Privacy Policy

1. Who we are and what this policy covers

MomentumOS Inc. (“we”, “us”) operates MomentumOS, a marketing platform for local businesses. This policy explains how we collect, use, share and protect personal information, in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). It covers:

• Visitors to www.momentumos.ca;
• Clients: the businesses that subscribe to MomentumOS, and their staff users;
• Clients' customers: people who interact with a client through MomentumOS, for example by receiving a review check-in, using a client's Webchat-to-SMS widget, calling a client's landline, or messaging a client through Google or WhatsApp.

2. Our role

For visitors and clients, we decide how personal information is used and are responsible for it. For clients' customers, the client business is responsible for the information, and we process it on the client's behalf and on its instructions, as its service provider.

If you are a client's customer with a question about your information, you can contact that business directly, or contact us and we will pass your request on and help them respond.

3. What we collect

From website visitors

When you request a trial: your name, business name, email, business phone number and the type of line it is, website, whether you have a verified Google Business Profile, and anything you write in the form. Our web server also records standard technical information such as IP address, browser type and the pages requested.

From clients

Business details (legal name, address, phone, website, hours and categories), account and billing contacts, staff user names and sign-in details, the information needed to register your number for business messaging, and payment information. Payment card details are collected and stored by our payment processor.

About clients' customers

• name, mobile number and, where provided, email;
• job details logged through the Job Done (Job Completion) form, such as the service provided and its date;
• questions submitted through Webchat-to-SMS, with the visitor's name and mobile number;
• appointment bookings and quote-form answers submitted on a client's Velocity website;
• the phone numbers of callers whose calls are missed, where the client uses Missed Call Text-Back;
• message content and history across text, Google profile chat and WhatsApp, including photos and files; and
• delivery status, review-link clicks, opt-out status, and tags describing how the contact arrived.

We do not ask for, and clients must not enter, sensitive information such as health details in job logs or messages.

4. How we use it

• to assess eligibility, set up and run the services, and support clients;
• to send the messages a client's account is configured to send, and deliver replies to the client's inbox;
• to register business numbers with messaging providers and carriers;
• to bill clients and keep business records; and
• to secure and improve the platform, prevent misuse and comply with the law.

We do not sell or rent personal information, and we never use clients' customer information to market our own services.

5. Business messaging registration (A2P 10DLC)

To send application-to-person (A2P) text messages from a client's business landline, our messaging provider enables Hosted SMS on that number: the number's text messaging route is updated in the NetNumber (NNID) registry, while voice calls stay with the client's carrier. Every number that sends automated check-ins or review requests is registered on The Campaign Registry (TCR) under a verified Brand and Campaign profile (A2P 10DLC).

For this we share the client's legal business name, physical service address, phone numbers, website and 9-digit CRA Business Number (or Federal Tax ID); a contact person's name, email and phone number; a description of how messages are used; and sample messages. The client signs a letter of authorization confirming that it owns or controls the number and answers a verification call to it, and may provide a recent bill; our messaging provider and the client's voice carrier use these to verify the request. Registration concerns the client business; it does not involve sharing the client's customer list. More detail is on our Hosted SMS page.

6. Consent for text messages

• Webchat-to-SMS. A visitor who enters their mobile number and question in a client's widget is asking to be contacted, and consents to receive text replies about that inquiry. The widget says so before they send.
• Job Done (Job Completion) forms. A client logs a customer after completing work for them. The client confirms it has an existing business relationship with the customer and the consent CASL requires to send the check-in, the review invitation and one reminder. Each message identifies the business and explains how to opt out.
• Velocity booking and quote forms. A visitor who books an appointment or requests a quote on a client's website ticks a consent box, linked to the client's privacy policy, before submitting, and is asking to be contacted about that booking or request, including the confirmation and reminder messages.
• Missed Call Text-Back, Google profile chat and WhatsApp. These texts reply to the customer's own call or message.
• Clients' customers are never added to our own marketing lists.

7. Opting out: STOP and ARRET

Every automated message sequence supports these bilingual keywords:

• Replying STOP or ARRET to a client's number stops further messages from that client's account. Other common opt-out words, such as UNSUBSCRIBE, CANCEL and END, are recognised too.
• We send one confirmation reply, in English for STOP and in French for ARRET, and nothing further.
• The number is added to that client's suppression list straight away, so automated sequences skip it. Opt-outs are processed automatically and immediately, and in every case within the 10 business days CASL allows.
• A customer who has opted out receives no further messages from that client's account unless they opt back in by replying START or UNSTOP, or give new consent.
• Replying HELP or AIDE returns a help message.
• To stop email from us, use the unsubscribe link in the email or contact us.

8. Who we share it with

We share personal information only as needed to provide the services, with:

• the software platform that powers MomentumOS, which hosts client accounts, contacts and conversations;
• messaging providers and telecommunications carriers, to deliver texts and register numbers;
• Google, to connect a client's Business Profile, read and reply to reviews, and support the Chat option;
• Meta, for clients who use the WhatsApp Business API or Social Lead Syndication & Auto-DM;
• Google or Microsoft, when a Velocity client connects its calendar for online booking;
• AI service providers, for clients who use the AI Web Booking Assistant, to generate replies to their customers' questions;
• directory publishers, which receive the client's business details (not its customers' information) through Listings Management;
• our payment processor; and
• our professional advisers, and authorities where the law requires it.

These providers may use the information only to provide their services, under their own privacy and security obligations.

No mobile information will be shared with third parties/affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services (e.g., customer service) is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

9. Where information is stored

Some of our service providers store or process information outside Canada, including in the United States. Information held there is protected by contractual and technical safeguards, but may be accessible to courts and authorities under the laws of those countries.

10. How long we keep it

We keep personal information for as long as it is needed for the purposes above: client and customer records for the life of the client's subscription, and billing records for as long as tax law requires. Opt-out (suppression) records are kept as long as needed to keep honouring the opt-out. After a client cancels, we delete or anonymize its customers' information within a reasonable period, unless the law requires us to keep it.

11. Security

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including access controls on client accounts and encrypted connections. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the people affected and the Privacy Commissioner of Canada as the law requires.

12. Your choices and rights

You can ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent, subject to legal and contractual limits. We respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

13. This website

www.momentumos.ca does not use analytics, advertising or tracking cookies. Our pages load fonts from Google Fonts, so your browser sends Google your IP address when you visit. The Webchat-to-SMS and Review Showcase widgets on our clients' websites are also covered by those clients' own privacy policies.

14. Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we will tell clients about material changes by email.

15. Contact our Privacy Officer

For privacy questions, access or correction requests, or to withdraw consent: