Privacy Policy

This Privacy Policy explains how NorthFlow Digital Inc. ("NorthFlow", "we", "us") collects, uses and discloses personal information when you visit our website, northflowdigital.ca, contact us, take or book a Digital Business Health Check™, book a call, use our client portal, or become a client. It also covers NorthFlow HQ, the business system we run on, including when we connect a Google account to it. It explains your privacy rights and how to use them.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL) and other applicable Canadian privacy laws.

Information we handle for clients during an engagement is also covered by our agreement with that client. Where the two differ, the agreement applies.

Consent

We ask for your consent when we collect personal information, and we tell you why we need it. By sending us your information through our website, forms or booking pages, you consent to its use as this policy describes. You can withdraw your consent at any time by contacting us, subject to legal or contractual limits. If you do, we may not be able to provide some services.

Information we collect

Contact form. Your name, email address, company (if you give it) and your message about what you need help with.

Digital Business Health Check™. Your answers and any notes you add, your name, business name and work email, and, if you choose to give them, your timeline, who makes the decision and your budget range. We also record whether you agreed to receive marketing emails, the page you started from, the website that referred you and any campaign tags (such as utm_source) in the link you followed. We keep your email once you enter it, even if you don't finish, so we can follow up about that check.

Bookings. When you book a call we collect your name, email address, the time you chose and anything you tell us about the call. Paid bookings are handled by our payment processor.

Clients and their contacts. Business contact details, information about your business processes and the tools you use, the records of our work together (proposals, agreements, signatures, invoices, payments, files and messages) and any information you share with us to deliver our services.

Billing. Billing contact and address, invoices and payment records. We do not store full payment card numbers; payments are handled by your bank or by our payment processor.

If you contact us directly. Your phone number, the contents of your message, any attachments, and anything else you choose to send.

Usage data. Our hosting providers automatically record basic request data, such as your IP address, browser type and version, the page requested and the date and time, to keep our services secure and working. Our forms use Cloudflare Turnstile to tell people from bots, which processes technical signals such as your IP address and browser details.

Cookies and similar technologies

A cookie is a small file placed on your device. Session cookies are deleted when you close your browser; persistent cookies stay on your device until they expire or you delete them. We use as few as we can:

What	Type	Purpose
Necessary	Session	Keep you signed in to our client portal and staff tools, and let Cloudflare Turnstile check that a form is sent by a person. The site cannot work properly without them.
Saved progress	Browser storage	Save your Digital Business Health Check™ answers on your own device so you can come back and finish. It is cleared when you send the check and expires on its own.
Analytics	Persistent	We do not use analytics cookies today. If we add a tool such as Google Analytics, we will use it only with your consent and update this table.

We do not use advertising or cross-site tracking cookies. You can refuse or delete cookies at any time in your browser settings. If you refuse necessary cookies, some parts of our services may not work as intended.

Google user data

NorthFlow HQ can connect to a Google account so that our booking page offers only times when we are actually free, and booked calls appear on our calendar. The connection is made by NorthFlow staff, for NorthFlow's own calendar. When the account owner chooses to connect Google, NorthFlow HQ asks for these permissions:

• See free and busy times (calendar.freebusy). HQ reads only whether a time is busy, never the details of the events, so the booking page offers open slots.
• Create and manage events (calendar.events). When someone books a call, HQ adds one event to the calendar with a Google Meet link and the guest invited, and updates or removes that same event when the booking is moved or cancelled. HQ changes only events it created.

How we handle that data:

• We use it only to show availability and to create, update and cancel the events booked through NorthFlow HQ.
• We store the access and refresh tokens Google gives us, encrypted (AES-256-GCM), in HQ's database, together with the IDs of the events HQ created. We do not copy or keep the contents of other calendar events.
• We do not sell Google user data, use it for advertising, or use it to build profiles.
• We do not share it with anyone, except as needed to provide the features above, to comply with the law, or as part of a merger or sale of our business with the same protections in place.
• No person at NorthFlow reads it, unless the account owner asks us to for support, it is needed for security or to investigate abuse, or the law requires it.
• We do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

NorthFlow's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The account owner can disconnect Google at any time in NorthFlow HQ under Settings, Integrations, or from their Google Account at myaccount.google.com/permissions. When a connection is removed we revoke Google's grant and delete the stored tokens straight away.

How we use your information

We use personal information only for the purposes below, or for other purposes we tell you about and, where required, ask your consent for:

• to reply to your enquiries and manage your requests;
• to score your Digital Business Health Check™, email you the report and follow up about it;
• to schedule, confirm, remind you of, reschedule and hold calls;
• to prepare proposals, deliver our services and perform our contracts with you;
• to give you access to the client portal and the documents we share with you;
• to send invoices, receive payments and keep business and tax records;
• to send you news and offers about our services, only as described in Marketing emails;
• to operate, secure and improve our website, services and marketing; and
• to detect and prevent fraud, spam and abuse, and to meet our legal obligations.

Marketing emails

We send marketing emails only to people who have given us express consent, for example by ticking the box on the Digital Business Health Check™, or where CASL otherwise allows it. Every marketing email identifies NorthFlow, includes our mailing address and has an unsubscribe link. We act on an unsubscribe within 10 business days.

Emails you need about something you asked for, such as your Health Check report, a booking confirmation or an invoice, are not marketing and are sent whether or not you have opted in.

How we share your information

We do not sell or rent your personal information. We may share it:

• With service providers who help us run our business, such as website and application hosting (Vercel, Railway), encrypted backups (Cloudflare), email (Resend), bot checks (Cloudflare Turnstile), image hosting (Cloudinary), electronic signatures, calendar and video calls (Google, when connected), payment processing (Stripe), accounting, and team chat with clients (Slack). They may use your information only to provide services to us and must protect it under written agreements.
• With our team members within and outside Canada who need access to your information to provide services to you, all of whom are bound by written confidentiality obligations.
• In a business transaction, such as a merger, financing or sale of all or part of our business, subject to confidentiality terms. We will notify you before your personal information becomes subject to a different privacy policy.
• When required by law, such as in response to a valid court order or request from a government authority, or where needed to protect our rights, investigate fraud or protect someone's safety.
• With your consent, for any other purpose.

Where your information is stored

Our website, NorthFlow HQ and most of our service providers store and process information outside Canada, mainly in the United States. Members of our delivery team in Nigeria may access information remotely to provide services. Information held outside Canada is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.

Wherever your information is handled, we remain responsible for it and use contracts, access controls and security measures to give it a comparable level of protection.

How long we keep your information

We keep personal information only as long as we need it for the purposes in this policy. The periods below are maximums; we delete or anonymize information sooner when we no longer need it.

Information	Kept for
Enquiries, Health Check submissions and correspondence	Up to 24 months after our last contact, unless you become a client
Server logs	Up to 24 months from collection
Marketing email list	Until you unsubscribe, or until your consent expires under CASL
Client project records and Health Check results	For the duration of our engagement and up to 24 months after it ends, unless our client agreement says otherwise
Contracts, invoices and financial records	Six years from the end of the tax year they relate to, as the Canada Revenue Agency requires
Google tokens and booked event IDs	Until the Google connection is removed
Encrypted database backups	90 days

We may keep personal information longer where the law requires it, where it is needed to establish or defend a legal claim, or where you ask us to.

How we protect your information

We use safeguards suited to the sensitivity of the information, including:

• encryption in transit and at rest, including encrypted backups and encrypted storage of connected account tokens;
• multi-factor authentication on all business accounts;
• passwords and client credentials kept in an approved password manager;
• access limited to people who need it for their work, under written confidentiality agreements; and
• encrypted, up-to-date devices and secure, approved tools for client work.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach of security creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires, and we keep a record of every breach.

Your rights

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct personal information that is inaccurate or incomplete;
• delete your personal information; and
• stop using your personal information for a purpose you agreed to earlier.

We may need to verify your identity first, and we will respond within 30 days. We may need to keep some information where the law requires or permits it. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the privacy regulator in your province.

Children's privacy

Our website and services are for businesses and are not directed to children under 16. We do not knowingly collect personal information from them. If you are a parent or guardian and believe your child has given us personal information, please contact us. If we learn we have collected such information, we will delete it, subject to any legal obligation to keep it.

Links to other websites

Our website may link to other websites. We do not control their content or their privacy and security practices, and we are not responsible for them. We encourage you to read the privacy policy of every website you visit.

Changes to this policy

We may update this policy to reflect changes in our practices, our services or the law. We will publish the updated version on this page and change the "Last updated" date. Where a change affects how we collect, use or disclose personal information, we will post a prominent notice on our website before it takes effect and tell clients directly.

Contact us

Questions about this policy, or a request for our Privacy Officer:

• Email: info@northflowdigital.ca
• The contact form on our website
• Mail: Privacy Officer, NorthFlow Digital Inc., 3882 33rd Street West, Saskatoon, Saskatchewan, Canada