1. Introduction

QuaiMax ("QuaiMax", "we", "our", or "us") is an artificial intelligence-powered accounting, bookkeeping, financial management, inventory management, and enterprise resource planning platform owned and operated by Datamond System Inc. ("Datamond"), an Ontario, Canada corporation.

This Privacy Policy explains how Datamond collects, uses, discloses, stores, transfers, processes, retains, and protects personal information when individuals, businesses, organizations, and their authorized users access or use the Services.

• QuaiMax websites, including QuaiMax.com;

• QuaiMax web and mobile applications;

• APIs, connectors, integrations, and synchronization services;

• AI-powered accounting, automation, analytics, and document-processing features;

• Customer support, onboarding, training, and communications; and

• Related QuaiMax products and services (collectively, the “Services”)

By using the Services, you acknowledge that you have read this Privacy Policy. Where consent is required by applicable law, we will seek consent in an appropriate manner.

2. Scope: Customer and Datamond Roles

This Policy applies to personal information Datamond controls and to personal information processed through the Services as described below.

2.1 Datamond as an organization/controller

Datamond generally determines the purposes and means of processing for information used to operate accounts, administer subscriptions, secure the Services, provide support, manage the website, communicate with users, comply with law, and improve the Services.

2.2 Datamond as a service provider/processor

When a business customer submits personal information about its customers, vendors, employees, contractors, or other individuals to QuaiMax for processing on the customer's instructions, the customer generally determines why that information is processed and Datamond processes it to provide the Services, subject to the customer agreement and applicable law.

Business customers are responsible for having appropriate authority, notices, consents, and other lawful bases to submit personal information to the Services and for responding to requests concerning information they control. Individuals whose information was provided by a QuaiMax customer may need to contact that customer first.

2.3 Exclusions

This Policy does not govern third-party websites, applications, or services that Datamond does not control. Third-party services may have their own privacy notices and terms.

3. Information We Collect

We collect information directly from users, through use of the Services, from business customers and their authorized users, and from third parties that users choose to connect to QuaiMax.

3.1 Account Information

• Name and contact details;

• Business name, role, and organization information;

• Account identifiers, login and authentication information;

• User roles, permissions, settings, and preferences; and

• Communications and support history.

3.2 Subscription, billing, and transaction information

• Subscription plan, invoices, billing address, tax information, and purchase history;

• Payment status and transaction references; and

• Payment-card information handled by payment processors where applicable. Datamond generally does not store full payment-card numbers unless expressly stated at collection.

3.3 Customer business and financial data

• Accounting records, journal entries, ledgers, trial balances, financial statements, reconciliations, chart-of-account data, and tax records;

• Invoices, sales receipts, customer payments, credit notes, refunds, bills, expenses, purchase orders, vendor credits, and payment records;

• Bank, credit-card, deposit, settlement, and other financial transaction data;

• Payroll, employee, contractor, withholding, and related records submitted by customers;

• Products, SKUs, inventory, warehouse, supply-chain, asset, and operational records; and

• Other business records, metadata, notes, and content entered or generated through the Services.

3.4 Documents and Attachments

• Receipts, invoices, statements, contracts, tax and payroll documents;

• Images, PDFs, spreadsheets, data exports, and other uploaded files; and

• Information contained within those files, which may include personal or sensitive information.

3.5 Connected accounts and third-party sources

If you connect a bank, payment service, e-commerce platform, accounting system, ERP, tax service, or other third-party application, we may receive information authorized through that connection, such as account identifiers,balances, transaction data, customer/vendor information, and synchronization metadata. The scope depends onthe connection and permissions you grant.

3.6 Al and automation data

Al-powered features may process documents, extracted text, accounting records, prompts, instructions, user corrections, review decisions, confidence information, and outputs needed to provide the requested feature.

3.7 Device, usage, and log information

• IP address and approximate geographic region;

• Browser, operating system, device and application identifiers;

• Session, authentication, access, and timestamp information;

• Feature usage, navigation, interaction, and performance information;

• Error, diagnostic, security, and audit logs; and

• Cookie and similar-technology identifiers.

