Une question ? 438 544-5191 — notre réceptionniste IA vous répond et vous transfère à un technicien au besoin.

Suivez-nous
Zen SolutionsSolutions IA · Laval
FREN
438 544-5191 Prendre rendez-vous
EN | FR ← Zen Solutions

Privacy & Data Agreement

Last updated: October 3, 2026

Zen Solutions (“we”), operated by Zen Solutions, provides an all-in-one automation and online-presence platform for businesses (booking, payments, accounting, AI agents, etc.). This policy explains what data we process, why, and your rights. Questions: zen-ai.net/consultation.

Our core promise. Your business data and your company’s features are never accessed or used without your consent — including for support. When you ask us for help, or explicitly authorize it, a Zen Solutions team member may look at or act within your account solely to assist you with that request. Outside of that consent, we do not view, share, sell, or use your data or your customers’ data.

1. Who can have an account

  • Business owners create the original account for their company and are responsible for the subscription. This is the only account that can be created without an invitation.
  • Employees and team members are invite-only. A manager or the owner adds them under the Employees tab and enters their email; they then receive an invitation email to set a password and create their account. Employees cannot self-register.
  • Each person only sees and can do what their role in the company’s hierarchy has been granted, as controlled by the owner and the people they delegate to.
  • Zen Solutions operates and oversees all business accounts to keep the service running and secure, and may use administrative options inside an account to assist that business — with your consent, as described in our core promise above.

2. Data we process

Business owners (our clients)

  • Identity and contact details (name, email, phone, business name, address).
  • Business configuration data (services, prices, hours, staff, products, invoices, accounting).
  • Billing data (handled by our payment processor Stripe; we do not store card numbers).
  • Login credentials — passwords are stored only as salted hashes; two-factor secrets and connected-mailbox credentials are encrypted at rest.

The business’s end customers

  • Contact details and history provided during a booking, order or conversation (name, email, phone, language, appointments, purchases).
  • Transcripts of conversations with the AI assistant (chat, phone, SMS, email, Messenger), for customer-service purposes.

3. Optional connected services

These are connected by you, only if you want the feature, and can be disconnected at any time. Credentials are encrypted and never shown back to your browser.

  • Your mailbox (email feature) — you connect a mailbox (Gmail, Outlook, Yahoo, iCloud or any IMAP provider) with an app password you generate, with “Sign in with Microsoft” for Outlook, or — for a Google Workspace domain — with an authorization your administrator gives in Google Admin. We read and send email through standard IMAP/SMTP to power your inbox and, if you enable it, AI auto-replies and tidying. We do not use Google’s Gmail API for this.
  • Your calendar (optional) — Google Calendar: if you connect Google, we use calendar.events only to create, update and cancel the appointments booked through the platform; or you share your calendar with our booking address (or your Google Workspace administrator allows it), and your agent then offers only the times that are free in it and books into it. Outlook calendar: “Sign in with Microsoft” lets your agent read your busy times and create, move and cancel its bookings.
  • Stripe (payments), Twilio (SMS / phone agent), Facebook and Instagram (Messenger, ads, and lead forms: the people who fill in your lead form are added to your leads) — connected by you to enable those features.
  • HighLevel — only if you are moving from HighLevel: with the access you give us, we read your contacts and conversations there (read only) to bring them over.
Google “Limited Use” compliance. If you connect Google Calendar or a Google Workspace mailbox, Zen Solutions’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we only use Google data to provide the features you requested; we do not sell it; we do not use it for advertising; and no human reads it except with your consent, for security, to comply with the law, or in aggregated/anonymized form.

4. Providers (sub-processors)

Each provider receives only what its part of the service needs, and only for that purpose.

  • Railway — hosting of the application and the database (United States, see section 8).
  • Cloudflare (R2) — encrypted database backups, held in North America. Cloudflare stores the file; it cannot read it.
  • Anthropic (Claude) — AI processing of messages: chats, texts, emails and requests to the assistants. If you connect Claude (claude.ai) to your Zen account, the notes Claude searches, reads or writes in your assistants’ memory also go to Anthropic, under your own Claude account and its terms; you can disconnect it at any time in Zen.
  • xAI (Grok) — the voice agents on the phone and on your website (what callers say and hear), speech-to-text, and AI requests or images when a Grok model is chosen.
  • Twilio — phone numbers, calls and text messages (SMS).
  • Stripe — payments and subscriptions; card numbers go to Stripe, never to us.
  • Google — our own email (Google Workspace: the emails we send you, and those we send your customers for you while your own mailbox is not connected), your calendar or mailbox if you connect them (section 3), app notifications (Firebase), and Google Wallet if a customer adds a card to it.
  • Microsoft — your Outlook mailbox and calendar, only if you sign in with Microsoft (section 3).
  • Meta (Facebook, Instagram) — Messenger, ads and lead forms, only if you connect them (section 3); the advertising pixel on our own pages, only with consent (section 10).
  • Sentry — error reports, so we can fix problems; personal details are removed before a report leaves our servers.
  • Higgsfield — AI images and videos made in the AI Studio (your instructions and the photos you upload).
  • Replicate — photo touch-ups such as removing a background, on the photos you upload.
  • Apify — reading your public website to build your agent’s knowledge base.
  • Komoot (Photon) — address suggestions while an address is typed in a form; our server sends only the typed address, never your IP address.
  • OpenStreetMap — the map in the control panel (work-site boundary, clock-in locations): your browser loads the map images from OpenStreetMap, which sees your IP address and the area shown.

