App privacy policy

How Gensy collects, uses, retains and destroys personal information — and what you are entitled to request. This English version is provided for convenience; if it differs from the French version, the French version prevails.

Introduction

AGENCE HÉLIUM INC. (also known as “Helium Agency Inc.”, hereinafter “Gensy”, “we”, “us” or “our”) — NEQ 1177643112, business number (Canada) 722984804, with its head office in Québec (Québec) G2K 0H7 — operates the platform available at app.gensy.email (the “Platform”), which enables its customers to create, manage and deploy email signatures and banner campaigns for their staff members (the “Service”).

Gensy attaches fundamental importance to the protection of privacy and the confidentiality of personal information. The purpose of this privacy policy (the “Policy”) is to inform the person concerned of: (i) Gensy’s governance rules and practices with respect to the protection of personal information; (ii) how personal information is collected, used, retained, disclosed and destroyed; (iii) their rights with respect to their personal information; and (iv) how to contact the Privacy Officer.

The Policy is intended to ensure compliance with applicable laws, including the Act respecting the protection of personal information in the private sector (“Law 25”), the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Canada’s Anti-Spam Legislation (“CASL”).

Gensy reserves the right to update the Policy periodically, including in response to legislative changes or recommendations issued by the Commission d’accès à l’information du Québec (the “CAI”). If changes are made to the Policy, Gensy will publish the amended Policy on the Platform and, where the changes are material, will notify Users by email or by a notice posted on the Platform.

1. Definitions

For the purposes of the Policy, the following terms have the meanings set out below:

• “Customer” means any legal person, or its representative, that has subscribed to the Platform.
• “Applicable Law” means, collectively, Law 25, PIPEDA, CASL and any other law applicable to the protection of personal information and to electronic communications.
• “Personal Information” has the meaning given to it in section 2.
• “Privacy Officer” means the person in charge of the protection of personal information designated by Gensy in accordance with Law 25.
• “User” means any person who accesses or uses the Platform, including representatives designated by a Customer.
• “Person Concerned by Processing on Behalf of the Customer” means any natural person whose Personal Information is processed by Gensy through the Service on behalf of a Customer — in particular, members of the Customer’s staff whose signatures are generated and deployed.

2. What is personal information?

Personal information means any information that concerns a natural person and that, directly or indirectly, allows that person to be identified (alone or in combination with other data) (“Personal Information”). Personal Information includes, among other things, a person’s name, email address, telephone number, job title, employer, photograph, IP address, technical identifiers and any information relating to the professional activities of an identifiable natural person.

The Policy covers both the Personal Information of Platform Users and that of any other person whose Personal Information may be processed by Gensy.

3. Personal information we collect

3.1. Information about Users

When a User signs up for or uses the Platform, Gensy may collect the following Personal Information:

• last name, first name and business contact information (email);
• login credentials (the password is stored in hashed form, never in plain text);
• billing information (full credit card details are not retained by Gensy — see subsection 3.3);
• content submitted to Gensy (support requests, questions put to the assistant, comments);
• account preferences and settings (language, theme, active workspace).

3.2. Information relating to a connected third-party account

To enable automatic signature deployment, the Customer may authorize Gensy to access certain information in its Google Workspace or Microsoft 365 environment, including: the directory of its staff members (name, email, job title) and, for Google Workspace, the Gmail signature settings, which Gensy’s service account accesses through the domain-wide delegation granted by a super administrator (the owner’s sign-in only verifies their identity, and no token from it is kept). With Microsoft 365, the Outlook add-in inserts the signature while composing, with no access to mailbox settings, and the directory is imported with an administrator’s consent. Stored integration tokens are encrypted (AES-256-GCM) and used solely to provide the Service. The Customer acknowledges that it is solely responsible for ensuring that this authorization complies with the terms of use of the third-party services concerned.

3.3. Payment information

Payments are processed by our payment service provider, Stripe, Inc. (“Stripe”), whose operations and processing servers are located in Canada and the United States. Gensy does not store full credit card numbers. Stripe may send us certain information (card type, last four digits, expiry date, transaction success or failure) for billing and fraud-prevention purposes. Stripe’s processing of data is governed by its privacy policy, available at stripe.com/privacy.

3.4. Information collected automatically

When a User browses the Platform, certain technical information is processed: essential authentication cookies (see section 14) and short-lived infrastructure logs (IP address, browser type) kept by our hosting provider for security and abuse-prevention purposes. Audience measurement tools (Vercel Analytics, Speed Insights — cookieless) are enabled only with the User’s prior consent (see section 11).