3.8 Information we ask you not to provide unless necessary

Because financial and payroll documents can contain sensitive information, customers should submit only information reasonably necessary for their use of the Services and should configure access permissions appropriately.

4. Cookies and Similar Technologies

We may use cookies, local storage, pixels, software development kits, and similar technologies to authenticate users, maintain sessions, remember preferences, secure the Services, measure performance, understand usage, and, where applicable, support communications or marketing.

Where required by law, we will request consent before using non-essential cookies or similar technologies. Users may manage browser settings and any cookie controls we make available. Blocking necessary technologies may prevent parts of the Services from functioning.

5. How and Why We Use Information

Subject to applicable law and customer instructions where Datamond acts as a processor, we may use information to:

• Provide, configure, operate, maintain, and support the Services;

• Create and administer accounts, subscriptions, permissions, and customer relationships;

• Import, synchronize, extract, classify, organize, match, reconcile, calculate, summarize, report, and otherwise process customer data;

• Provide Al-powered document understanding, accounting analysis, draft transactions, recommendations, automation, validation, exception handling, and related features;

• Authenticate users; prevent fraud, abuse, unauthorized access, and security incidents; and maintain audit logs;

• Respond to inquiries, troubleshoot issues, provide onboarding/training, and send service-related communications;

• Measure performance, diagnose errors, conduct quality assurance, and improve usability and reliability;

• Develop and improve features using information as described in Section 9;

• Administer billing and enforce agreements;

• Comply with legal, regulatory, tax, accounting, audit, and recordkeeping obligations; and

• Establish, exercise, or defend legal claims and protect the rights, safety, property, and integrity of users, Datamond, and others.

6. Consent and Legal Bases

The legal basis for processing depends on the information, purpose, location, and relationship with the user. Where applicable, Datamond may rely on:

• Performance of a contract or steps requested before entering a contract;

  Consent, including express consent where required for sensitive or non-essential processing;

  Datamond's or another party's legitimate interests, where permitted and not overridden by applicable privacy rights;

• Compliance with legal obligations;

• Protection of vital interests; and

• Other grounds permitted by applicable law.

Where processing is based on consent, consent may be withdrawn subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing that was lawful before withdrawal.

7. Customer Data, Ownership, and Instructions

“Customer Data” means information, documents, records, and content submitted, imported, synchronized, stored, transmitted, generated, or processed through the Services by or for a customer.

As between Datamond and the customer, Datamond does not claim ownership of Customer Data. Customer Data remains subject to the customer's rights and the rights of individuals whose personal information it contains.

Customers authorize Datamond and its authorized service providers to process Customer Data as reasonably necessary to provide, secure, maintain, and support the Services, and to improve the Services only as described in this Privacy Policy and the applicable customer agreement, in accordance with customer instructions and applicable law.

8. Artificial Intelligence and Automated Processing

QuaiMax uses artificial intelligence, machine learning, deterministic rules, and automation as part of its accounting and ERP functionality. Depending on the feature and product line, these technologies may:

• Extract and structure information from documents;

• Classify documents and accounting activity;

• Suggest or determine chart-of-account mappings and accounting treatments;

• Prepare draft transactions and journal entries;

• Identify matches and assist with reconciliation;

• Detect anomalies, confidence issues, and exceptions;

• Generate summaries, reports, explanations, and recommendations; and

• Automate accounting workflows subject to configured controls and product functionality

The degree of human review depends on the product, customer configuration, workflow, and applicable requirements. Some features are designed for human review and approval, while other features may perform automated processing with validation, controls, and exception handling.

Where applicable law provides rights concerning decisions based solely on automated processing that produce legal or similarly significant effects, Datamond will provide applicable information and mechanisms required by law. QuaiMax is not intended to make employment, credit, insurance, housing, or other regulated eligibility decisions about individuals unless expressly supported under a separate applicable service and agreement.

9. AI Training, Model Improvement, and De-Identified Data

Datamond may use aggregated, anonymized, or de-identified information to operate, secure, analyze, improve, and develop the Services, provided the information is processed in a manner intended not to identify an individual or customer.

Datamond does not use identifiable Customer Data to train publicly available general-purpose AI models.

