Privacy Policy

Effective Date: May 10, 2026
Last Updated: May 10, 2026

1. Introduction

QuantumFlex AI Inc. ("we," "our," or "us") operates SmartForms, a web-based form builder service that allows you to create digital forms, share them via unique links, collect submissions, and export your data. Our registered office is located at 461036 RGE RD 241, Wetaskiwin, AB T9A 1X1, Canada.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use SmartForms. We are committed to protecting your privacy and complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the European Union's General Data Protection Regulation (GDPR).

By using SmartForms, you agree to the collection and use of information in accordance with this policy. If you do not agree, do not use our service.

Privacy Officer: David Strick, QuantumFlex AI Inc. — privacy@quantumflexai.com — 461036 RGE RD 241, Wetaskiwin, AB T9A 1X1, Canada

2. Information We Collect

2.1 Information You Provide

Account information: Email address, name, and password when you create an account
Profile information: Business details, branding (logo, company name), preferences, and settings you configure
Forms you create: Form definitions, field structures, branding choices, and any content you enter into the form builder
Payment information: Billing details (name, billing address, payment method) processed securely through Stripe. We do not store full card numbers on our servers.
Support communications: Messages you send to our support channels

2.2 Form Submission Data — Controller and Processor Roles

When end users submit data through forms you have built using SmartForms, we receive and store that submission data on your behalf.

For form submissions:

You are the data controller. You determine what data your forms collect, the purpose of collection, and how the data is used after submission.
QuantumFlex AI Inc. is the data processor. We process the submission data on your behalf, solely to provide the SmartForms service to you.
You are responsible for obtaining a lawful basis for collection (consent, contract, legitimate interest, etc.) and for complying with all applicable data protection laws in respect of the personal data your forms collect.
We do not use, sell, share, or analyse your form submission data for any purpose other than providing the service to you.

            IP address logging on form submissions: When a person submits a form, their IP address is recorded with the submission. This helps form owners identify duplicate submissions, detect fraud, and meet legal requirements. IP addresses are stored as cryptographic hashes, not in plaintext. By submitting a form, end users consent to this collection. Form owners must disclose this processing to their end users in their own privacy notice.
        

2.3 Automatically Collected Information

Usage data: How you interact with SmartForms, features used, frequency and duration of use
Device information: Browser type, operating system, device identifiers
Log data: IP address (stored as cryptographic hash), access times, pages or screens viewed
Cookies and tracking technologies: See Section 10 (Cookies and Tracking)

3. How We Use Your Information

We use your personal information for the following purposes. Where GDPR applies, the legal basis for each purpose is noted.

Providing and maintaining SmartForms: Processing is necessary to perform our contract with you
Processing requests and transactions: Processing is necessary to perform our contract with you
Sending service-related communications (account notices, security alerts, billing): Processing is necessary to perform our contract with you
Analyzing usage patterns to improve our service: Processing is based on our legitimate interest in improving SmartForms, using aggregated and anonymized data where possible
Protecting against fraud and unauthorized access: Processing is based on our legitimate interest in securing the platform
Complying with legal obligations: Processing is required by applicable law

We will not use your information for purposes that are incompatible with those listed above without first obtaining your consent.

We do not use your form submission data, your forms, or your end users' personal data for any purpose other than providing SmartForms to you. Specifically, we do not analyse, mine, or train AI models on your forms or your submission data.

4. Data Sharing and Sub-processors

We do not sell your personal information. We may share data in the following circumstances:

4.1 Service Providers and Sub-processors

We engage trusted third parties to help operate SmartForms. These parties process data only as directed by us and are bound by data processing agreements:

Sub-processor	Purpose	Data Processed
Amazon Web Services (Lightsail, Oregon US)	Hosting, compute, database	All stored data (encrypted at rest)
Amazon Web Services (SES)	Transactional email delivery	Email addresses, account/security email content
Cloudflare	DNS, CDN, DDoS protection	Network metadata for inbound traffic
Stripe	Payment processing	Email, billing details, payment information
Google reCAPTCHA v3	Bot prevention on signup and key forms	IP address, browser data, interaction signals

4.2 Legal Requirements

We may disclose your information if required by law, court order, or a lawful request from a governmental authority, or where we believe in good faith that disclosure is necessary to protect rights, property, or safety.

4.3 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your personal information is subject to a materially different privacy policy.

