Privacy Policy

Last updated: November 2025

This Privacy Policy (the "Policy") describes how Flexibl Technologies Inc. ("Flexibl", "we", "our", or "us") collects, uses, discloses, protects, and retains Personal Information in accordance with the laws of the Province of Quebec, including the Act Respecting the Protection of Personal Information in the Private Sector, CQLR c. P-39.1 ("Law 25"), and the federal Personal Information Protection and Electronic Documents Act ("PIPEDA").

Capitalized terms not defined herein have the meaning set out in the Flexibl Terms of Use.

By accessing or using the Flexibl website, Platform, or any related services (collectively, the "Services"), you acknowledge that you have read and understood this Policy and that your Personal Information will be handled in accordance with it.

1. Purpose and Scope of This Policy

Flexibl provides a web-based Payment Intelligence platform allowing businesses to aggregate, visualize and analyze their payment and financial data through integrations with third-party payment processors.

This Policy applies to:

  • Individuals who create and use User accounts on the Platform (the "Users");
  • Visitors of the Flexibl marketing website (www.goflexibl.com);
  • Any interactions with Flexibl in connection with the Services.

This Policy does not apply to personal information of our clients' customers included within Client Business Data imported into Flexibl through integrations. Flexibl processes such information strictly as a service provider on behalf of its clients and does not control its collection or accuracy.

2. Roles and Responsibilities Within Flexibl

Privacy Officer

Flexibl has appointed a Privacy Officer responsible for:

  • Implementing privacy policies and procedures;
  • Responding to requests to access or correct Personal Information;
  • Managing privacy incidents and reporting them when required by law;
  • Overseeing compliance with Law 25 and PIPEDA.

Contact information:

Flexibl will respond to written requests within 30 days.

Internal Responsibilities

Flexibl personnel are responsible for:

  • Maintaining confidentiality obligations;
  • Following internal access control procedures;
  • Reporting any actual or suspected privacy incidents.

Flexibl provides privacy awareness training to its employees.

3. Definitions

"Personal Information" means any information relating to an identifiable natural person. Examples: name, email address, login information, device identifiers, IP address.

"Client Business Data" means non-User data provided or imported by Flexibl's clients through integrations with payment processors (e.g., Stripe, Paysafe, Nuvei, Adyen). This may include transaction data or other business records relating to the client's customers. Client Business Data is not considered Personal Information of the User.

4. What Personal Information We Collect About Users

Flexibl collects the following categories of Personal Information:

Identity and Contact Information

  • Full name
  • Email address
  • Company affiliation (if applicable)

Account Information

  • Login credentials (processed through Amazon Cognito)
  • Account settings
  • Authentication and session identifiers

Technical and Usage Information (via cookies and tracking tools)

  • IP address and geolocation approximation
  • Browser type, device type, operating system
  • Pages visited, actions taken, session duration
  • Interactions with our website or Platform

Collected through:

  • Google Analytics
  • Hotjar (heatmaps, session recordings, behavior analytics)
  • Lemlist website tracking

Communications with Flexibl

  • Emails sent to Flexibl
  • Forms submitted through the website
  • Support or onboarding interactions

Uploaded Files

  • Users may upload documents or data files (e.g., CSV, Excel) required to use the Services.
  • Flexibl does not collect credit card numbers or full payment card details. Payments are processed exclusively through Stripe Checkout or other hosted payment flows.

5. How We Collect Personal Information

Flexibl collects Personal Information:

  • Directly from Users, when creating or managing an account, submitting forms or uploading files, or communicating with Flexibl;
  • Automatically, via cookies and tracking tools: Google Analytics (usage analytics), Hotjar (behavior analytics, recordings, heatmaps), Lemlist (website visit tracking);
  • Through essential session cookies required for authentication.

Users may disable non-essential cookies through browser settings, though this may affect Platform performance.

6. Processing of Client Business Data

Flexibl integrates with third-party payment processors, currently including:

  • Stripe
  • Paysafe
  • Nuvei
  • Adyen

Through these integrations, Flexibl processes Client Business Data solely to deliver the Services to the client. Flexibl acts exclusively as a service provider / processor and does not:

  • Control how the client collects its customers' data;
  • Determine the purposes for which Client Business Data is used;
  • Communicate Client Business Data to third parties except as required to provide the Services.