Datamond does not permit third-party AI providers to use identifiable Customer Data to train their general-purpose AI models.

Where third-party AI or machine-learning providers process Customer Data on Datamond's behalf, Datamond uses contractual, technical, and organizational safeguards appropriate to the nature and sensitivity of the information and requires such providers to process Customer Data only for authorized purposes.

User feedback, corrections, and interaction signals may be used to improve QuaiMax features where permitted by the customer agreement, applicable law, and relevant privacy settings.

10. When We Disclose Information

Datamond does not sell personal information for monetary consideration. We may disclose information in the following circumstances:

10.1 Service providers and subprocessors

We may use vendors for cloud hosting, infrastructure, data storage, AI processing, document processing, analytics, communications, customer support, payments, security, monitoring, and other functions. They are permitted to process information only for authorized purposes and subject to appropriate contractual obligations.

10.2 Customer-directed integrations

When a customer connects or directs us to interact with a third-party service, we may disclose information to that service as necessary to carry out the customer's instruction.

10.3 Within a customer organization

Information may be available to account owners, administrators, accountants, team members, or other authorized users according to the customer's roles, permissions, and configuration.

10.4 Professional advisers

We may disclose information to lawyers, auditors, accountants, insurers, consultants, and other professional advisers where reasonably necessary and subject to confidentiality obligations.

10.5 Legal, security, and rights-protection purposes

We may disclose information where required or permitted by law, legal process, regulatory request, or to investigate fraud or security incidents; protect rights, safety, and property; or enforce agreements.

10.6 Corporate transactions

Information may be disclosed or transferred in connection with a proposed or completed merger, acquisition, financing, investment, reorganization, insolvency, or sale of assets, subject to applicable law and appropriate protections.

11. International and Cross-Border Processing

Datamond is based in Canada and may use service providers or infrastructure in Canada, the United States, the United Kingdom, the European Economic Area, or other jurisdictions. As a result, information may be processed outside the province, state, or country where it was collected and may be subject to lawful access by courts, law-enforcement agencies, or other authorities in those jurisdictions.

Where required, Datamond uses contractual, organizational, and other safeguards intended to support lawful cross-border transfers, which may include contractual transfer terms or other recognized transfer mechanisms.

12. Data Security

Datamond uses administrative, technical, organizational, and physical safeguards designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Depending on the system and risk, safeguards may include:

Encryption in transit and at rest;

• Authentication controls and multi-factor authentication support;

• Role-based and least-privilege access controls;

• Logging, audit trails, monitoring, and alerting;

• Network, application, and infrastructure security controls;

• Backups, resilience, and recovery measures;

• Vendor and access management; and

• Security and privacy procedures and training.

No security measure or system is completely secure. Users are responsible for protecting their credentials, configuring permissions appropriately, and promptly notifying Datamond of suspected unauthorized access.

13. Privacy and Security Incidents

Datamond maintains processes to assess and respond to suspected privacy and security incidents. Where required by applicable law, Datamond will notify affected individuals, customers, regulators, or other authorities and will maintain required records of qualifying breaches.

Customers should promptly report suspected unauthorized access, disclosure, loss, or misuse of information associated with their QuaiMax account using the contact information in Section 23.

14. Data Retention and Deletion

Datamond retains personal information and Customer Data only for as long as reasonably necessary for the purposes described in this Policy, to provide the Services, comply with customer instructions and contractual commitments, meet legal or regulatory obligations, resolve disputes, maintain security and audit records, and enforce agreements.

Retention periods vary by data type, customer configuration, legal requirements, backup cycles, and operational needs. When information is no longer required, Datamond will delete, destroy, anonymize, or de-identify it in accordance with applicable requirements and internal procedures.

Deletion from active systems may not immediately remove information from encrypted backups or logs. Such information may remain until the applicable backup or retention cycle expires and generally will not be restored except for disaster recovery, security, or legal purposes.

15. Accuracy of Personal Information

Datamond takes reasonable steps to keep personal information as accurate, complete, and up to date as necessary for the purposes for which it is used. Users and customers are responsible for maintaining accurate account information and may request correction of personal information as described below.

