Privacy Policy

Contact forms and inbound messages

To receive inquiries, check whether the project is a fit, respond to requests, prevent spam or abuse, and keep records of business communications.

Booking and scheduling

To schedule calls, send calendar details and reminders, prepare for meetings, and connect the request to the right business context.

Attribution and analytics

To understand which pages, campaigns, referrers, and search or social parameters led to an inquiry, using limited first-party and analytics data.

AI-assisted scoping

To summarize requirements, identify workflow patterns, estimate effort, draft implementation notes, and prepare practical recommendations.

Call notes and transcripts

To create accurate notes, confirm requirements, reduce rework, and maintain an accountable project record where transcription is enabled or provided.

Email follow-up

To send requested information, proposals, reminders, project updates, handoff materials, and support responses.

Delivery workflows

To design, build, test, hand off, support, and improve client-approved automation workflows using the tools needed for the engagement.

Anthropic, PBC

Purpose: AI-assisted scoping, summarization, and delivery work on engagements where Anthropic's Claude is used for the project.

Data accessed: Engagement-context text, scoping prompts, and project material submitted through AI-assisted workflows during paid engagements. No long-term storage by Ottawa Automates of the AI request payload itself.

Processing location: United States. Anthropic operates from US infrastructure, so any text submitted to the AI workflow leaves Canada when this provider is active.

Vendor privacy notice

OpenAI, L.L.C.

Purpose: AI-assisted scoping, summarization, and delivery work on engagements where OpenAI is used for the project.

Data accessed: Engagement-context text, scoping prompts, and project material submitted through AI-assisted workflows during paid engagements. The AI provider is selected per engagement, so either Anthropic or OpenAI may handle the submitted text for a given project.

Processing location: United States. OpenAI operates from US infrastructure, so any text submitted to the AI workflow leaves Canada when this provider is active.

Vendor privacy notice

Selected per engagement (e.g., Zoom, Google Meet, or Microsoft Teams built-in transcription)

Purpose: Generate accurate notes and call records when transcription is enabled for a paid engagement.

Data accessed: Audio, video, and resulting transcript text from meetings where the client has agreed in advance to transcription. Consent and the named tool are confirmed in the engagement agreement before recording.

Processing location: Depends on the meeting platform used for the engagement. The specific transcription tool, its processing location, and its retention rules are named in the engagement scope before recording begins.

Cal.com, Inc.

Purpose: Schedule fit calls, scoping calls, and follow-up meetings, including reminder emails and calendar events tied to those bookings.

Data accessed: Name, email, time zone, selected meeting time, and any context fields submitted through the Cal.com booking form.

Processing location: United States and global edge infrastructure operated by Cal.com. Booking data leaves Canada when bookings are created or managed.

Vendor privacy notice

Conva Ventures Inc.

Purpose: Privacy-first traffic and page-performance measurement that does not rely on cookies or cross-site identifiers.

Data accessed: Aggregated and anonymized page-view, referrer, and basic device metadata. Fathom does not build cross-site visitor profiles.

Processing location: Canada and the European Union. Fathom is Canadian-owned and processes events from EU-located infrastructure as described in their privacy documentation.

Vendor privacy notice

Microsoft Corporation

Purpose: Session-replay diagnostics for usability and to understand where visitors get stuck before booking. Full disclosure, including data captured and opt-out path, is in the Cookies And Similar Technologies section of this policy.

Data accessed: Session-replay events, masked form input, and aggregated interaction data. See the Cookies And Similar Technologies section for the full disclosure.

Processing location: United States.

Vendor privacy notice

Google LLC

Purpose: Traffic, attribution, and campaign measurement. Full disclosure, including data captured, retention window, and opt-out path, is in the Cookies And Similar Technologies section of this policy.

Data accessed: Page views, referrers, UTM and click identifiers, approximate IP-derived location, and device metadata. See the Cookies And Similar Technologies section for the full disclosure.

Processing location: United States.

Vendor privacy notice

Google LLC

Purpose: Loads and manages the consent-gated measurement tags that run on the site, such as Google Analytics. Tags only fire when the visitor's stored consent and active Do Not Track or Global Privacy Control signals allow them to.

Data accessed: The Tag Manager container script itself reads the visitor's Google Consent Mode v2 signals (ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage, security_storage) and decides which downstream tags may fire. Individual tags then collect the data described in their own entries in this policy.

Processing location: United States. Google Tag Manager is operated by Google from US infrastructure, so the container request and tag execution metadata leave Canada when this tool is loaded.

Vendor privacy notice

Cloudflare, Inc.

Purpose: Static site hosting and edge delivery for the public website and its serverless functions.

Data accessed: HTTP request metadata, IP addresses processed for delivery and security, and any content sent through site endpoints.

Processing location: Global edge operated by Cloudflare; the company is headquartered in the United States.

Vendor privacy notice

Selected per engagement (e.g., Stripe, Interac e-Transfer, or invoice billing as named in the engagement letter)

Purpose: Process payment for engaged work. Ottawa Automates does not take payment site-side; the payment tool is named in the signed engagement agreement.

Data accessed: Payment instrument details handled directly by the chosen payment provider, plus invoice metadata kept by Ottawa Automates for tax recordkeeping.

Processing location: Depends on the payment tool selected for the engagement. The payment provider and its country of processing are named in the engagement letter before any payment is taken.

Microsoft Clarity

Microsoft Corporation · United States

Purpose. Diagnose usability issues, see where visitors get stuck, and improve page layout, copy, and the path to booking a call.

What it captures. Session replay recordings of mouse movement, clicks, taps, scrolls, page interactions, and form interactions. Clarity starts in cookieless denied mode, then uses analytics cookies only if you allow Analytics. Clarity automatically masks the content of form input fields by default, but the surrounding session is still recorded.

Cross-border processing. United States. Clarity is operated by Microsoft from US infrastructure, so visitor interaction data leaves Canada when this tool is loaded.

Retention. Recordings and aggregated metrics are stored and retained by Microsoft under Microsoft's own terms and Clarity's data retention rules, not by Ottawa Automates directly.

Consent behavior. Starts without analytics or ad cookies. Analytics cookies are used only if you allow Analytics.

Opt out. Microsoft privacy controls and Clarity opt-out information .

Google Analytics

Google LLC · United States

Purpose. Measure traffic sources, page performance, campaign attribution, and aggregate visitor behavior across the site.

What it captures. Page views, referrers, UTM and click identifiers, approximate location derived from IP, device and browser metadata, and aggregated event data. IP addresses are processed by Google as part of event collection.

Cross-border processing. United States. Google Analytics 4 is operated by Google from US infrastructure, so analytics events leave Canada when this tool is loaded.

Retention. Event and user data are stored and retained by Google under Google's own terms and the GA4 retention window chosen for this site, not by Ottawa Automates directly.

Opt out. Google Analytics opt-out browser add-on .

Analytics

Measures traffic sources, page performance, and aggregate visitor behavior so Ottawa Automates can see what is working on the site and where visitors get stuck. When this category is off, no analytics or session-replay tags fire.

Example tags. Google Analytics, Microsoft Clarity (loaded through Google Tag Manager).

Ads

Allows ad measurement and remarketing tags to read or write the cookies they need to attribute a campaign and to retarget visitors. When this category is off, ad storage, ad user data, and ad personalization are all denied.

Example tags. Google Ads conversion and remarketing tags (loaded through Google Tag Manager when active).

Consent and reasonable purposes

Ottawa Automates collects, uses, and discloses personal information for identified business purposes with consent where required, subject to legal exceptions.

Limiting collection

Information requests are limited to what is needed to understand, scope, schedule, deliver, support, and protect the relevant work.

Retention

Records are kept only as long as needed for the stated purposes, legal or accounting requirements, dispute handling, security, and reasonable business continuity.

Safeguards

Administrative, technical, and vendor-access controls are applied based on the sensitivity of the information and the systems involved.