5. Data Security

We implement appropriate technical and organizational measures to protect your data:

Encryption of data in transit using TLS 1.2 or higher
Encryption of data at rest
Passwords stored as cryptographic hashes (never in plaintext)
Password history retained to prevent reuse
Account lockout after repeated failed login attempts
Per-account session token rotation on password change
CSRF protection on state-changing requests
Rate limiting on authentication and form submission endpoints
Bot prevention via Google reCAPTCHA v3
IP address hashing on form submissions
Regular security audits and vulnerability assessments
Access controls limiting employee access to user data on a need-to-know basis
Daily automated database backups
Continuous security monitoring

No method of transmission or storage is 100% secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security. In the event of a data breach that creates a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

6. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy. Specific retention periods are as follows:

Data Type	Retention Period
Account and profile data	Until you delete your account, plus 30 days for recovery
Forms you create	Until you delete them, or 30 days after account deletion
Form submissions (including hashed IPs)	Until you delete them, or 30 days after account deletion
Password history (hashed)	Last 5 passwords retained for security
Payment and billing records	7 years from date of transaction (Canadian tax law)
Server logs	90 days

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required for legal compliance, dispute resolution, or fraud prevention.

7. Your Privacy Rights

7.1 Rights Under PIPEDA (Canadian Users)

Under Canada's Personal Information Protection and Electronic Documents Act, you have the right to:

Know whether we hold personal information about you and access that information
Challenge the accuracy and completeness of your information and request corrections
Withdraw consent at any time, subject to legal or contractual restrictions
Request that we delete your personal information (subject to our legal retention obligations)
File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you believe your privacy rights have been violated

7.2 Additional Rights Under GDPR (EEA and UK Users)

If you are located in the European Economic Area or United Kingdom, you have additional rights under the GDPR:

Right of access: Obtain a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure ("right to be forgotten"): Request deletion of your data, subject to certain exceptions
Right to restrict processing: Request that we limit how we use your data in certain circumstances
Right to data portability: Receive your data in a structured, machine-readable format (CSV or JSON)
Right to object: Object to processing based on legitimate interests or for direct marketing
Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce significant legal effects

To exercise any of these rights, contact our Privacy Officer at privacy@quantumflexai.com. We will respond within 30 days. We may need to verify your identity before processing your request.

8. Marketing Communications (CASL)

We comply with Canada's Anti-Spam Legislation (CASL). We send two categories of electronic messages:

Transactional communications: Messages required to provide the service (account notices, password resets, billing receipts, security alerts). These are sent based on your use of the service and do not require separate consent.
Marketing communications: Newsletters, product updates, and promotional messages. These are sent only with your express or implied consent as defined under CASL.

You may withdraw consent for marketing communications at any time by:

Clicking "Unsubscribe" in any marketing email
Updating your notification preferences in SmartForms account settings
Emailing privacy@quantumflexai.com with your unsubscribe request

Unsubscribing from marketing emails does not affect transactional communications, which are required for the operation of your account.

9. International Data Transfers

QuantumFlex AI Inc. is incorporated and based in Canada. SmartForms application infrastructure is hosted on Amazon Web Services in the Oregon, United States region. By using SmartForms, you understand that your personal data and your form submission data will be transferred to, stored in, and processed in the United States.

For users in the European Economic Area or United Kingdom: where personal data is transferred from the EEA/UK to the United States, we rely on appropriate safeguards including Standard Contractual Clauses and the data protection commitments of our sub-processors.

For users in Canada: your data is transferred outside Canada when stored on AWS US infrastructure. AWS maintains appropriate certifications (SOC 2, ISO 27001, etc.) and data processing agreements governing this transfer. Canadian privacy law continues to apply to your relationship with QuantumFlex AI Inc. regardless of where data is processed.

10. Cookies and Tracking

We use cookies and similar technologies. See our Cookie Policy for full details.

In summary, SmartForms uses:

Essential cookies (session, CSRF, login persistence)
One functional cookie (cookie consent record)
Third-party cookies set by Stripe (payment), Cloudflare (DDoS protection), and Google reCAPTCHA (bot prevention)

We do not use analytics cookies, advertising cookies, or cross-site tracking cookies.

11. Children's Privacy

SmartForms is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@quantumflexai.com and we will delete that information promptly.

12. Third-Party Links

SmartForms may contain links to third-party websites or services, including documentation, payment processors, and integration partners. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the updated policy on this page with a new "Last updated" date
Sending an email notification to registered users for material changes

Your continued use of SmartForms after the effective date of changes constitutes acceptance of the updated policy. If you do not agree to material changes, you must stop using SmartForms and may request account deletion.

14. Contact Us

For questions, complaints, or requests relating to this Privacy Policy or our data practices:

QuantumFlex AI Inc.
Privacy Officer: David Strick
Email: privacy@quantumflexai.com
Website: https://smartforms.quantumflexai.com
Mail: 461036 RGE RD 241, Wetaskiwin, AB T9A 1X1, Canada

If you are a Canadian resident and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

If you are an EEA resident, you may contact your local data protection authority.