16. Your Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have rights concerning your personal information, including the right to:

• Know whether we process your personal information and obtain information about its use and disclosure;

• Request access to or a copy of personal information;

• Request correction of inaccurate or incomplete information; Request deletion or erasure;

• Request restriction of or object to certain processing;

• Request data portability where applicable; Withdraw consent where processing relies on consent;

• Opt out of certain targeted advertising, sale, sharing, or profiling where applicable;

• Request information or exercise rights concerning certain automated decisions where applicable; and

• Complain to Datamond or an applicable privacy/data-protection regulator.

Rights are not absolute. We may need to verify identity and authority before acting on a request, and we may deny or limit a request where permitted by law. If Datamond processes information solely on behalf of a business customer, we may refer the request to that customer.

To exercise a privacy right, contact us using Section 23. We will respond within the timeframe required by applicable law.

17. Canadian Privacy Rights and Accountability

Datamond is a Canadian organization and seeks to handle personal information in accordance with applicable Canadian private-sector privacy requirements, including principles of accountability, identified purposes, meaningful consent where required, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and mechanisms to challenge compliance.

Datamond designates a Privacy Officer responsible for privacy compliance within the organization. Questions, access requests, and privacy complaints may be directed to the Privacy Officer using the contact information in Section 23. Individuals may also have the right to complain to the Office of the Privacy Commissioner of Canada or an applicable provincial privacy regulator.

18. Additional Rights for EEA, UK, and Other Jurisdictions

Where the GDPR, UK GDPR, or similar laws apply, individuals may have additional rights such as access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and rights concerning certain solely automated decisions. Individuals may also lodge a complaint with the data-protection authority in their country or region.

Where required, Datamond will identify the applicable legal basis for processing and implement appropriate safeguards for restricted international transfers.

19. U.S. State Privacy Disclosures

Residents of certain U.S. states may have privacy rights under state law, subject to applicability thresholds, exemptions, and exceptions. These may include rights to know/access, correct, delete, obtain a portable copy, opt out of certain sales, sharing, targeted advertising or profiling, and appeal a denied request.

Datamond does not sell personal information for monetary consideration. If Datamond engages in an activity that applicable U.S. state law defines more broadly as a "sale" or "sharing," Datamond will provide any legally required notice and opt-out mechanism.

Datamond will not unlawfully discriminate against an individual for exercising applicable privacy rights.

20. Marketing Communications

Where permitted by law, we may send product news, offers, event information, or other marketing communications. You may unsubscribe using the mechanism provided in the message or by contacting us. Service, security, billing, and other transactional communications may continue where necessary to operate the account or Services.

21. Children's Privacy

The Services are intended for business and professional use and are not directed to children. Datamond does not knowingly collect personal information directly from children for their own use of the Services. If we learn that personal information was collected from a child in circumstances requiring parental consent and such consent was not obtained, we will take appropriate steps as required by law.

Business customers may submit records that incidentally contain information about minors (for example, certain payroll, benefits, or business records). In those circumstances, the customer is responsible for ensuring it has authority to provide that information.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Services, technology, legal requirements, vendors, or privacy practices. We will post the revised Policy with a new “Last Updated” date. Where required by law, we will provide additional notice or obtain consent for material changes that introduce new purposes or materially different processing.

We encourage users to review this Policy periodically.

23. Contact Us and Privacy Complaints

Datamond System Inc.

3600 Steeles Ave. E., Markham, Ontario, Canada L3R 9Z7

Privacy Officer / Privacy inquiries and requests: contact@quaimax.com

Please include sufficient information for us to understand and respond to your request. Do not send passwords, full payment-card numbers, or unnecessary sensitive information by email.

If you are not satisfied with Datamond's response, you may have the right to submit a complaint to the privacy or data-protection authority with jurisdiction over your matter.

24. Related Customer Agreements

This Privacy Policy should be read together with the applicable QuaiMax Terms of Service, customer agreement, Data Processing Addendum (if any), security documentation, cookie notice, and other notices presented when information is collected. If a customer agreement contains specific data-processing terms, those terms may govern the processing covered by that agreement.