Legal

Privacy Policy

Version v3.0 · Effective 2026-09-30

Who We Are and What This Policy Covers

M2xDigital Inc. ("M2xDigital," "we") builds and operates software and provides technology services for businesses. This Privacy Policy covers personal information handled across our: • Website: m2xdigital.ca, including its contact form (Section 4); • M2 Mavn: our software platform for contracting businesses at m2mavn.com, including its client portal and mobile app (Sections 6–10), and future software products we release, which this policy will cover as updated; • Software licensing and resold products: subscriptions we resell as an authorized reseller (Section 11); • Managed website and application services: sites and apps we build and host for clients (Section 12). Find your section: • a visitor to our website — Section 4. • A contractor using M2 Mavn — Sections 5–10. • A contractor's client or worker (including portal users) — Sections 6–8. • A licensing or managed-services customer — Sections 11–12. • Everyone — Sections 13–19 (sharing, cookies, cross-border, retention, rights, security, contact). A distinction runs through this policy: for our own website, customer accounts, billing, and portal login identities, we decide how data is used (we are the "controller"). For information inside services we run on a customer's behalf, such as a contractor's client records in M2 Mavn, or end-user data on a website we host for a client, we process it under the customer's instructions (we are a "service provider" or "processor"), governed by our Data Processing Addendum with that customer.

What We Do Not Do

Across everything we operate: we do not sell personal information; we do not share it for cross-context behavioural advertising or targeted advertising; we do not use customer or client data for our own marketing or to train AI models; and we use no advertising cookies or cross-site tracking.

Our Contact Details and Privacy Officer

Privacy compliance at M2xDigital is the direct responsibility of our founders. Our Privacy Officer, the individual accountable for our compliance with privacy law, including under PIPEDA, and the person in charge of the protection of personal information under Quebec's private-sector privacy law, can be reached at [email protected]. Direct privacy questions, requests, and complaints there; we respond within the time applicable law requires. You also have the right to complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator, and for M2 Mavn matters in the United States to your state attorney general.

Our Website (m2xdigital.ca)

4.1 The Contact Form If you use our contact form, we collect what you enter: your name and email (required), phone and company (optional), the services you are interested in, your rough timeline and budget (selected from lists), and your message. Please do not include sensitive personal information in the message field. Your submission is delivered to us as an email (via Amazon SES) to our business inbox (Google Workspace), which is the only place it is stored, the website itself keeps no copy. We use it to respond to your inquiry and for follow-up about the services you asked about; you are not added to any mailing list without separate consent. We keep submissions for up to 24 months from our last exchange with you, then delete them, unless you become a client (your information then moves under our client records).

4.2 Spam and Abuse Prevention The form is protected by Cloudflare Turnstile, which checks your browser for signs of automation and receives your IP address and browser signals for that purpose. We also use your IP address transiently to rate-limit submissions; it is not stored with your submission and does not appear in the email we receive.

4.3 Website Analytics We use Google Analytics 4 to understand how the site is used. Analytics loads only after you click Accept on the cookie banner, until then, nothing loads from Google Analytics and no analytics data is collected. If you accept, Google Analytics sets cookies and collects page views, approximate location, and device information under pseudonymous identifiers; ad features and ad personalization are turned off. Your choice is remembered for 365 days, and you can change it any time via the "Cookie settings" link in the site footer.

4.4 Website Infrastructure The site is served through Amazon Web Services (Amplify hosting and the CloudFront content delivery network), which, like any web host, processes every visitor's IP address, browser details, and requested pages to deliver the site and maintain security. Self-hosted fonts mean your browser makes no request to Google Fonts.

4.5 Links to Other Sites The site links to other destinations with their own privacy practices, which this policy does not cover, including m2mavn.com, vendor sites for products we resell, and client sites we showcase.

Our Customers' Account Information (All Offerings)

For businesses that buy from us, an M2 Mavn subscription, resold licences, or managed services, we collect and control: contact and account details (names, emails, phones, roles), business details, billing information and history (card details are collected and stored by Stripe for M2 Mavn subscriptions; other billing is invoiced), support communications, and records of orders and agreements. We use these to provide and bill the services, support you, meet legal obligations, and send service communications.

M2 Mavn — If a Contractor Sent You an Estimate or Invoice

• Your contractor entered your contact details into M2 Mavn to prepare your documents. They are responsible for that information; we store and process it on their behalf. • When you sign an estimate or change order electronically, on a link or in the portal, we record your name, email, drawn signature, date and time, IP address, and browser information, as evidence of the agreement, for both you and your contractor. The signing page tells you this and that your electronic signature is binding. • When you open an invoice or estimate link, the system records that it was viewed, and your contractor can see that (and may receive it in systems they connect). • Card payments happen on Stripe-hosted pages, we never see or store your card number. • Emails and texts about your project (including reminders and, after payment, a request to review your contractor) are sent at your contractor's instruction and on their behalf. Texts honour STOP; non-essential emails include an unsubscribe link. • To access, correct, or delete your information, contact your contractor, they control it and we will help them respond. You can also reach us at [[email protected]] and we will route your request.