Access and correction

Individuals may request access to, or correction of, their personal information, subject to identity verification and lawful limits.

Questions and complaints

Privacy questions, access requests, correction requests, consent withdrawals, and complaints can be sent to the accountable privacy contact.

Service providers and cross-border handling

Personal information may be handled by booking, analytics, hosting, AI, transcription, payment, or delivery-tool providers in Canada or other jurisdictions.

Contact identifiers (name, email, phone, organization, role)

Up to 7 years from the end of the engagement for clients; 24 months for people who did not become clients.

Why this period. Client contact identifiers are tied to invoiced engagements, so CRA Income Tax Act s.230 recordkeeping applies. Ottawa Automates keeps them for up to seven years to cover tax records and practical dispute timing. Records from people who have not become clients are kept only as long as needed to follow up under PIPEDA Principle 4.5.

People who did not become clients. Deleted or anonymized 24 months after the last meaningful interaction if the person has not become a client.

Business context (workflow problems, budget, timeline, tooling, constraints)

Up to 7 years from the end of the engagement for clients; 24 months for people who did not become clients.

Why this period. When business context becomes part of a delivered engagement, it is part of the project record retained for CRA recordkeeping under Income Tax Act s.230. When it belongs to someone who did not become a client, Ottawa Automates keeps it only for a limited follow-up period under PIPEDA Principle 4.5.

People who did not become clients. Deleted or anonymized 24 months after the last meaningful interaction if the person has not become a client.

Booking metadata (meeting time, calendar details, attendance, scheduling notes)

Up to 7 years for booking metadata tied to a client engagement; 24 months for booked calls that did not lead to an engagement.

Why this period. Booking records that become part of a paid engagement may be needed for CRA recordkeeping under Income Tax Act s.230. Booking records that do not lead to an engagement are kept only for a limited follow-up period under PIPEDA Principle 4.5.

People who did not become clients. Deleted or anonymized 24 months after the booking date if the person who booked a call did not become a client.

Device, page, referrer, campaign, and analytics attribution

Up to 14 months, matching the GA4 retention window chosen for this site.

Why this period. Device attribution data is used for site and campaign measurement, so Ottawa Automates keeps it for a short period under PIPEDA Principle 4.5. The 14-month limit follows the GA4 retention window chosen for this site and avoids keeping attribution data longer than analysis requires.

Communications (emails, form submissions, call notes, voicemail, chat, meeting summaries)

Up to 7 years for communications tied to a client engagement; 24 months for messages from people who did not become clients.

Why this period. Communications that document client work are part of the engagement record retained for CRA recordkeeping under Income Tax Act s.230 and ordinary dispute-handling needs. Messages from people who did not become clients are kept only for a limited follow-up period under PIPEDA Principle 4.5.

People who did not become clients. Deleted or anonymized 24 months after the last meaningful interaction if the sender did not become a client.

Project delivery records (requirements, test notes, handoff materials, support history, invoices, approved workflow documentation)

At least 7 years from the end of the engagement, including all invoices and tax-relevant records.

Why this period. Invoices and project delivery records are tax-relevant and fall under CRA Income Tax Act s.230, which requires at least six years of retention from the end of the last tax year a record relates to. Ottawa Automates keeps these records for at least seven years to cover tax records and practical dispute timing.

Notice to affected individuals

Ottawa Automates will notify affected individuals as soon as feasible where a breach of security safeguards creates a real risk of significant harm, with enough information for those individuals to understand the significance of the breach and reduce or mitigate the risk.

Report to the Privacy Commissioner

Ottawa Automates will report qualifying breaches to the Office of the Privacy Commissioner of Canada (OPC) using the form and process required by PIPEDA s.10.1, and will notify any other organization or government institution that can help reduce or mitigate the risk to affected individuals.

Record of breaches

Ottawa Automates keeps a record of every breach of security safeguards involving personal information under its control, regardless of whether the real-risk-of-significant-harm threshold is met, and retains those records for at least 24 months from the date the breach was determined, in line with the Office of the Privacy Commissioner of Canada's guidance.