Privacy & Security Policy

1. Who is responsible

2. What we collect

• Contact and estimate forms — your name, email and country, your company and phone if you add them, the project type, budget, timeline and description you enter, and a record of your consent: when you gave it, the wording you agreed to and the language of the form.
• Technical details sent with a form — your browser and device type (user agent) and the page you came from (referrer), stored with your enquiry to help us spot spam.
• AI assistant and estimator — what you type is sent to our AI provider to generate a reply or a price range. We don’t store chat conversations or estimator inputs on our side. Please don’t share payment details, passwords, health information or government ID in the chat.
• Call bookings — if you book a call, Google Calendar collects your name, email, the time you choose and your answer to the booking question, and adds a Google Meet link.
• Emails — when you write to us or reply to our emails, we keep that correspondence in our inbox.
• Usage analytics — pages viewed, approximate location (country or city), device and browser, and how you reached the site, through Google Analytics with IP anonymisation. This isn’t linked to your name.
• IP address — used for a few minutes, in memory only, to limit how often one connection can send forms or chat messages, and recorded briefly in our hosting provider’s server logs.

We don’t collect payment information on this site, and we don’t buy or receive personal information about you from data brokers.

3. Why we use it

• To reply to your enquiry, prepare a proposal and follow up on a project you asked about.
• To answer questions in the AI assistant and give an indicative price range in the estimator.
• To prioritise enquiries (see section 4).
• To send you a confirmation email when you submit a form.
• To understand which pages are useful, keep the site working and block spam or abuse of our forms and AI tools.

We use your information only for these purposes. We don’t sell or rent it, we don’t share it for advertising and we don’t run ad-retargeting pixels. We won’t add you to a newsletter or send you marketing emails unless you ask for them, in line with Canada’s Anti-Spam Legislation (CASL).

4. How we use AI

• The assistant tells you it’s AI — the chat on this site is an AI assistant, not a person. It can be wrong, it can’t commit to prices, dates or contracts, and it offers to put you in touch with a person at any time.
• Estimates are indicative — the estimator’s price ranges are a starting point, not a quote. A binding price only comes from a written proposal.
• Enquiry scoring — when you submit a form, an AI model reads your enquiry and gives it a priority score (for example, how urgent and how well it fits our services) so we can reply to the most time-sensitive first. A person reads every enquiry and makes every decision; the score never decides on its own whether we work with you. You can ask us for your score and how it was produced.
• No model training — our AI provider, Anthropic, does not use what you send through our site to train its models, under its commercial terms. It keeps inputs and outputs for up to 30 days to detect misuse, then deletes them.

5. Who processes it, and where

We share your information only with the service providers below, which process it on our behalf to run this site. Each is bound by its own privacy and security terms, and we remain responsible for your information while they hold it. Most of them store or process it outside Canada, mainly in the United States, where it is subject to local law and may be accessed by courts, law enforcement and national security authorities there.

• Anthropic (Claude), United States — generates chat replies and estimates, and scores enquiries.
• Railway, United States (Virginia) — hosts the website and its server functions, including short-lived server logs.
• Google Cloud Firestore, United States — stores form submissions (multi-region US data centres).
• HubSpot, United States — our customer relationship manager (CRM), where we track enquiries and follow up on projects.
• Resend, United States — sends the confirmation and notification emails triggered by the forms.
• Google Analytics, Google Calendar and Google Meet — measure site usage, handle call bookings and host video calls. Google may process this data in the United States and other countries.
• IONOS — hosts our email inbox at zeasdesign.ca.

We may also disclose information if the law requires it, for example in response to a valid court order, or to a buyer if the business is ever sold, in which case the buyer must honour this policy.

6. Your consent

7. Cookies and similar technologies

• Your choice — we store your accept or decline choice in your browser’s local storage so we don’t ask on every page. It contains nothing else.
• Google Analytics, only if you accept — sets first-party cookies (named _ga and _ga_ followed by an ID) that distinguish visitors and last up to two years. We use them to count visits and see which pages are useful, not to build advertising profiles.
• Google Calendar booking — the booking calendar on our contact page is provided by Google and may set Google’s own cookies when it loads.
• No advertising cookies — we don’t use cookies or pixels for cross-site advertising or retargeting.

You can change your choice at any time from “Cookie settings” at the bottom of every page; declining stops Google Analytics and deletes its cookies. You can also block or delete cookies in your browser settings. The site works fully without analytics cookies.

8. How we protect it

• All traffic to this site is encrypted in transit with HTTPS/TLS, and our providers encrypt stored data at rest.
• Stored enquiries can only be reached from our server, never directly from the browser, and access is limited to the people who need it to reply.
• API keys and credentials stay on the server and are never exposed to the browser.
• Forms and AI tools are rate-limited and have spam protection to reduce automated abuse.
• Accounts that hold your data are protected with strong, unique passwords and two-step verification where the provider offers it.

No system is perfectly secure. If a breach of security safeguards involving your information creates a real risk of significant harm, we’ll notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires, and keep a record of it.

9. How long we keep it

• Enquiries — deleted automatically 12 months after you send them, from both our database and our CRM, by a weekly clean-up job. If we start a project together, we keep them for the length of the engagement.
• Client records — contracts, invoices and payment records are kept for six years after the end of the tax year they relate to, as the Canada Revenue Agency requires.
• Chat and estimator inputs — not stored by us; deleted by our AI provider within 30 days.
• Emails and bookings — kept in our inbox and calendar while we are in touch about a project, and deleted on request unless they form part of a client record.
• Server logs — kept for a short period set by our hosting provider, then deleted automatically.
• Analytics — kept for the retention period set in Google Analytics, no longer than 14 months.

10. Your rights

11. Children

12. Changes to this policy