3.5. Information processed on behalf of the Customer

The Customer imports into the Platform the Personal Information of its staff members that is needed to generate their signatures: name, email, telephone, job title, department and, where applicable, photograph. This information may come from a file provided by the Customer, manual entry, the self-service portal offered to the persons concerned, or the directory synchronization authorized under subsection 3.2. With respect to this information, the Customer remains the party responsible for the processing and Gensy acts as a service provider: the Customer warrants that it is authorized to entrust this information to Gensy and that it has informed the persons concerned.

3.6. Signature usage statistics

When the Customer enables this feature (disabled by default — see section 11), signatures may contain a tracking pixel and redirect links used to count opens and clicks. This mechanism is deliberately minimized: no cookie is placed on recipients’ devices, no IP address is kept in the statistics (it is only used in memory, long enough to set aside duplicates and abuse) and nothing about the recipient is recorded — a view or click only records the employee concerned, the device type, the browser, the link and the time, for the benefit of the sending Customer.

4. Purposes of collection and use

Gensy collects, uses and retains Users’ Personal Information for the following purposes (Personal Information processed on behalf of a Customer, described in subsection 3.5, is used only to provide the Service to that Customer, according to its instructions and the Data Processing Agreement):

• to create and administer the User’s account;
• to provide, operate, improve and personalize the Service (generating and deploying signatures and campaigns);
• to process payments and manage billing and collections;
• to communicate with the User (technical notices, support, service notifications);
• to send, subject to applicable consent, commercial electronic messages in accordance with CASL;
• to prevent fraud, abuse and uses contrary to the terms of use;
• to ensure the security of the Platform and the protection of Personal Information;
• to carry out statistical and performance analyses, using de-identified or aggregated data where possible;
• to comply with Applicable Law and respond to any lawful request.

5. Legal basis for processing and consent

By creating an account and using the Platform, the User consents to the collection, use and disclosure of their Personal Information in accordance with the Policy. The User may withdraw their consent at any time, subject to applicable legal or contractual restrictions and to the need to retain certain Personal Information so that Gensy can provide the Service or comply with its obligations.

6. Disclosure of personal information to third parties

Gensy may disclose Personal Information to the following third parties, to the extent reasonably necessary:

• Service providers and subprocessors: cloud hosting, payment processing (Stripe), transactional email delivery, artificial intelligence features, error monitoring, security and fraud prevention. These third parties are contractually required to keep Personal Information confidential and to use it solely for the purposes for which it was disclosed to them.
• Third-party platforms authorized by the Customer: services to which the Customer connects its account (Google Workspace, Microsoft 365). Personal Information transmitted to these platforms is governed by their own privacy policies.
• Public authorities and law enforcement agencies, where disclosure is required by Applicable Law, a court order or a valid legal request.
• Professional advisers (lawyers, accountants, auditors), within the scope of their respective mandates.
• Third-party acquirers, in connection with a business transaction involving all or part of Gensy’s business or assets (merger, acquisition, reorganization), subject to appropriate confidentiality undertakings.

Gensy undertakes to limit the Personal Information it discloses to third parties to only the information reasonably necessary to enable them to perform their functions.

Gensy maintains an up-to-date list of its main service providers and subprocessors, available on the Subprocessors page or upon request to the Privacy Officer. Gensy undertakes to update this list within a reasonable time whenever a service provider with access to Personal Information is added or removed.

7. Disclosure outside Quebec

Personal Information processed by the Service is hosted in the United States: the database, authentication and files are with Supabase, in the AWS us-east-1 region (Northern Virginia), and the application is served by Vercel. Other providers listed on the Subprocessors page are also based in the United States. Personal Information is therefore disclosed outside Quebec and may be accessible to the courts and authorities of the countries where it is processed, under the laws of those countries.

In accordance with Law 25, before disclosing Personal Information outside Quebec, Gensy conducts a privacy impact assessment (PIA) that takes into account the following: the sensitivity of the Personal Information concerned; the purposes for which it will be used; the contractual, technical and organizational protection measures that will apply to it; and the legal framework applicable in the receiving jurisdiction, including the personal information protection principles that apply there.

Where the PIA shows that the Personal Information will receive adequate protection, Gensy enters into a written agreement with the recipient setting out confidentiality and protection commitments that meet the requirements of Law 25.

8. Use of artificial intelligence and automated decisions

Gensy uses artificial intelligence systems for certain optional features, including to: (i) extract contact details from content provided by the User (Paste a text); (ii) suggest corrections to staff profiles (data cleanup); (iii) generate or modify signature templates; and (iv) process images. Content submitted to these features is transmitted to the AI providers listed on the Subprocessors page solely to perform the requested feature.

The Service does not make any decision based exclusively on automated processing that produces effects with respect to the persons concerned. Should such a decision be introduced, Gensy would, in accordance with Law 25, inform the persons concerned, who would then have the right to obtain the information provided for by Law 25 and to submit observations to a member of Gensy’s staff who is in a position to review the decision.

The User acknowledges that content generated or suggested by artificial intelligence tools may contain errors or biases. Verifying such content before any use remains the sole responsibility of the User.

9. Retention and destruction

Gensy retains Personal Information only for as long as necessary to fulfill the purposes for which it was collected, to provide the Service or to comply with its legal, accounting and tax obligations. Gensy has adopted a retention schedule, the main retention periods of which — applied automatically by the Platform — are:

• signature usage statistics: detail 90 days, daily aggregate 13 months, monthly archives of the detail 12 months, automatic daily purge;
• technical and audit logs (activity log, AI action history, schedules, Outlook add-in log, scheduled-task records) and notifications: 90 days, automatic daily purge; invitations: 14 days; support access: 72 hours; revoked or expired API keys: erased after 90 days; photos of a deleted record: removed the following night (a replaced photo, one day later);
• account data and Customer staff data: until deleted by the Customer or until the account is deleted;
• support requests: 12 months after the last activity; AI assistant conversations: 12 months;
• billing data: statutory accounting and tax retention periods.

When a User deletes their account (My account > Security > Delete my account), the Personal Information in the workspaces they own is immediately and permanently destroyed (databases, files and photographs), and subscriptions are cancelled immediately, with no pro-rata refund. The same applies when an owner deletes a workspace. Signatures already installed in mailboxes are not removed: the Customer must first unpublish the Gmail ones. Infrastructure backups are purged according to our hosting provider’s cycle, within a maximum of 30 days. When the retention periods expire, Personal Information is destroyed permanently and irreversibly.

10. Security and protection

Gensy implements and maintains reasonable physical, technical and organizational security measures to protect Personal Information against loss, theft and unauthorized access, disclosure, copying, use or modification. These measures include:

• encryption of data in transit (TLS/HSTS) and at rest, as well as application-level encryption (AES-256-GCM) of integration tokens;
• strict segregation of data between customer organizations (row-level security policies);
• cryptographic signing of tracking links and access tokens;
• strict access management based on the principle of least privilege: the support team only enters a workspace’s content with the access the owner grants it, for 72 hours (visible in Settings > Team, logged, and expiring by itself), and the operations team only accesses data when needed to operate and secure the Service (diagnosing an outage, handling a security issue); app-based two-factor authentication is available to Users;
• logging of access and sensitive actions, with automatic purging;
• request rate limiting and bot protection;
• periodic security reviews of code and dependencies.

Because no method of electronic transmission or storage is completely secure, Gensy cannot guarantee the absolute security of Personal Information. The User is responsible for keeping their login credentials and API keys confidential and for notifying Gensy without delay of any unauthorized use.

11. Default privacy settings

In accordance with Law 25, Gensy ensures that the Platform’s privacy settings provide the highest level of confidentiality by default, without any intervention required from the person concerned. This obligation does not apply to cookies.

In particular: the app’s audience measurement (Vercel Analytics and Speed Insights) is disabled by default and is enabled only if the User accepts it in the consent banner; this choice follows their account, lasts 13 months and can be changed at any time in My account > Security; and signature usage statistics (subsection 3.6) are disabled by default for each new organization — a Customer that enables them (Settings > General, owner or admin) must inform the persons concerned, and may disable them at any time in its settings.

12. Confidentiality incidents

If Gensy has reason to believe that a confidentiality incident within the meaning of Law 25 has occurred (unauthorized access, use or disclosure, or loss of Personal Information), it takes reasonable measures without delay to reduce the risk of injury and to prevent a similar incident from occurring again.

If the incident presents a risk of serious injury, Gensy promptly notifies the CAI and, where applicable, the Office of the Privacy Commissioner of Canada, as well as any person whose Personal Information is concerned by the incident, subject to the exceptions provided for by Law 25. The notice to the persons concerned contains at least: (i) a description of the Personal Information covered by the incident or, if that information is not known, the reason why it cannot be provided; (ii) a brief description of the circumstances of the incident; (iii) the date or period when the incident occurred or, if it is not known, the approximate period; (iv) a description of the measures Gensy has taken or intends to take to reduce the risk of injury; (v) the measures the person concerned can take to reduce the risk of injury or to mitigate such injury; and (vi) the contact information of the Privacy Officer from whom the person concerned can obtain more information.

Gensy keeps a register of confidentiality incidents in accordance with the requirements of Law 25.

13. Rights of the person concerned

Subject to the conditions set out in Applicable Law, the person concerned has the following rights with respect to their Personal Information:

13.1. Right of access

The person concerned may ask Gensy to confirm whether it holds Personal Information about them and to access that information.

13.2. Right to rectification

The person concerned may request the rectification of any inaccurate, incomplete or equivocal Personal Information about them.

13.3. Right to portability

The person concerned may request that the computerized Personal Information they have provided to Gensy be communicated to them in a structured, commonly used technological format, or that it be communicated to a third party they designate. For this purpose, the Platform offers the owner of each workspace a self-service export (My account > Security > “Export (JSON)”): the active workspace’s data, without images, of which only the addresses are included. Other persons concerned send their request to the Privacy Officer.

13.4. Right to withdraw consent

The person concerned may withdraw their consent to the collection, use or disclosure of their Personal Information, subject to applicable legal or contractual restrictions.

13.5. Right to de-indexing

The person concerned may ask Gensy to cease disseminating Personal Information or to de-index any hyperlink providing access to it where the conditions set out in Law 25 are met.

13.6. How to exercise these rights

Requests to exercise these rights must be sent in writing to the Privacy Officer designated in section 16. Gensy will respond to any request within 30 days of receiving it. A request will be processed only if it is made by a person who proves their identity and, where applicable, their authority. Transcription, reproduction or transmission may give rise to reasonable fees, of which the requester will be notified in advance. Where the request concerns Personal Information processed on behalf of a Customer (subsection 3.5), Gensy forwards it to the Customer concerned, which remains responsible for it, and assists that Customer.

13.7. Right to file a complaint

To make a complaint about how Gensy handles Personal Information, the person concerned writes to the Privacy Officer named in section 16. Gensy acknowledges receipt within 5 business days, reviews the complaint and responds in writing within 30 days. If the person concerned believes that Gensy has not met its obligations, they may also file a complaint with the CAI (www.cai.gouv.qc.ca) or, where applicable, with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

14. Cookies and similar technologies

The Platform uses cookies and similar technologies (session identifiers, local storage) to function properly, remember the User’s preferences and, with the User’s consent, analyze usage. The main types used are:

• Essential cookies: necessary for the Platform to function (authentication, security, active workspace). These cookies cannot be disabled without making the Platform unusable.
• Functional local storage: remembers display preferences, without transmission to third parties; the language and the audience-measurement consent choice are also saved with the User’s account.
• Audience measurement: cookieless tools (Vercel Analytics, Speed Insights) enabled only after consent (see section 11).
• Error monitoring: the Platform uses Sentry to detect and fix technical errors (legitimate interest). Events are minimized — no IP address, no cookies or headers, no User identity — and, only when an error occurs, a replay of the faulty session may be captured for diagnostic purposes, with all entered text and media fully masked.

The User can manage their preferences through their browser settings and change their audience-measurement choice at any time in My account > Security.

15. Direct marketing and CASL

In accordance with CASL, Gensy sends commercial electronic messages (newsletters, promotional offers) to a User only to the extent that the User has consented to them, except where CASL provides for implied consent or an exemption. Any User may withdraw their consent at any time by using the unsubscribe mechanism provided in each message or by contacting Gensy at the address indicated in section 16. Withdrawal of consent will be processed as soon as possible and no later than 10 business days.

16. Governance and Privacy Officer

In accordance with section 3.2 of Law 25, Gensy has established policies and practices governing personal information, which provide in particular for: the roles and responsibilities of staff members throughout the information life cycle (collection, use, disclosure, retention and destruction — see sections 3, 4, 6, 7 and 9); a retention schedule applied automatically by the Platform (section 9); a process for handling requests to exercise rights and complaints (sections 13 and 16); a procedure for managing confidentiality incidents, including keeping a register (section 12); and a periodic review of these policies. This summary is published pursuant to that obligation.

In accordance with Law 25, Gensy has also designated a Privacy Officer responsible for ensuring compliance with and implementation of Applicable Law within the organization.

17. Children and minors

The Platform is intended for professional (B2B) use by adults (18 years of age or older). Gensy does not knowingly collect Personal Information about minors. Anyone who believes that a minor’s Personal Information has been provided to Gensy is invited to contact the Privacy Officer, who will take the necessary steps to delete that information.

18. Changes to the policy

Gensy reserves the right to amend the Policy at any time. Changes take effect upon publication on the Platform. In the event of material changes, Gensy will notify Users by email or by a notice posted on the Platform before the changes take effect. Continued use of the Service after the changes take effect constitutes acceptance of the amended Policy.

19. Governing law and language

The Policy is governed by the laws applicable in the Province of Quebec and the federal laws of Canada applicable therein.

In accordance with the Charter of the French Language (CQLR, c. C-11), the Policy is drafted and published in French. A version in another language may be made available to the User after the French version has been provided to them and at their express request. In the event of any discrepancy between the French version and any version in another language, the French version prevails.

Policy effective September 21, 2026, updated October 9, 2026.