art. 28.1): see Section 4(e).
• Right to information about automated decisions (art. 12.1): see Section 4(f) and Privacy Policy §8.5.
• Penalties. We are aware that violations of Law 25 may result in administrative monetary penalties of up to the greater of CAD 10,000,000 or 2% of worldwide turnover, and penal fines of up to CAD 25,000,000 or 4% of worldwide turnover (art. 90.12 and art. 91). Compliance is a board-level priority.

6.1 French-language rights (Charter of the French Language, "Bill 96")

In accordance with the Charter of the French Language (CQLR c C-11) as amended in 2022 (commonly "Bill 96"), Quebec users may have the right to receive consumer-facing contracts of adhesion and related documents in French before agreeing to be bound by an English version. A clause stating that the parties choose English is not, by itself, sufficient where the French-first requirement applies.

Until our French contracting flow is complete, Quebec users should request the French version of our key legal documents before accepting English-only terms by submitting a Support Ticket → Privacy & Compliance or Legal. New Canadian account creation and subscription purchases are currently waitlist-only; if/when they open, we may restrict, delay, or decline Quebec self-serve account creation, subscription purchases, or other transactions where we cannot provide the French version or obtain the language choice required by Quebec law. The application of Quebec language rules to non-Quebec businesses and online self-serve SaaS flows is fact-specific and should be verified by Quebec counsel before relying on an English-only flow.

7. CASL — Canada's Anti-Spam Legislation

Commercial electronic messages ("CEMs") to electronic addresses in Canada are sent only with the consent required by CASL (S.C. 2010, c. 23):

• Express consent (most users): you have ticked an opt-in box at signup, in account settings, or via a similar clear affirmative action. Express consent does not expire unless withdrawn, and we keep records sufficient to prove consent where required.
• Implied consent (limited circumstances under §10(9) CASL): for 24 months following a purchase from us; for 6 months following an inquiry, application, or similar request; or where you have conspicuously published a business email address without a notice that you do not wish to receive CEMs and the message is relevant to your role, functions, or business.

Every CEM contains the sender identification (QuantCAD / ZeroEnd Technology AB), our mailing address, and an unsubscribe mechanism that remains valid for at least 60 days after the message is sent and takes effect without delay and within 10 business days (§6 CASL). We will not send CEMs to a Canadian address where consent has been withdrawn.

Excluded CEMs (§6(6) CASL): transactional, account-administration, and similar messages required for the operation of the Service are not "CEMs" and you cannot unsubscribe from them while you have an account.

8. How to file a complaint

If you are not satisfied with our response to a privacy concern, you may file a complaint with the appropriate regulator:

• Federal — Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca.
• Quebec — Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca.
• Alberta — Office of the Information and Privacy Commissioner of Alberta (OIPC AB): oipc.ab.ca.
• British Columbia — Office of the Information and Privacy Commissioner for British Columbia (OIPC BC): oipc.bc.ca.
• CASL complaints — Canadian Radio-television and Telecommunications Commission (CRTC): crtc.gc.ca/eng/internet/anti.htm.

We encourage you to contact our Privacy Officer (Section 2) first so we can attempt to resolve the matter directly and within statutory timeframes.

9. Contact

• Privacy Officer: Support Ticket → Privacy & Compliance (preferred).
• Mail: ZeroEnd Technology AB, Privacy Officer, Järpvägen 41B, 75653 Uppsala, Sweden.

10. Changes to this notice

We may update this notice from time to time. Material changes will be announced on this page with a new "Last updated" date and version number, and (where required) communicated to affected users in advance. Past versions are retained internally and are available on request via Support Ticket → Privacy & Compliance.