ZaboteQc Privacy Policy
Version 6 — effective date: October 26, 2026
In short
- ZaboteQc holds the files of the Firm's clients, their statements and transactions, and the accounts of the Firm's staff.
- Hazarabedian & Tosikyan Inc. is the enterprise responsible for its clients' and staff's information; Zasenami provides and maintains the app for it.
- The information is kept in Quebec (Montreal). Redacted statement pages and transaction lines are sent to Anthropic, in the United States, for reading and account suggestions; text messages go through Twilio, in the United States.
- Nothing is sold or used for advertising. Anthropic does not use it to train its models; Cloudflare uses the technical data from the anti-bot check to improve that service (section "Providers and locations").
- You exercise your rights with the Firm's person in charge (section "Contact us").
Who this policy applies to
This policy explains what personal information ZaboteQc (the "Service") collects, why, who it is shared with, where it goes, how long it is kept and how to exercise your rights. It covers the Firm's staff members who use the app, the Firm's clients whose information is in it and the people who receive a text message sent by the app.
It is separate from the Service's Terms of Use. Accepting the terms, or confirming that you have read this policy, is not consent to the uses that require a separate consent (section "Separate consents").
Who is responsible
- Zasenami. Solutions Zasenami Inc. (NEQ 1182183815), Laval, Quebec ("Zasenami"), provides, hosts and maintains the Service. Zasenami is the enterprise responsible for the information it collects for its own purposes: the accounts of the people who use the Service (the "Users"), the security of the Service, acceptance records, support and billing. Its person in charge of the protection of personal information is Sebouh Kaloussian, President and person in charge of the protection of personal information, help@zasenami.com.
- Hazarabedian & Tosikyan Inc. For the information that the Firm enters or has entered into the Service about its customers, its staff or other people (its clients' identity and contact details, their social insurance numbers, information about their businesses, their bank and card statements and the transactions taken from them, their documents, appointments, notes, invoices and text messages), Hazarabedian & Tosikyan Inc. is the responsible enterprise. Zasenami then acts as its service provider, under a written agreement, and uses this information only to provide the Service to it. The Firm's person in charge of the protection of personal information is Vahe Tosikyan, vahe@hazarabedian.ca; the app shows the name and email entered in its settings.
- The Firm informs the people whose information it enters into the Service and obtains the necessary consents, according to its own practices.
- Zasenami's governance rules on personal information (retention and destruction, its staff's roles and responsibilities, complaint handling) are summarized at https://zasenami.com/privacy#governance. To complain about how your information is handled, write to the person in charge at the enterprise concerned. Zasenami examines every complaint about information it is responsible for and answers in writing within 30 days; it forwards without delay to the Firm any complaint about information the Firm is responsible for.
Information collected
About the Firm's clients, depending on the services it provides to them:
- identity and contact details: name, date of birth, address, phone, email, language of communication;
- social insurance number (encrypted in the database);
- information about their businesses: name, business and tax numbers, fiscal year end, related people;
- bank and credit-card statements, and the transactions taken from them. In lists, account numbers are cut to the last four digits, and card and social insurance numbers that appear in a description are masked. The original uploaded file is kept as is (section "How long");
- documents filed in the client's file, appointments, notes, rates, credits and invoices;
- text messages sent and received, and the status of their consent to receive messages.
About the Firm's staff:
- name, email, role and permissions;
- sign-ins: date, IP address, browser and device;
- the authenticator-app key (for two-step sign-in);
- timesheets, pay rates, chat messages, tasks;
- activity log and work journal (section "The activity log and the work journal");
- acceptances of the terms and signatures of documents made in the app.
About people who receive a text message: their number, the message, its delivery status and, where applicable, their unsubscribe request.
Most of this information is entered by the Firm's staff, from what clients give the Firm. The Firm informs its clients of this collection according to its own practices.
Why
- keep the clients' books: read statements, assign each transaction an account from the Firm's chart of accounts and produce the entry lists;
- manage clients' files and communicate with them (document reminders, appointments, greetings);
- manage the Firm's work: timesheets, pay, tasks, invoices, chat;
- protect the app and the information: two-step sign-in, detection of access attempts, logs;
- keep proof of acceptances and signatures;
- meet the Firm's legal obligations, including tax and professional ones.
No sale, no advertising
We do not sell or rent personal information. We do not disclose it for targeted advertising or data brokering, and we do not use it to train an artificial-intelligence model. If a provider may use certain information for its own purposes, the "Providers and locations" section says so.
Separate consents
- Where a use of information Zasenami is responsible for requires your consent (for example promotional messages, audience measurement with cookies, the use of sensitive information or any use that is not necessary to the Service), we ask for it separately, for each purpose, with an unticked box, and we keep proof of your answer.
- Refusing such a consent does not deprive you of the Service, unless the information is necessary to provide it.
- You may withdraw a consent at any time (section "Your rights").
- For information the Firm is responsible for, the Firm obtains the necessary consents (section "Who is responsible").
- Separate consents the Service asks for: none; the consents of the Firm's clients to receive promotional text messages are the Firm's to obtain, and the Firm records them in the app.
Artificial intelligence
The app uses the artificial-intelligence model Claude, from Anthropic, in the United States, to:
- read PDF statements and photos of statements;
- suggest an account for transactions that the Firm's rules do not already classify.
What is sent to the model: the image of the statement pages, the transaction lines (date, description, amount) and the Firm's chart of accounts. The social insurance number stored in the file is never sent. Before sending, the image of each page is redacted: the client's name and address printed outside the transaction lines, account numbers (except the last four digits) and branch numbers are masked. Transaction lines are not changed, and the statement kept in the app stays as uploaded. Under its commercial terms, Anthropic does not use this data to train its models.
No other artificial-intelligence provider receives information from the app. A new provider would be announced to the Firm in writing at least 30 days before it receives any information, under the agreement between them.
No decision about a person is made solely by automated processing: every suggested account is reviewed by a member of the Firm's staff, who can change it.
The activity log and the work journal
- Activity log: every change made in the app (who, what, when, old and new value), for security and accountability. The Firm's owner and administrators view it.
- Work journal: for each staff member, pages viewed, the number of searches (not their content), filters, exports, documents filed (their type, never their name), errors shown and session length. It is used to understand how the app is used and to manage the work. A notice is shown to each member before the journal starts. The Firm's owner views each member's journal; each member views their own. Zasenami's account is not recorded in it.
Automated decisions
If a decision about you is made solely through automated processing of your information, you are informed no later than when it is communicated to you. On request, you are told the information used, the reasons and the main factors that led to the decision, and your right to have that information corrected. You may submit your observations to a person who is able to review the decision. The "Artificial intelligence" section states whether the Service makes such decisions.
Cookies and browser storage
The app uses only one cookie needed for it to work: your sign-in session. The browser also keeps, on your device, your display preferences (theme, text size, statement zoom, remembered choices) and the state of some screens during the session. There is no advertising cookie and no third-party audience-measurement or tracking tool.
Providers and locations
The app has its own database, reserved for the Firm. It relies on the following providers, which receive only what they need for their service:
| Provider | What it does | What it receives | Where | What binds it |
|---|---|---|---|---|
| Supabase | Database, uploaded files, sign-in | All the information in the app | Quebec (Montreal) | Supabase's terms of service, which include its data processing agreement |
| Vercel | Hosting and running the app | The information passing through during use, technical logs | Runs in Montreal; global delivery network | Vercel's data processing agreement |
| Anthropic | Reading statements and suggesting accounts (section "Artificial intelligence") | Redacted statement pages, transaction lines, chart of accounts | United States | Anthropic's commercial terms and data processing agreement |
| Twilio | Sending and receiving text messages | Phone number and message text | United States | Twilio's data protection addendum |
| Cloudflare | Anti-bot check at sign-up and sign-in | IP address and technical browser data of staff members | Global network | Turnstile privacy addendum |
| Zasenami | Maintenance, support, fixing incidents | Access to the app when needed (section "Security") | Quebec | Service agreement signed with the Firm and confidentiality undertaking |
Cloudflare receives no information about the Firm's clients; under its addendum, it also uses this technical data to improve its verification service. No other provider receives information from the app.
Communication outside Quebec
- Some providers process information outside Quebec: in the United States (Anthropic, for reading statements and suggesting accounts; Twilio, for text messages) and on global networks (Cloudflare, for the anti-bot check at sign-up and sign-in; Vercel's delivery network, through which pages travel) (section "Providers and locations").
- Before information is communicated outside Quebec, a privacy impact assessment is carried out. It takes into account the sensitivity of the information, the purpose of its use, the protection measures, including contractual ones, and the legal framework of the place it goes to. The information is communicated only if the assessment concludes that it will receive adequate protection. A provider that processes information on our behalf is bound by a written agreement; the "Providers and locations" section states what binds each one. Where the Firm is the responsible enterprise, Zasenami prepares this assessment and the Firm approves it.
- Outside Canada, the information is subject to the laws of those countries and may be accessible to their courts, law enforcement agencies and national security authorities.
- Under privacy law, we remain accountable for the information we entrust to our providers. This statement does not change how responsibility is allocated in the Service's terms.
Other disclosures
Information may also be disclosed without consent where the law requires or permits it, including:
- to legal or accounting advisers bound by professional secrecy;
- to a court or authority that requires it;
- in an emergency that threatens the life, health or safety of a person;
- to collect a debt;
- as part of a sale, merger or financing of the business, under an agreement that limits the use of the information to that transaction and requires its destruction if the transaction does not take place.
Emails and text messages
- Service messages (security, account, invoices, changes to the terms or to this policy) are sent because they are necessary to the Service.
- A promotional message from Zasenami is sent only with express or implied consent under Canada's Anti-Spam Legislation. It identifies the sender, gives its contact information and offers a simple way to unsubscribe, valid for at least 60 days. An unsubscribe request is processed without delay and no later than 10 business days.
- Messages sent on behalf of the Firm identify it as the sender; the Firm is responsible for the consents of their recipients and for honouring their unsubscribes.
How long
| Information | Retention |
|---|---|
| A client's file and transactions | As long as the Firm keeps it, and at least as long as tax and professional laws require. When the Firm removes a client, their file, documents and text messages are erased |
| Original statement file | Erased seven years after the end of the fiscal year it relates to, once that year is closed. Transactions and lists remain |
| Chat messages | For the period the Firm chooses (30 days to 10 years; two years by default) |
| Work journal | Two years |
| IP address and browser of a sign-in | 90 days |
| Activity log | Until the Firm sets a period |
| A staff member's account | Until the Firm removes it |
| Records of acceptance of the terms and of document signatures | For as long as the Service lasts, then destroyed no later than three years after it ends |
At the end of the Service, Zasenami gives the Firm a copy of its data and then destroys it, under the agreement between them.
Destruction and backups
When the purposes for which information was collected have been achieved, it is destroyed or anonymized, subject to the retention periods the law imposes and to the exception for a dispute set out in the section "End of the Service: return and destruction of data" of the Terms of Use. Providers' backup copies are replaced on their own schedule and remain protected until then.
Security
Reasonable security measures, suited to the sensitivity, quantity and medium of the information, protect the Service, including: two-step sign-in required for every account; permissions per member, including for sensitive fields; social insurance numbers encrypted in the database with a key Zasenami keeps in its host's encrypted settings, of which the Firm receives a copy when it signs the agreement; account and card numbers masked in lists; encryption of communications (HTTPS) and of data stored at the host; a database of the Firm's own, separate from those of Zasenami's other clients; a log of every change and monitoring of sign-in attempts. No system is perfectly secure, and no one can guarantee that an incident will never happen.
Zasenami's access
Zasenami keeps an operations account that lets it maintain the app and help the Firm. It uses it only for support, maintenance, security, fixing an incident or at the Firm's request. The Zasenami person who uses it has signed a confidentiality undertaking to the Firm.
Confidentiality incidents
- If personal information is accessed, used, disclosed or lost without authorization, or its protection is otherwise compromised, the responsible enterprise (section "Who is responsible") takes reasonable measures to reduce the risk of injury and prevent it from happening again, and records the incident in its register.
- If the incident presents a risk of serious injury, it promptly notifies the Commission d'accès à l'information and the people concerned. Where the information involved is processed outside Quebec, it also meets the reporting obligations of federal law.
- Where the Firm is the responsible enterprise, Zasenami notifies it without delay and helps it take these steps.
- To report a suspected incident, write to the person in charge named in the "Who is responsible" section.
Your rights
You may ask:
- to access the personal information about you and receive a copy of it;
- to have it corrected if it is inaccurate, incomplete or equivocal;
- to receive the information you provided in a structured, commonly used technological format, or to have it sent to a person you designate;
- to withdraw a consent;
- that the dissemination of information stop or that a link be de-indexed, in the cases provided by law;
- to know the information and the reasons behind an automated decision (section "Automated decisions").
Send your request in writing to the person in charge at the enterprise that holds the information (section "Who is responsible"), with what is needed to confirm your identity. If Zasenami receives a request about information for which the Firm is responsible, it forwards it without delay and helps it answer. The law requires a written answer within 30 days of receipt of the request; Zasenami meets that deadline for information it is responsible for. Access is free of charge; a reasonable fee may be charged for transcribing, reproducing or transmitting the information, and you are told the approximate amount in advance.
If you are not satisfied with the answer, you may contact the Commission d'accès à l'information du Québec and, for information processed outside Quebec, the Office of the Privacy Commissioner of Canada.
Age
The Service is intended for businesses and their staff. No one under 14 may have an account; a person aged 14 to 17 may have one only for their work for the Firm, with its authorization. If we learn that an account was opened for a person under 14, we close it.
If you live in the United States
- The categories of information collected and the categories of third parties that receive it are described in the "Information collected" and "Providers and locations" sections. Some of it is processed in the United States.
- We do not sell your information or share it for targeted advertising based on your activity on other websites or apps.
- "Do Not Track" signals and Global Privacy Control: the app does not respond to these signals; it uses no advertising cookie and no audience-measurement tool.
- Third-party tracking: no third party tracks your activity in the app or across sites.
- You can review and have your information corrected as described in the "Your rights" section. Changes to this policy are announced to you as described in the "Changes" section.
Changes
- Each version of this policy carries a number or a date, and its effective date. The version in force is always published at https://zaboteqc.zasenami.com/privacy?lang=en.
- Each new version is announced by a notice disseminated the same way as the policy, in the Service, by email or both, with a summary of the changes.
- Information already collected is not used for a new purpose, or disclosed to a new recipient for a new purpose, without your consent where the law requires it. Such a change is presented to you for acceptance before it applies.
Language
This document is presented first in French, and an English version is offered. No fee is charged for the French version. A person who chooses the English version declares that they expressly wished to do so after the French version was provided to them. Both versions were written to have the same meaning.
Contact us
- For your information or that of one of the Firm's clients: the Firm's person in charge of the protection of personal information, Vahe Tosikyan, vahe@hazarabedian.ca.
- For a question about the app or about the information Zasenami is responsible for: Sebouh Kaloussian, Zasenami's person in charge of the protection of personal information, help@zasenami.com.