DRAFT: needs legal review before launch. This page is a starting point, not legal advice. Items marked TODO must be filled in.

Privacy policy

Version 2026-10-28 · Last updated: October 28, 2026 · Version française

This policy explains how Quickster AI, Winnipeg, Manitoba, Canada ("Quickster AI", "we", "us") TODO: legal business name and mailing address collects, uses, discloses and protects personal information. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 fair information principles and, where they apply, provincial privacy laws, including Quebec's private-sector privacy law as amended by Law 25.

Quickster AI is an AI phone receptionist for businesses. This policy covers:

1. Our customers: the businesses that sign up for Quickster AI, their staff, and visitors to quicksterai.ca (Part A).
2. Callers: people who phone a business that uses Quickster AI (Part B).

Part A: Customers and website visitors

A1. What we collect

• Account and contact information: business name, owner or contact name, email, phone numbers (including owner, transfer, department and backup voicemail numbers), industry, plan, business address and time zone.
• Free-trial form: what you type in the form on quicksterai.ca (name, business, phone, email, industry, plan, notes and language), plus a record that you agreed to our Terms of Service, which version, and when, and whether you chose to get marketing emails or texts, and when.
• Terms acceptance in the dashboard: each time the owner (or someone using the account) accepts our Terms of Service, Privacy Policy and Acceptable Use Policy in the Quickster dashboard, including each time a new version must be accepted, we record the business account, the terms version, the date and time, the IP address, the browser (user agent) and the language used.
• Billing information: plan, invoices, payment history and usage totals. Card details are handled by our payment processor; we don't store full card numbers. TODO: name the payment processor
• Business Content: greetings, hours, services, prices, stock lists, FAQs and other setup information you give us.
• Connected accounts: if you connect Google Calendar (Pro and up), the access needed to read free/busy times and create, change or cancel appointments.
• Website and support: messages you send us, and basic technical information (such as IP address, browser and pages visited) that our hosting provider processes to deliver and protect the site. We don't use advertising trackers or analytics cookies on quicksterai.ca. TODO: update if analytics are added

A2. How we use it

To set up and provide the Service; reply to your trial request; bill you; send service and billing notices (including usage warnings and price-change notices); provide support; keep the Service secure; prevent fraud and abuse; keep a record of your agreement to our terms; comply with law; and improve the Service using combined or de-identified information.

We send marketing emails or texts only if you opt in, and you can unsubscribe at any time, as Canada's Anti-Spam Legislation (CASL) requires. We contact you about your trial request whether or not you opt in.

A3. How long we keep it

We keep account and billing records while your account is open, and afterwards as long as needed for tax, accounting and legal purposes (generally 7 years for invoices under Canadian tax rules). Records of your acceptance of our terms (terms version, date and time, IP address and browser) are kept as long as they may be needed as legal proof of the agreement, including after your account closes. They are not deleted with call records after 30 days. TODO: confirm retention periods Trial requests that don't become customers are deleted within 12 months. TODO: confirm

Part B: Callers

B1. Who is responsible for your information

When you call a business that uses Quickster AI, that business is responsible for your personal information. Quickster AI handles it on the business's behalf, as its service provider, to answer your call and pass your message on. For questions about how a business uses your information, or to make an access or correction request, please contact that business first. You can also contact us (section C6), and we'll help or pass your request on.

B2. What you're told on the call

At the start of every call, the AI receptionist tells you that you're speaking with an AI assistant and that the call is recorded so your message can be passed on. (See section B3 for what is actually kept: a written transcript, and an audio recording only if you leave a voicemail.) Callers who continue the call consent to this. If you don't want to be recorded, you can hang up and contact the business another way (for example, in person, by email or through its website). Businesses using Quickster AI are responsible for any further notice their industry or privacy rules require.

B3. What we collect on a call

• your phone number (caller ID) and, if you give them, your name and a call-back number;
• a written transcript of the call: calls handled by the AI receptionist are turned into text by speech recognition and are not audio-recorded;
• if you leave a voicemail, an audio recording of your message (up to 120 seconds) and its transcript;
• an AI-written summary of the call, the reason for calling, and details you choose to give (for example, the service you need, an appointment time, an address, an order name or number, or a product you asked about, including items that weren't in stock);
• call details such as date, time, length, outcome (message taken, booked, transferred, voicemail, spam, silent) and technical logs; and
• if you book an appointment, the booking details placed in the business's Google Calendar, and any texts sent to you about it.

Please don't share payment card numbers, banking details, Social Insurance Numbers, health card numbers, passwords or detailed health information on a call.

