In short
We are a one-person studio in Halifax. We collect the details you send us so we can reply to you and do the work you hired us for. We do not sell your information, we do not rent it, and we do not add you to a mailing list you did not ask for.
You send us your name and how to reach you. We use it to talk to you about your website. A small number of suppliers see it because they host the site and carry the email. Ask us to delete it and we will.
This policy applies to alpwebstudio.com and to the work we do for clients. It does not cover the websites we build for other businesses once those are live, each of those is its own operator's responsibility, and section 06 explains our role there.
What we collect
When you get in touch
Whatever you put in the enquiry form, an email, or a text: typically your name, business name, email address, phone number, your town or service area, your current website, and a description of what you need. You choose what to include; only a name and a way to reply are genuinely required.
When you become a client
The information needed to build and run your site: business details, hours, services, photos, and the logins or access we need for your domain, hosting or Google Business Profile. Plus billing details for the monthly plan.
We never see or store your full card number. Payments are handled by a payment processor, which holds the card and gives us a reference and the last four digits.
When you just visit the site
Standard web server logs, which include your IP address, browser, and the pages requested. These are a by-product of serving a website rather than something we go looking at, and they are used for security and diagnosing faults.
Why we collect it
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) we have to tell you our purposes, and limit ourselves to them. Ours are:
- To reply to you. If you send an enquiry, we use your details to answer it. That's the entire purpose for most people who ever contact us.
- To do the work. Building, hosting, monitoring and changing your website needs your business details and, in some cases, access to your accounts.
- To bill you. Monthly plans need a billing record.
- To keep the site up. Server logs for security, fault-finding and abuse prevention.
- To meet our own obligations. Tax and accounting records we're legally required to keep.
We do not use your information to build a profile of you, we do not run advertising off it, and we do not sell or trade it to anyone. If we ever wanted to use it for something not on this list, we would ask you first.
How long we keep it
- Enquiries that go nowhere: kept for about a year, in case you come back, and then deleted.
- Client records: kept for as long as you're with us, and for a period afterwards so we can answer questions about work we did.
- Billing and tax records: kept for as long as Canadian tax law requires, which is longer than we would otherwise choose.
- Server logs: rotated automatically after a short period.
If you want something gone sooner, ask. Unless we're legally required to keep it, we'll delete it and confirm that we have.
Your rights
Under PIPEDA you can ask us to:
- Show you what personal information we hold about you.
- Correct it if it's wrong or out of date.
- Delete it, subject to anything we're legally obliged to retain.
- Withdraw consent to us using it, understanding that if you're a client this may mean we can't keep running your site.
- Complain, to us first, and then to the Office of the Privacy Commissioner of Canada if we haven't resolved it.
Email hello@alpwebstudio.com and you'll get a person, not a ticket. We aim to answer within a few days and are required to respond within thirty.
If we built your site
When we run a website for a business, that business decides what it collects from its own customers and why. They're responsible for their own privacy policy and their own compliance; we're the supplier that operates the site for them.
In practice that means we can see the enquiries that come through a client's contact form, and for Lead Machine clients we can see the leads in their dashboard, because we built and maintain those systems. We treat that information as the client's, not ours. We don't mine it, we don't use it for anything except keeping the system working, and we don't move it between clients.
If you're a member of the public who filled in a form on a site we built, and you want that removed, the fastest route is to contact that business directly. If you can't reach them, contact us and we'll help.
Security
Sites we run are served over HTTPS with certificates issued and renewed automatically. Hosting is managed and backed up. Access to client accounts is limited to the one person who does the work, and credentials are stored in a password manager rather than in an email thread.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affecting your information ever occurred, we would tell you and the relevant regulator promptly, and tell you what actually happened rather than a sanitised version.
Changes and contact
If this policy changes materially, the date at the top of the page changes with it, and clients on a plan get an email. We won't quietly broaden what we do with your information and let you find out later.
Questions, requests, or complaints:
- Email hello@alpwebstudio.com
- Call or text (902) 225-5280
- Alp Web Studio, Halifax, Nova Scotia, Canada