1. Who we are and who to contact
Pinlight is a web design studio run by Cameron Zic in Ottawa, Ontario, serving clients across Canada. Phone: 613-858-8104.
Person in charge of protecting personal information: Cameron Zic, Owner and privacy officer. Email: [email protected]. You can write to this person about anything in this policy, including access, correction, deletion and complaints.
This policy applies to this website and to the personal information we handle when you contact us, book a call or become a client. Laws that apply: the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25. We apply Quebec’s rules to everyone, because they are the strictest.
2. What we collect, why, and on what basis
We collect only what we need. Required fields are marked on every form, and each form says why it asks.
| When | What | Why | Consent | Who processes it | Kept for |
|---|---|---|---|---|---|
| You send a message | Name, email or phone, optional business name, your message, and your planner answers only if you include them | To reply to you | Express: you choose to send it | Cloudflare (form handling), Web3Forms (delivery to our inbox), Google LLC (Gmail, our inbox); Resend if auto-replies are on | 24 months after our last contact, unless you become a client |
| You book a call | Name, email, the time you pick, anything you type into the booking form | To hold the call and contact you about it | Express: you load the calendar and book | Calendly LLC | 24 months after the call, unless you become a client |
| You run the free site check | The web address you enter | To test that site | Express: you press the button after being told | Cloudflare, Inc. (our checker, which loads that page and its public robots.txt, sitemap and llms.txt files once); Google LLC (PageSpeed Insights) only if we switch that option on | Not stored by us |
| You ask for a site-check report | Email, optional name, the address tested and its scores | To send you the report | Express: separate, unticked box | As for messages | 24 months, or until you ask us to delete it |
| You call, text or email us directly | Your phone number or email address, and what you tell us | To answer you | Express: you contact us | Our phone carrier; Google LLC (Gmail) | 24 months after our last contact, unless you become a client |
| We contact your business | Business name, type of business, the phone number and email the business publishes (for example on its website, Google or social media page), its public website address and what our check of that website found, and the public post if you asked online for website help | To offer our services once, with a reason specific to your business, and to keep a record so we don’t contact you again if you say no | Business contact information you published (PIPEDA s. 4.01; CASL s. 10(9)(b)); every email says who we are and how to opt out | Kept on our own computer; Google LLC (Gmail) if we email you | 12 months after our last contact, unless you reply or become a client. If you ask us not to contact you, we keep only your business name and contact details on a do-not-contact list, so we don’t |
| You become a client | Contact details, billing details, project files, account access you give us | To do the work, bill you and keep records the law requires | Contract | As above, plus hosting, domain and accounting providers named in your contract | For the contract, then as tax law requires (generally six years after the tax year), then deleted |
| You allow visit counting | Pages viewed, referring site, browser type, approximate country; no cookies, no profile | To see which pages help people | Opt-in, off by default | Cloudflare, Inc. | We see only totals; Cloudflare’s retention applies |
| You allow form spam protection | Browser and device signals for a one-time check | To block spam | Opt-in, off by default | Cloudflare, Inc. (Turnstile) | Not kept by us |
| Any visit | IP address and request details in security logs | To deliver the site and protect it from attacks | Necessary to provide the site | Cloudflare, Inc. (hosting) | Cloudflare’s log retention; we don’t keep them |
| Your browser only | Your choices (motion, sound, cookie preferences and a log of them), planner answers | To remember your settings | Stored on your device, never sent to us | Nobody | Choices: until you clear your browser storage. Planner answers: until you close the tab |
We don’t ask for sensitive information, and please don’t send it. We never put personal information in web addresses.
3. Consent, and changing your mind
We ask for consent separately for each purpose, never pre-ticked and never bundled. You can withdraw it any time: use “Cookie preferences” at the bottom of any page, or write to us. Withdrawing is as easy as agreeing. If you withdraw, we stop that use, and the page reloads without that service; it may mean a feature (for example, the booking calendar) isn’t available, and we’ll offer another way.
Technology that could identify, locate or profile you is off by default, and we tell you how to turn it on. This site has no advertising trackers, no social media pixels and no fingerprinting.
4. Storage outside Quebec and Canada
Some services we use store or process information in the United States and possibly other countries: Cloudflare, Calendly, Web3Forms, Google (Gmail, our inbox; and the site check’s optional speed score, only if switched on) and Resend (if auto-replies are on). Information there may be accessible to authorities under those countries’ laws. Before sending information outside Quebec, we assess the privacy risk and check that each provider is bound by written terms to keep it confidential, use it only to provide its service, protect it, report breaches, and delete it when the service ends.
5. Cookies and similar technology
This site sets no cookies of its own. Your preferences are kept in your browser’s local storage. Optional services may set their own cookies only after you allow them: Calendly when you load the booking calendar. If you later withdraw, clear any cookies Calendly already set in your browser settings. Details and controls: Cookie preferences.
6. How long we keep information, and how we destroy it
Retention periods are in the table above. When a period ends, we delete the information from our inbox, files and service accounts, and ask processors to delete their copies. Where information is needed only for statistics, we anonymise it instead. Backups roll over and disappear within 30 days.
7. How we protect it
HTTPS everywhere, two-factor sign-in on every account that holds personal information, strong unique passwords in a password manager, encrypted devices, the fewest possible people with access (just us, and processors only for their service), and security headers on this site. No system is perfectly secure. If a breach creates a real risk of significant harm (the federal test) or a risk of serious injury (Quebec’s test), we report it to the Office of the Privacy Commissioner of Canada and, for Quebec residents, to the Commission d’accès à l’information, and we notify the people affected. We keep a record of every privacy incident for at least five years (Quebec’s rule, which is longer than the federal 24 months).
8. Your rights
- Access: ask what we hold about you and get a copy.
- Correction: ask us to fix anything wrong or incomplete.
- Withdraw consent: any time, for any optional use.
- Deletion: ask us to delete information we no longer need or that you no longer consent to.
- Portability: get information you gave us in a structured, commonly used format, or have it sent to another organisation.
- Stop dissemination or de-indexing: ask us to stop sharing information about you, or to remove links to it, where the law allows.
Write to the person in charge (section 1). We answer within 30 days. Requests are free.
9. Complaints
Please tell us first; we’ll try to fix it. If you’re not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, if you’re in Quebec, to the Commission d’accès à l’information du Québec.
10. What we don’t do
We don’t sell or rent personal information. We don’t use it to make automated decisions about you. We don’t send newsletters or marketing texts. We may send one email to a business at an address it published, about our services and with a reason specific to that business (see the table); every such email identifies us, gives our mailing address and lets you opt out by replying, and we honour opt-outs right away (the law allows 10 business days).
11. Children
This site is for businesses. We don’t knowingly collect information from anyone under 14.
12. How we govern personal information (summary)
We keep written rules covering: who is responsible (the owner, as the person in charge), what we collect and why, retention and destruction periods, how we assess privacy risks before new projects or transfers, how we handle requests and complaints, and how we respond to incidents. We review them every year and whenever a law or a service changes.
13. Changes to this policy
When we change this policy, we update the date and the change log below and tell clients by email if the change affects them. If a change affects the choices you made, the cookie banner asks you again on your next visit.
- 9 October 2026: named our inbox provider (Gmail); described the site check’s own checker; added phone, text and email contact, and how we contact businesses that published their details.
- 8 October 2026: incident records kept five years; contact-form notice expanded; map embed removed from the concept builds.
- 7 October 2026: first version.