B4. How it's used

• to answer your questions using information the business provided;
• to take your message and send a summary to the business (by text and, if the business turns it on, by email);
• to book, change or cancel appointments, or to transfer your call;
• to send you texts you asked for or that relate to your call (such as booking confirmations and reminders);
• to detect and decline spam and robocalls;
• to give the business call logs, reports and dashboards; and
• to keep the Service secure, fix problems, count calls for billing (as totals only) and comply with law.

We don't sell callers' personal information, and we don't use it for our own marketing. We don't use it to train general-purpose AI models. TODO: confirm against each AI provider's API data terms

B5. Automated processing

The receptionist is an automated AI system. It decides how to respond, whether a call looks like spam, and whether to take a message, book or transfer you, based on your words and the business's settings. If a call is wrongly treated as spam or misunderstood, contact the business directly. Quebec residents may ask to be told about the personal information used and the main factors behind an automated decision, and to have it reviewed by a person.

B6. Text messages

Texts sent to you name the business they're from. Reply STOP to stop receiving texts from that number (French: Répondez STOP pour vous désabonner). After you reply STOP, our telephone provider blocks further texts to your number from that line. We don't send promotional texts to callers. Message and data rates from your carrier may apply.

B7. Silence and problems

If you say nothing for a set time (10 seconds by default; the business's setting may differ), the receptionist says goodbye and ends the call. Calls end after a maximum length (15 minutes by default; this can also be changed). Voicemail messages can be up to 120 seconds long. If the AI has a problem, we try to send your call to voicemail so you can still leave a message.

B8. How long we keep it

Call records in the Quickster AI app (your number, name, the reason for your call, summaries, transcripts, messages and related entries) are automatically deleted about 30 days after the call. Working copies used during the call are deleted within about 1 day. For billing, we keep only daily totals (number of calls and billing units), with no phone numbers, names or call content, for about 13 months.

Some copies are not covered by that automatic deletion:

• Voicemail recordings and call records held by our telephone provider (Twilio) are kept and deleted on Twilio's schedule, not ours. TODO: before launch, set Twilio recording and log retention to delete after 30 days, then update this line
• Texts and emails already delivered to the business, and any exports (such as CSV files) the business downloads, are under the business's control.
• Appointments created in the business's calendar stay there, under the business's control.
• Limited technical logs and backups kept by our service providers for their own security and operations, under their own retention periods.

Part C: For everyone

C1. Service providers

We use service providers to run Quickster AI. They may use personal information only to provide services to us (or as their own terms and the law require):

We may also disclose personal information: to the business you called (Part B); if the law, a court order or a lawful government request requires it; to protect the rights, safety or property of anyone; or to a buyer or successor if our business is sold or reorganized, subject to this policy.

C2. Storage outside Canada

Some of our service providers are in the United States, and personal information may be stored and processed in Canada, the United States and other countries. There, it's subject to local laws and may be accessed by courts, law enforcement and national security authorities. We use contracts and other measures to require providers to protect information and use it only to provide their services to us. TODO: lawyer to confirm Quebec Law 25 assessment for transfers outside Quebec

C3. How we protect information

We use safeguards suited to the sensitivity of the information, including encrypted connections, checking that calls really come from our telephone provider, password-protected call logs and dashboards for each business, limiting access to what's needed, keeping secret keys in secured storage rather than in code, and automatic deletion after 30 days. No system is completely secure.

C4. Breaches

If a breach of security safeguards creates a real risk of significant harm, we (or the business, as the organization responsible for caller information) will notify affected people and the Office of the Privacy Commissioner of Canada and, where required, the Commission d'accès à l'information du Québec or other regulators, as the law requires. We'll tell affected businesses without undue delay and keep records of breaches.

C5. Your rights

Subject to legal limits, you can ask to see the personal information we hold about you, correct it, withdraw consent (which may mean we can't provide some services), or ask us to delete it. Quebec residents also have rights to data portability and to information about automated decisions. Because call records are deleted after about 30 days, we may no longer have them. We'll respond within 30 days, and we may need to confirm your identity. If a request is about a business's caller records, we may refer it to that business.

C6. Contact and complaints

Privacy officer: TODO: name / title, Quickster AI, Winnipeg, Manitoba · privacy@quicksterai.ca TODO: confirm address

If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information du Québec.

C7. Health information

Clinics and other health businesses should set up their questions so callers aren't asked for health details over the phone. Health businesses may have extra duties under provincial health privacy laws (in Manitoba, The Personal Health Information Act). TODO: legal review for clinic customers

C8. Children

Quickster AI is a business service and isn't directed to children. We don't knowingly collect children's information, other than what a caller chooses to say on a call to a business.

C9. Changes

We may update this policy. We'll post the new version here with a new date and, for material changes, tell customers by email at least 30 days ahead.