Client Business Data is processed under the contractual instructions of the client and is not governed by the User rights in this Policy.

7. Why We Use Personal Information

Flexibl uses User Personal Information strictly for the following purposes:

To provide and administer the Services

  • Authenticate Users (Cognito)
  • Enable access to the Platform
  • Display dashboards and features
  • Process file uploads

To operate, maintain, and improve the Platform

  • Monitor performance
  • Improve UX and security
  • Conduct analytics using GA and Hotjar

To communicate with Users

  • Transactional emails (account notices, verification, technical alerts)
  • No marketing or promotional emails are sent

To comply with legal obligations

Flexibl does not use User Personal Information for advertising, remarketing, or promotional messaging.

8. Third-Party Providers

Flexibl shares Personal Information with the following categories of service providers:

A. Cloud Hosting and Infrastructure

  • Amazon Web Services (AWS)
  • Region: us-east-1 (North Virginia)
  • Hosting, storage, infrastructure, encryption at rest / in transit

B. Authentication

  • Amazon Cognito

C. Email and Notifications

  • Amazon Simple Email Service (SES)
  • Amazon Simple Notification Service (SNS)

D. Analytics and Tracking (Website and Platform)

  • Google Analytics
  • Hotjar
  • Lemlist (website tracking only)

E. Customer Relationship Management

  • HubSpot (CRM; no tracking cookies used)

Flexibl does not sell, rent, or disclose Personal Information to third parties for marketing or commercial purposes.

9. International Transfers

Personal Information is stored and processed on AWS servers located in:

  • United States (us-east-1, North Virginia)

Before transferring Personal Information outside Quebec, Flexibl conducts a privacy impact assessment as required by Law 25 and ensures that the foreign jurisdiction provides adequate protections.

10. Retention and Deletion of Personal Information

Flexibl retains Personal Information only as long as necessary to fulfill the purposes described in this Policy or as required by law.

User Account Deletion

When a User deletes their account:

  • Flexibl deletes the User's Personal Information (identity, contact, credentials, session data).
  • Flexibl retains Client Business Data, as it belongs to the client company and is processed under its instructions.

Backup and audit logs may persist for a limited period as required for security and compliance.

11. Security Measures

Flexibl employs administrative, technical, and physical safeguards appropriate to the sensitivity of Personal Information, including:

A. Access Controls

  • Multi-factor authentication (MFA) for employees
  • Role-Based Access Control (RBAC)
  • Limited employee access on a need-to-know basis
  • User authentication via Amazon Cognito

B. Encryption

  • TLS encryption for data in transit
  • AWS default encryption (AES-256) for data at rest

C. Organizational Safeguards

  • Employee confidentiality obligations
  • Privacy awareness practices
  • Incident detection and response procedures

Flexibl relies on AWS's industry-standard infrastructure protections. No representations are made regarding deeper encryption layers or configurations beyond AWS defaults.

12. Privacy Incidents

Flexibl maintains processes for:

  • Detecting, containing, and mitigating privacy incidents;
  • Assessing risks of serious harm;
  • Notifying the Commission d'accès à l'information du Québec and affected individuals when legally required.

13. User Rights

Subject to applicable law, Users have the following rights concerning their Personal Information:

  • Right of access
  • Right to rectification
  • Right to withdraw consent (where applicable)
  • Right to data portability
  • Right to lodge a complaint
  • Right to request deletion of their Personal Information

These rights apply only to Personal Information of the User, not to Client Business Data. Requests must be submitted to the Privacy Officer.

14. Amendments to This Policy

Flexibl may update this Policy from time to time. Material changes will be communicated to Users by email or through the Platform. Continued use of the Services after an update constitutes acceptance of the revised Policy.

15. Contact Information

Questions regarding this Policy or the handling of Personal Information may be directed to:

Privacy Officer
Flexibl Technologies Inc.
Email: support@goflexibl.com
Address: 195 rue Montcalm, Bromont, Quebec, J2L 2C8, Canada