Privacy Policy

1. Who We Are and Privacy Officer

Zasenami is a digital services company based in Laval, Quebec, Canada. We build websites and apps, manage Search Visibility (Google + AI assistants), set up Google Business Profile and Merchant Center, deliver AI chatbot solutions, and provide hosting and maintenance for local and small businesses.

• Legal address: Laval, Quebec, Canada
• Privacy Officer: Sebouh, Founder & Privacy Officer
• Privacy Officer email: help@zasenami.com
• Mail: Zasenami — Attn: Privacy Officer, Laval, Quebec, Canada

The Privacy Officer is the person responsible for the protection of personal information within Zasenami and is the point of contact for any privacy-related question, access request, rectification request, portability request, de-indexation request, or complaint.

2. Scope

This policy applies to zasenami.com (including the contact form), any service delivery we perform for clients, and any transactional or marketing email we send through Resend. It does not apply to personal information collected on websites we build or manage for clients — each client site is governed by that client's own privacy policy, and Zasenami acts as a data processor under the client's instructions for service-delivery data only.

3. Personal Information We Collect

We limit collection to what is necessary for the stated purpose (Law 25 s.5).

From website visitors

• Contact form submissions: name, email, phone (optional), current website URL (optional), service interest, project timeline, free-text message.
• Analytics: Vercel Analytics — cookieless, no PII, no fingerprinting, no cross-site tracking.

From clients

• Business and personal identifiers (name, email, phone, address, billing info).
• Project content (brand assets, copy, images, credentials stored in encrypted password manager and used only for service delivery).
• Communication history (emails, messages, call notes).
• Payment information — processed directly by our third-party payment processor; we do not store card or banking data.

4. Purposes and Legal Basis

Each purpose has a specific legal basis under Law 25, PIPEDA, and (where applicable) GDPR:

• Respond to contact-form inquiries: implied consent / legitimate interest.
• Deliver contracted services: express consent in signed agreement / contract performance.
• Transactional emails (lead acknowledgment, project updates, invoices): existing business relationship (CASL s.10(9)(a)) / contract performance.
• Educational email sequences: express consent (opt-in at signup).
• Analytics: legitimate interest (no personal data processed — cookieless).
• Legal, tax, and regulatory compliance: legal obligation.

We do not use personal information for purposes other than those stated here without obtaining separate consent.

5. Automated Decision-Making (Law 25 s.12.1)

Where an AI tool processes personal information and produces an assessment, recommendation, or decision that could affect an individual, Law 25 requires us to disclose this.

As of the effective date: Zasenami does not use automated decision-making to make decisions producing legal or significant effects on individuals on our own website or in our internal operations. Our contact-form responses, service quotes, and client communications are authored or reviewed by a human before being sent.

For AI chatbot services we deploy on client sites, we configure the systems so that no decision materially affecting an individual is made solely by automated means without human review availability. To request human review of any automated interaction, email help@zasenami.com.

6. Cross-Border Data Transfers (Law 25 s.17)

Personal information we collect may be transferred to and processed in the United States by the following service providers, each operating under a Data Processing Agreement (DPA) with Zasenami:

• Vercel Inc. (San Francisco, CA, USA) — website hosting, cookieless analytics, serverless function execution.
• Resend Inc. (USA) — transactional and marketing email delivery.
• Notion Labs Inc. (San Francisco, CA, USA) — contact lead record management (CRM).
• Cloudflare Inc. (San Francisco, CA, USA) — DNS, email routing, CDN.

Before relying on each provider, Zasenami has conducted a Privacy Impact Assessment consistent with Law 25 s.17 requirements and has put contractual protections in place (including Standard Contractual Clauses for EU data transfers where applicable). Contact help@zasenami.com for specific measures taken.

7. Sharing With Third Parties

We do not sell, rent, or share personal information with third parties except: (a) service providers listed in Section 6, acting as processors on our instructions; (b) professional advisors (accountants, legal counsel) under confidentiality; (c) when required by law or court order; (d) in the event of a merger, acquisition, or sale of assets, subject to the same privacy protections.

We do not share personal information for advertising, profiling, or analytics resale.

8. Your Rights

Regardless of where you reside, you may exercise the following rights by contacting help@zasenami.com. We respond within 30 days (extendable to 60 days with notice).

Under Quebec Law 25 and PIPEDA

• Access — obtain a copy of the personal information we hold about you.
• Rectification — correct inaccurate or incomplete information.
• Erasure and de-indexation — withdraw consent and request deletion; for publicly-linked information, request de-indexation (Law 25 s.28.1).
• Data portability — receive your information in a structured, commonly used format (Law 25 s.27 para 3, in force Sept 2024).
• Withdraw consent at any time.
• Complain to the CAI — Commission d'accès à l'information du Québec, 1-888-528-7741.

Under GDPR (EU/EEA/UK visitors)

• Restriction of processing (Art. 18), objection to processing (Art. 21), rights regarding automated decision-making (Art. 22), complaint to your local supervisory authority.

Under CCPA/CPRA (California residents)

Zasenami does not meet CCPA business thresholds and does not sell or share personal information. California residents may contact us to exercise applicable access and deletion rights.

9. Data Retention and Destruction

• Contact-form inquiries (non-clients): 24 months from last contact.
• Client engagement records: duration of engagement plus 7 years (Quebec tax law).
• Financial records: 7 years from end of fiscal year.
• Email marketing consent records: duration of consent plus 3 years (CASL).
• Lead records in our CRM: 24 months from last contact unless converted to client.

On destruction we permanently delete records and authorize our processors to do the same, or we anonymize them such that the remaining data cannot be associated with any identifiable individual.

10. Cookies and Tracking Technologies

zasenami.com uses Vercel Analytics, a cookieless analytics service that does not place cookies on your device and does not collect personally identifiable information. We do not use advertising cookies, retargeting pixels, cross-site tracking, or fingerprinting technologies on this website.

Standard technical cookies may be set by the hosting and CDN infrastructure (Vercel edge routing, Cloudflare DDoS protection) strictly for site operation. These are exempt from consent requirements because they are strictly necessary to deliver the service you are requesting. If we ever add non-essential cookies or tracking in the future, we will update this policy and implement a compliant consent banner before any such technology is loaded.

11. Breach Notification

If we become aware of a confidentiality incident involving your personal information that presents a risk of serious injury, we will notify the CAI and affected individuals without delay, as required by Law 25 s.3.5 and PIPEDA. To report a suspected incident, contact help@zasenami.com.

12. Marketing Communications (CASL)

Commercial electronic messages are sent only on the basis of express consent or implied consent under CASL. Every message we send includes Zasenami's legal name, mailing address, and a functioning unsubscribe mechanism that remains valid for at least 60 days and is processed within 10 business days. Opt out any time via the unsubscribe link or email help@zasenami.com.

13. Security

We take reasonable technical and organizational measures: encrypted cloud storage, credentials in encrypted password manager, access limited to project personnel, annual processor reviews, TLS 1.2+ on all data in transit. No system is perfectly secure; we will notify you of any breach involving a risk of serious injury as described above.

14. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable law. Material changes will be communicated by email to active clients and announced on this page. The effective date at the top is updated on every change. Continued use of our services after the effective date constitutes acceptance of the updated policy.