Anthropic and xAI do not use the data Zen sends them to train their models. Notes you send through your own Claude account follow that account’s privacy settings. These providers are outside Québec, most of them in the United States.

We never sell your data or your customers’ data, and we do not use it to serve third-party ads.

5. AI & automation

The AI assistant and automations act within the scope you configure and the permissions of the person using them. The AI manager and front-of-house bots are capped to each user’s access level and cannot act outside it.

6. Retention and security

We keep data while the account is active, then for the period required by law. Secrets (tokens, keys, app passwords) are encrypted at rest (AES-256-GCM) and never exposed to the browser. Data is isolated per business. You can request deletion of your account and data at any time.

Database backups are encrypted (AES-256-GCM) before they leave our servers and stored in a private bucket at Cloudflare (R2) in North America — Cloudflare holds the file but cannot read it, because the key never leaves our control. Backups are deleted automatically after 30 days by a rule on the bucket itself, not by anyone remembering to do it.

7. Your rights

Under Quebec’s Law 25 and applicable laws, you can access, correct or delete your data, or withdraw consent (including disconnecting Google or a mailbox at any time from your dashboard). Write to zen-ai.net/consultation.

8. Where your data is stored, and outside Quebec

Our application and database run on managed cloud infrastructure (Railway) located in the United States — not in Canada. We say so plainly because, under Law 25, communicating personal information outside Quebec carries specific obligations, and because you are entitled to know where your customers' information physically sits before you trust us with it.

What protects it there: encryption in transit (TLS) on every connection; credentials, tokens and mailbox passwords encrypted at rest; access scoped per user and enforced server-side; and our provider's own contractual data-protection terms. We have assessed this transfer against the factors Law 25 requires — the sensitivity of the information, the purpose of its use, the protective measures around it, and the legal regime of the destination. If you need your data to remain in Canada, tell us before you sign: it is a hosting decision we can discuss, not something to discover later.

9. Privacy Officer & confidentiality incidents

The person responsible for the protection of personal information at Zen Solutions is Mathieu Payment, owner. Reach the Privacy Officer at privacy@zen-solutions.net for any question, access request, correction, deletion, or complaint about how information is handled.

We keep a confidentiality incident register, in which every incident involving personal information is recorded — including those that do not present a risk of serious injury — and retained for at least five years. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned promptly, and take reasonable measures to reduce the risk and prevent recurrence. We remain responsible for these obligations even where the information is held by a provider on our behalf.

10. Cookies, the advertising pixel & changes

Essential cookies (session, language preference) are set on every visit and cannot be turned off — without them the site cannot keep you signed in or remember which language you read in.

On our own marketing pages we also offer the Meta advertising pixel, and it is off until you say yes. Nothing is requested from Meta and no advertising cookie is written unless you accept the notice shown on your first visit. Refusing loads nothing at all, and a Global Privacy Control signal from your browser is honoured as a refusal without us asking. When you do accept, the pixel discloses your IP address, your browser and the pages you view on this site to Meta Platforms, in the United States, so we can measure and target our own advertising. It is never placed on a client's own site or storefront.

You can change your answer at any time: review your advertising-measurement choice.

We may update this policy; the date at the top shows the last revision, and material changes are communicated to account owners.

11. The mobile app (Android)

The Zen Solutions app is the same service in a phone-sized window: it signs you in to the account your employer or Zen Solutions created for you, and shows you your own work. It asks for a small number of phone permissions, each for one purpose only, and each refusable — the app keeps working without them, minus that feature.

  • Notifications — so we can tell you about a shift change, a message from your manager or a new booking while the app is closed. We store a device token (an address Google Firebase gives us for your phone) together with your account. It is deleted when you sign out, when your account is deactivated, and when your employer removes you from the business.
  • Location — read only at the moment you clock in or out, and only if your employer has set a work-site boundary for punches. It is not read in the background, there is no trail of where you go, and no location is stored beyond what is needed to accept or refuse that one punch.
  • Camera and photos — only when you take or choose a picture yourself (a profile photo, a receipt, a product shot). The app never opens the camera on its own.
  • Microphone — only while you are dictating to the AI assistant, and only for as long as you hold the button.

Diagnostics. If the app crashes it sends us the error, the app version and the phone model, attached to your business and your login so we can find it. It carries no message content, no customer records and no location. You can also send the same report yourself from Settings → Support & diagnostics.

What the app does not do. No advertising identifier, no analytics profile, no third-party trackers, and nothing collected for advertising. We do not sell your data or your customers' data. The app collects nothing at all until you sign in.

Deleting your data. Signing out removes this phone from our notification list. To delete an account and its data, write to the Privacy Officer at privacy@zen-solutions.net — for an employee account, your employer can also remove it from the Employees tab, which deletes it along with its registered devices.

12. The Windows app

The optional Computer control pack of the Windows app runs only on your computer. It sends nothing to us or to anyone else; Desktop Commander's own usage reporting is switched off.

Zen Solutions — zen-ai.net/consultation

Appeler l’agentEssai gratuit