M2 Mavn — The Client Portal; Calls, Texts, and Chat

Portal: if your contractor invites you, you create a sign-in with our identity provider (Clerk), that login is yours, and one login can hold access at more than one contractor. We manage the login identity (email, name, sign-in methods, sessions, device and IP information) as controller; everything you see and do in the portal about your project, documents, signatures, payments, message threads, is processed on your contractor's behalf. Invitations are single-use and expire after 7 days; sessions last up to 30 days. Messages are visible to your contractor's team and may be forwarded to systems they connect. The Portal Terms & Privacy Notice, presented at sign-up, governs your portal use. • Calls: calls to a contractor's tracking number may be recorded (including voicemail) and transcribed, the greeting discloses this and call records include your number, the number called, and duration; • Texts: we log messages and delivery status; reply STOP to stop texts to your number across the platform; • Website chat: a contractor's site chat assistant is an AI agent; conversations are stored, processed by our AI provider to generate responses, and may create a lead record for the contractor. It cannot quote prices or book appointments.

M2 Mavn — Contractors, Teams, and Workers

• Account and identity: name, email, phone, profile photo (stored with us and Clerk), sign-in methods and sessions (held by Clerk, we never store passwords), optional MFA factors (encrypted), notification and analytics preferences; • Business details: name, trade, contact details, logo, billing address, tax settings, review-page links; integration credentials (encrypted tokens for Google Calendar and QuickBooks connections you authorize); • Client and project records processed on the contractor's behalf: contacts, addresses (often home addresses, with map coordinates), estimates, change orders, jobs, tasks, invoices, payment references (never card numbers), notes, e-signature evidence, view timestamps, portal messages, chat transcripts, call recordings and transcripts, text logs, lead records, and copies of emails the platform sends on the contractor's behalf (kept in a send log for troubleshooting and accountability); • Workers: time entries with cost/billing rates and, only when the employer enables geofenced clock-in, a single GPS fix at clock-in (location, accuracy, distance from the job site). Not continuous tracking. Your employer is responsible for workplace-monitoring notices and lawful use; • Usage, security, and audit records, including IP addresses (stripped from audit logs after 90 days).

M2 Mavn — AI Features

Parts of M2 Mavn use large language models from a third-party AI provider configured at the platform level (currently Anthropic / OpenAI). When a contractor uses an AI feature, the relevant content, a question and the account records needed to answer it, a document being drafted, a receipt photo being read, a website-chat conversation, is sent to that provider to generate the response. Under our provider's API terms, customer content is not used to train its models, and inputs may be retained by the provider for a limited period for abuse monitoring. Assistant conversations are stored in the contractor's account. One feature, Work Finder, searches the public web (via the provider's hosted search) for publicly posted requests for contracting services and shows contractors matching posts, including the poster's posted name, location, and a link to the original post. We collect this from public sources; we do not contact posters ourselves, and contractors who respond must follow the source site's rules and applicable law. If you believe your post has been surfaced and want it removed from results, contact [[email protected]].

M2 Mavn — App Analytics

In the M2 Mavn application, analytics (Google Analytics 4) works in two modes: on public and portal pages, sign-in and sign-up, invite links, public estimate and change-order pages, the client portal, and website chat, analytics is off by default and runs only with your consent; for signed-in contractor customers, analytics is on by default as disclosed in the Terms of Service, with a per-user opt-out in settings, a control we provide in line with Quebec's Law 25.

Resold Software and Licensing

When you buy third-party software subscriptions through us (for example, cybersecurity or cloud products), we collect and use your business contact, domain or tenant, seat, and billing information to quote, provision, renew, and support your subscriptions, and we share it for those purposes with our distribution partner (currently Pax8) and the product's vendor (for example, Sophos). Your use of the product itself, and the vendor's handling of the data inside it, is governed by the vendor's own terms and privacy policy, which the vendor presents to you. Our customer billing and licensing portal is operated for us on a third-party platform; its sign-in and use are subject to that platform's practices alongside this policy.

Managed Website and Application Services

For clients whose websites or applications we build and host: your own account and billing information is handled per Section 5. The data inside your site or application, your content and your end users' personal information (form submissions, accounts, analytics, transactions), is yours: we process it as your service provider under our Data Processing Addendum and your statement of work, we access it only to operate and support your service, and you are responsible for your own site's privacy notice to your users. This policy does not replace that notice.

How We Use Information

• To provide the services described above, and to bill, support, and secure them (authentication, fraud and abuse prevention, audit logging, debugging); • To respond to inquiries and administer orders, licensing, and renewals; • To improve our services using aggregated or de-identified information; • To meet legal obligations and enforce our agreements.

