Privacy policy

CanoeUX respects your privacy. This policy explains what information we collect through this website, why we collect it, and the choices you have. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Who we are

CanoeUX is an independent technology consultancy based in Toronto, Ontario, Canada. In this policy, “we”, “us” and “our” refer to CanoeUX.

Information we collect

We collect only the information you choose to give us through our contact form:

• Required: your name, work email address, company or organization, the services you're interested in, your project stage, a description of your challenge or desired outcome, and your consent to be contacted.
• Optional: your role, company size, industry, approximate timeline, budget range and any additional details you decide to share.

Please don't include sensitive personal information (such as health or financial details about individuals) in the form. We don't need it to respond.

How we use your information

We use the information you provide to:

• read and respond to your enquiry;
• arrange and prepare for a conversation with you;
• understand your needs so we can suggest a relevant next step or proposal.

We don't sell your information, and we don't add you to marketing lists without your separate, explicit consent.

Consent

By submitting the contact form and ticking the consent box, you agree to our use of your information as described here. You can withdraw your consent at any time by contacting us; we will then stop using your information, except where we are required by law to keep it.

Cookies, analytics and tracking

This website doesn't use analytics, advertising pixels or tracking cookies. To avoid replaying a brief logo animation on every page, the site stores a single, non-identifying flag in your browser's session storage. It contains no personal information and is cleared when you close the browser tab.

Like most websites, our hosting provider may automatically process technical information (such as IP address, browser type and request times) to deliver the site securely and reliably and to protect it from abuse. To limit repeated automated submissions, our contact form uses a one-way hash of your IP address for a short period; the address itself isn't stored by us.

Service providers

We use trusted service providers to host this website and to deliver contact form submissions to our team. The site and its contact form run on Microsoft Azure. Form submissions are processed by Azure services that may be located in the United States, and enquiries we store are kept in Microsoft's Canada Central region. We may also use email or workflow services to notify our team. These providers may only process your information on our behalf and for these purposes, and must protect it. Information processed outside Canada may be subject to the laws of that jurisdiction.

Retention

We keep enquiry information only for as long as needed to respond to you and manage any resulting relationship, or as required by law. Copies of enquiries stored by our website are deleted automatically after one year. When information is no longer needed, we securely delete or anonymize it.

Security

We protect your information with reasonable safeguards appropriate to its sensitivity, including encrypted connections (HTTPS), server-side validation and access restricted to the people who need it. No method of transmission or storage is completely secure, but we work to protect your information and review our practices regularly.

Your rights

You can ask to access the personal information we hold about you, ask us to correct it, or withdraw your consent. We will respond within the time required by law, which is normally 30 days. To make a request, use our contact form, select “Something else” and mention that your message is a privacy request.

If you're not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (opens in a new tab).

Children

This website is intended for business audiences and isn't directed at children.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised.