Privacy Policy

1. Who Is Responsible

Under section 5(3) of PIPA we have designated an individual responsible for our compliance with the Act. You can reach that person here:

The Privacy Officer answers questions about this policy, about any collection it describes, and about our use of service providers outside Canada. Access requests, correction requests, withdrawals of consent, and complaints all go to the same place.

2. What We Collect

2.1 Information you give us

The Site has one form. When you use the contact form, we collect:

• your name
• your email address
• your company name, if you choose to enter one
• a rough budget range, if you choose to select one
• the content of your message

There are no accounts on this Site, no logins, no passwords, and no payments.

2.2 Information collected automatically

When you load a page, the following is collected:

• your IP address
• your browser type and version, operating system, device type, screen size, and language
• the page you requested and the URL that referred you to it
• the pages you view and the links, buttons and form fields you interact with
• an approximate location — city and region — derived from your IP address
• the date and time of each request
• an advertising identifier stored in your browser by each of our two advertising tags, Google Ads and Meta, both described in section 6
• if you reached the Site by clicking one of our ads, the click identifier that ad added to the link you followed — Google and Meta each add their own

When you submit the contact form we also read your IP address to enforce a submission limit of five per fifteen minutes. That address is used only to count submissions within that window, is held in the web server's working memory, and is never written to a database or a log file we keep. It is discarded when the server process recycles; we persist it nowhere.

2.3 What we do not collect

We think it is worth being specific about the things we deliberately do not do:

• No session or screen recordings. Session replay is switched off in our analytics configuration.
• Nothing we send an advertiser contains your message. The Site runs advertising tags — two of them at the moment, Google Ads and Meta, both set out in section 6 and named in section 5. What they receive from us is that a page was viewed and that a message was sent successfully. Never your name, never your email address, and never a word of what you wrote.
• No profiles built from outside sources. We do not buy personal information, enrich it against third-party databases, or combine it with anything bought from a data broker.
• We do not sell, rent, or trade your personal information. Not to anyone, for any price.
• No sensitive information. We do not ask for it and have no use for it. Please do not put banking or payment details, government ID numbers, health information, or anyone else's confidential information into the contact form.

3. Why We Collect It

Section 13(1)(a) of PIPA requires us to tell you our purposes before or at the time we collect. They are:

For information you give us through the contact form

• to read and reply to your message
• to work out whether we are the right people for what you need, and to tell you if we are not
• to keep a record of the inquiry so that a later conversation makes sense
• if we go on to work together, to set up that engagement

For information collected automatically

• to serve the Site and keep it working
• to understand which pages people find useful, so we can write better ones
• to detect and limit spam, automated abuse, and attacks
• to diagnose errors and measure page performance
• to measure whether the ads we pay for actually bring anyone here, and to show our ads again to people who have already visited the Site

For both

• to meet obligations the law places on us

We will not use your personal information for a new purpose without asking you first. We do not send marketing email from this Site. There is no mailing list and there is no newsletter.

4. Consent

By submitting the contact form you consent to us collecting and using the information in it for the purposes in section 3.

For the technical information collected automatically, we rely on your consent given by continuing to use the Site after receiving this notice. Section 6 tells you how to limit that collection if you would rather not give it.

Withdrawing consent. You may withdraw your consent at any time by writing to the Privacy Officer, subject to legal or contractual restrictions and reasonable notice. We will tell you what withdrawing will mean before we act on it — in practice, for the Site, it means we stop processing your inquiry and delete it. Withdrawing consent does not undo anything we did lawfully before you withdrew.

5. Service Providers, and the Countries Your Information Goes To

We use a small number of outside companies to run the Site. Each of them handles personal information on our behalf, and each of them is outside Canada. We are telling you this before you give us anything, which is what section 13.1 of PIPA requires.

Apart from the five companies above, we do not use any other analytics, error-reporting, session-recording, chat, mapping, advertising, or customer-relationship service on this Site.

Because these companies are outside Canada, the personal information they hold on our behalf is subject to the laws of the countries named above, and may be accessible to courts, law enforcement, and national security authorities in those countries under the laws that apply there. That is true of any Canadian business using services of this kind, and we would rather say it plainly than leave it out.

Your right to ask about this. You may obtain written information about our policies and practices with respect to service providers outside Canada, and ask any question about how those providers collect, use, disclose, or store personal information on our behalf, by writing to the Privacy Officer at info@realeasytechnologies.ca. We will answer.

Other disclosures. Apart from the service providers above, we disclose personal information only where PIPA permits or requires it — for example, in response to a lawful court order, subpoena, or demand from a body with jurisdiction to compel it, or where necessary to investigate a suspected breach of an agreement or of the law. If we are ever sold or merged, personal information may transfer as part of that transaction; PIPA restricts what the buyer may then do with it, and we would tell you.

6. Cookies and Similar Technologies

Our analytics provider, PostHog, stores a small identifier in your browser so that repeat visits from the same browser can be counted as one visitor rather than several. It is kept in two places: a cookie, which expires twelve months after your most recent visit, and an entry in your browser's local storage, which has no expiry date and stays until you clear this Site's data.

We also run two advertising tags: one from Google Ads, and one from Meta, the company behind Facebook and Instagram. Each stores an identifier in a cookie on this Site that expires ninety days after it is set, and each reads the click identifier that an ad added to the link if you arrived by clicking one of ours. The Google tag additionally loads a hidden frame from Google's doubleclick.net domain, which lets Google set cookies of its own; the Meta pixel loads no frame and reports directly to facebook.com. Between them these let us tell whether the ads we pay for bring anyone here, and let us show our ads again to someone who has already visited.

It is worth being exact about what our code sends. There are two things, and they go to both platforms: that a page was viewed, and — when a contact form message is sent successfully — that a submission happened. Google additionally receives a nominal value so that its Ads account can count it; Meta receives the event and nothing besides. Neither carries your name, your email address, or a word of what you wrote. The conversion is a bare count, and it fires only when the message actually reached us: a submission we reject, one our spam trap catches, or one our mail provider fails to accept sends both companies nothing at all. We do not upload customer lists, and we do not ask either company to match you against anything it already knows about you.

Nothing on this Site needs cookies to work. It is a set of written pages and one contact form. If you block cookies and local storage, every page and the form will still function normally, and we will simply count your visits separately rather than together and lose the ability to tell whether an ad brought you here.

You can limit or stop this collection by:

• blocking or clearing cookies and site data for this Site in your browser's settings
• using your browser's private or incognito mode
• blocking the domain us.i.posthog.com with a content blocker or your DNS
• blocking www.googletagmanager.com and doubleclick.net the same way, which stops the Google tag
• blocking connect.facebook.net and facebook.com the same way, which stops the Meta pixel
• turning off personalised advertising in your own Google account at My Ad Center, which applies to Google's advertising generally and not only to ours
• reviewing the ad preferences on your own Meta account at Accounts Center, including the activity Meta has received from other businesses, which likewise applies to Meta's advertising generally and not only to ours

We still do not show a cookie consent banner, and this is the second time we have had to revisit the reason. It was once that we ran no advertising trackers at all. Then it was that we ran exactly one. Both have now been overtaken, and we would rather be direct about the second one: this section used to say that adding a second advertising platform would mean a notice was no longer enough. We have added a second advertising platform.

So we have reconsidered that position rather than quietly restated it. We run one analytics tool, two advertising tags, and no session recording, and nothing we send to either advertiser contains anything you typed. Alberta's PIPA permits us to rely on the consent implied by your continuing to use the Site once we have told you specifically what is collected and how to stop it, and we think that is still the right reading at this size. But it is a judgement rather than a law of nature, we have now stretched it once, and you are entitled to be told that plainly instead of finding a rewritten sentence where a commitment used to be.

Here is the line, and this one we intend to keep. A third advertising platform, any tracking that reads the contact form itself, or advertising aimed at the United Kingdom or the European Union — where the law wants your consent before a tag loads rather than notice afterwards — and this stops being a notice and becomes a choice you make before anything runs. That would be a change to the code that loads the tags, not to this paragraph.

7. How Long We Keep It

• Contact form messages in our inbox

  24 months after our last correspondence with you, unless the inquiry becomes a client engagement — in which case the records are kept under that engagement’s terms

• The same messages in Resend’s transactional logs

  Retained for 30 days, which is the log-retention period Resend publishes

• Analytics events in PostHog

  12 months from the date of the event

• The advertising cookie set by the Google Ads tag

  90 days from the last time it was set. What Google retains on its own systems is governed by Google’s policies and the retention settings on our Ads account, not by us

• The advertising cookie set by the Meta Pixel

  90 days from the last time it was set, which is the pixel’s own default rather than a period we chose. What Meta retains on its own systems is governed by Meta’s policies and the settings on our ad account, not by us

• Hosting and request logs at Vercel

  Retained on Vercel’s own schedule, which we do not control

• IP addresses used for submission rate limiting

  Counted over a fifteen-minute window, in the server’s memory only, and discarded when the server process recycles. Never written to disk

When a retention period ends, we delete the information or render it non-identifying, as section 35 of PIPA requires. Where the information sits with a service provider on a schedule we do not set, we say so above rather than promise something we cannot deliver.

8. How We Protect It

We would rather tell you what is actually in place than reassure you in general terms.

• The Site is served over HTTPS only, with HTTP Strict Transport Security set for one year and applied to subdomains.
• A Content Security Policy restricts which scripts the Site may load and which servers it may contact, and additional headers block content-type sniffing, restrict framing, and limit what referrer information is shared with other sites.
• Contact form input is validated on the server and escaped before it is placed into an email, and submissions are rate-limited by IP.
• We keep no customer database. There is no user table on this Site, because there are no users. Inquiries live in one email inbox.
• Access to that inbox and to the analytics and email accounts is limited to the small number of people who run the company.

No system is perfectly secure, and we will not tell you otherwise. What we can tell you is how little there is here to lose.

9. Your Rights

If you are in Alberta, PIPA gives you these rights. We are stating them as rights rather than possibilities, because that is what they are.

To exercise any of these, write to the Privacy Officer at info@realeasytechnologies.ca. Please give us enough detail to find the records, and be aware we may need to confirm who you are before we hand over personal information.

10. If Something Goes Wrong

If personal information under our control is lost, accessed without authorisation, or disclosed without authorisation, and a reasonable person would consider that there is a real risk of significant harm to you as a result, we will notify the Information and Privacy Commissioner of Alberta without unreasonable delay, as section 34.1 of PIPA requires, and we will notify you.

11. Complaints

Please raise any concern with our Privacy Officer first — we would like the chance to fix it. If you are not satisfied with our answer, you may ask the Commissioner to review it:

12. Changes to This Policy

We may update this policy. When we do, we will change the “Last updated” date at the top, and we keep dated copies of every earlier version — ask the Privacy Officer if you want to see one. Where a change materially affects how we handle information we already hold about you, we will seek your consent rather than rely on the posted change.

13. Contact Us