How We Share Information

With service providers under contracts limiting what they can do: Amazon Web Services (website hosting and delivery; email; SMS where configured), Google Workspace (our business inbox, where website inquiries are stored), Cloudflare (security, bot protection, delivery network), Google (analytics per Sections 4 and 10; address lookup and geocoding in M2 Mavn), Clerk (identity), Stripe (payments and billing), Replit (M2 Mavn hosting and file storage on Google Cloud), Supabase (database), Twilio (texts, call tracking, recording, transcription), our AI provider (Section 9), Expo (mobile push), and Slack (our internal operational alerts). The current subprocessor list for services under our DPA, with locations. At the customer's direction: M2 Mavn contractors can connect QuickBooks, push jobs to their team's Google calendars, and register webhooks or automations that deliver event data to systems they choose, those recipients act for the contractor. For resold products: with Pax8 and the product vendor, per Section 11. Otherwise, only: professional advisers under confidentiality; authorities where required by law (with notice to the affected customer where permitted); and a successor in a merger or asset sale, with this policy continuing to apply.

• Strictly necessary: sign-in session cookies (Clerk, in M2 Mavn), security and bot-protection signals (Cloudflare Turnstile and bot detection), and application storage, required for the services to work; • Analytics: consent-based on the website and on M2 Mavn's public and portal pages, and default-on with opt-out for signed-in M2 Mavn customers (Sections 4.3 and 10). Consent choices are stored in a first-party cookie for 365 days and can be changed via the "Cookie settings" link; • No advertising cookies, no cross-site tracking. Cloudflare Web Analytics on the app.

Where Information Is Stored; Cross-Border Transfers

Our services and service providers process data in Canada, the United States and on global infrastructure: website inquiries are delivered through US email infrastructure and stored in our Google Workspace inbox; M2 Mavn is hosted in the Canada; and our providers (including AWS, Google, Cloudflare, Stripe, Clerk, and Twilio) are US-based or operate globally. If you are in Canada, personal information you provide, or that is handled through services we run, may be transferred to and stored in the United States, where it may be accessible to US authorities under US law. We protect transfers through contracts with our providers and the safeguards in this policy. Use of our services involves communication of personal information outside Quebec.

How Long We Keep Information

We keep personal information only as long as needed: website contact submissions up to 24 months (Section 4.1); customer account and billing records for the relationship plus legal retention periods; and, in M2 Mavn, audit logs 24 months (IPs removed after 90 days), application logs 14 days, email send logs 12 months, call recordings, transcripts, texts, and chat transcripts 12 months, webhook and automation records 90 days, encrypted backups on a 7-day cycle, and account data for the life of the account plus a 30 day deletion grace period, with invoice/payment records and e-signature evidence kept 7 years (tax rules and proof of signed agreements). M2 Mavn customers can export their data at any time and delete their account themselves.

Your Rights and Choices

Everyone: you may request access to or correction of personal information we hold about you, and withdraw consents where processing rests on consent. We respond within the time applicable law requires (30 days under PIPEDA) and never discriminate for exercising rights. Where we hold data as someone else's service provider, a contractor's records in M2 Mavn, or end-user data on a client's site, direct your request to that business, and we will assist them; if you contact us, we will acknowledge and route it. Canada: access and correction rights under PIPEDA and substantially similar provincial laws, and complaint to the OPC or your provincial regulator (Section 3). Quebec residents additionally have data portability, the right to be informed of and deactivate tracking technology (Sections 4.3, 10, 15), and complaint to the Commission d'accès à l'information. United States: depending on your state, rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of sale, sharing, or targeted advertising, none of which we do (Section 2). Exercise rights, or appeal a decision, at [[email protected]]; we will explain any appeal outcome and how to contact your state attorney general.

Security; Staff Access; Children; Changes

We use safeguards appropriate to the data's sensitivity: TLS in transit and encryption at rest; managed sign-in with optional MFA; strict separation of each customer's data; card entry handled only by Stripe; unguessable tokens on public document links and hashed, expiring portal tokens; signed webhooks with destination validation; audit logging; encrypted nightly backups kept 7 days; input validation, security headers, and bot protection on our website; and confidentiality obligations for personnel. Authorized staff can access customer data, including, in M2 Mavn, the log of emails the platform sends, for support, security, billing, privacy-request fulfilment, and legal compliance, and may use time-limited, read-only, fully logged account impersonation to reproduce support issues. If a breach creates a real risk of significant harm, we will notify affected customers and regulators as the law requires.

Our services are business tools, not directed at children, and we do not knowingly collect personal information from anyone under 18 as a user; contact [[email protected]] for deletion. If we make a material change to this policy, we will post the update and notify customers by email or in-app notice at least 15 days before it takes effect; prior versions are available on request.