Privacy Policy

1. Who we are

Ablaze.Digital Inc. (“Ablaze.Digital”, “we”, “us”) is a corporation based in Calgary, Alberta, Canada. We provide AI solutions, business management and integration, marketing and SEO, and media services. For the personal information described in this policy, Ablaze.Digital Inc. is the organization responsible (the “controller” under the EU and UK General Data Protection Regulation).

Contact: [email protected] · 1.855.4ABLAZE (+1-855-422-5293) · Calgary, Alberta, Canada.

2. Scope of this policy

This policy applies to personal information we handle when you:

• visit ablaze.digital or its language versions;
• contact us, request a consultation or apply for a job;
• buy a plan or service, including through our Stripe-hosted checkout at ignite.ablaze.digital;
• use the Ablaze.Digital client portal; or
• interact with us by email, phone, video call or social media.

When we process personal information on behalf of a client — for example, the client’s customer lists, CRM records or campaign audiences — we act as a service provider or “processor”. That processing is governed by our Master Services Agreement and Data Processing Addendum with the client, and the client’s own privacy notice applies. Requests about that information should be directed to the client; we will assist them.

3. Information we collect

Information you give us

• Enquiries and consultations: first and last name, email address, and optionally phone number, company, the service and budget you are interested in, a subject and your message, your preferred language and whether you opted in to marketing emails.
• Job applications: name, email, phone, the position you are applying for, your cover letter or motivation, and links you choose to share (résumé, LinkedIn profile or portfolio).
• Purchases: when you buy through Stripe checkout, Stripe collects your payment card details directly. We receive your name, email address, phone number, billing country and address, the plan purchased and the payment status — never your full card number.
• Client relationship and portal: account details (name, email, company), project records, documents, payment records and messages you exchange with us.
• Communications: emails, call and meeting notes, feedback and support requests.

Information collected automatically

• Technical and security data: our hosting and security provider, Cloudflare, processes your IP address, browser and device type, the pages requested, referring URL and timestamps to deliver the site, protect it from abuse and produce aggregate traffic statistics. Our form handlers record the IP address of a submission to prevent spam and fraud.
• Analytics (only with your consent): if you allow analytics cookies, Google Analytics and Cloudflare Web Analytics record how pages are used — pages viewed, time on page, approximate location derived from IP address, device and browser type, and page performance.
• Choices and sessions: your cookie choices, and a secure session cookie when you sign in to the client portal.

Information from other sources

We may receive information from Stripe (payment status), from people who refer you to us, and from publicly available business sources such as your company website or professional profile.

Sensitive information

We do not ask for sensitive personal information through this website. We process sensitive information (such as health information) only when a client instructs us to under a written agreement with appropriate safeguards.

4. How we use information and legal bases

We use personal information only for purposes a reasonable person would consider appropriate, and we collect no more than we need for those purposes. Where the GDPR or UK GDPR applies, the legal basis for each purpose is shown.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that already took place.

5. Cookies and similar technologies

Cookies are small files stored by your browser. We use essential cookies that the site needs to work and, only if you agree, analytics and marketing cookies. Non-essential cookies are not set and non-essential scripts are not loaded until you opt in through our cookie banner. You can change your choice at any time with Cookie Settings (also in the footer of every page) or through your browser settings. If your browser sends a Global Privacy Control signal, we treat it as a refusal of marketing cookies.

We do not currently use advertising or cross-site tracking cookies. If we add marketing cookies, they will only run with your consent under the “Marketing” category. The site also stores copies of its own files (fonts, images) in your browser’s cache through a service worker so it loads faster; this contains no personal information.

6. How we share information

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose personal information only:

• To service providers who process it on our behalf under contracts requiring confidentiality and appropriate protection, including: Cloudflare (website hosting, content delivery, security, analytics and our internal business platform), Stripe (payments), Google (analytics, with your consent), and providers of email, communication, productivity and — when you engage us for AI services — AI model services.
• To professional advisers such as lawyers, accountants and auditors, under confidentiality.
• For legal reasons, where required by law or legal process, or to protect the rights, safety and property of Ablaze.Digital, our clients or others.
• In a business transaction, such as a merger or sale of assets, subject to confidentiality and to this policy.
• With your consent or at your direction.

7. International transfers

We are based in Canada, and our service providers operate in Canada, the United States and other countries. Your information may therefore be stored or processed outside your province, state or country, where it may be accessible to courts, law enforcement and national security authorities under local law. Before transferring personal information outside Québec, we assess whether it will receive adequate protection. For transfers from the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions (including Canada’s adequacy status for commercial organizations), the EU–U.S. Data Privacy Framework where the recipient is certified, or standard contractual clauses.

8. How long we keep information

We keep personal information only as long as needed for the purposes described, then securely delete or anonymize it. Typical periods:

• Enquiries that do not lead to an engagement: up to 24 months after our last contact.
• Job applications: up to 12 months after the position is filled, unless you are hired or ask us to keep your application longer.
• Client, contract and financial records: for the relationship and up to 7 years afterwards, to meet tax, accounting and legal obligations, unless a longer or shorter period is agreed in a Statement of Work or Data Processing Addendum.
• Portal sessions: 12 hours. Security logs: generally no more than 12 months.
• Analytics data: no more than 14 months in Google Analytics.
• Consent records: for as long as needed to demonstrate your choice.

9. Security

We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption in transit (HTTPS with HSTS) and at rest by our providers, HttpOnly and Secure session cookies, multi-factor authentication and zero-trust access controls for staff systems, role-based access, logging and monitoring, bot protection on forms, and tested backups. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the relevant regulators of a breach where the law requires. See our Data & Security Policy for more detail.

10. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and learn how it is used and disclosed;
• correct inaccurate or incomplete information;
• delete your information or have it de-indexed (Québec), subject to legal exceptions;
• withdraw consent or object to processing based on legitimate interests;
• restrict processing (EU/UK);
• data portability — receive computerized information you provided in a structured, commonly used format (Québec, EU/UK and several U.S. states);
• be informed about, and ask for a review of, decisions made exclusively by automated processing; and
• complain to a data-protection authority (see section 15).

How to make a request: email [email protected] with the subject “Privacy request”. We will verify your identity before acting, respond within 30 days (or the period set by your local law, such as 45 days in California), and tell you if we need an extension and why. Requests are free of charge unless they are manifestly unfounded or excessive. You may use an authorized agent where your law allows. We will not discriminate against you for exercising your rights.

11. Additional information for U.S. residents

Residents of California and other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) have the rights described in section 10 to know, access, correct, delete and port their information, and to opt out of the sale or sharing of personal information, targeted advertising and profiling.

• Categories collected in the last 12 months: identifiers (name, email, phone, IP address); commercial information (plans purchased); internet activity (with consent, site usage); professional information (company, job applications); and inferences we do not create for profiling.
• Sources, purposes and recipients: as described in sections 3, 4 and 6.
• Sale and sharing: we do not sell or share personal information for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing information of consumers under 16. We honour Global Privacy Control as an opt-out request.
• Sensitive personal information: we do not use or disclose it for purposes that would give rise to a right to limit.
• Appeals: if we decline your request, you may appeal by replying to our decision; if you are not satisfied, you may contact your state attorney general.

12. AI and automated decision-making

We do not make decisions about website visitors, enquirers or candidates that produce legal or similarly significant effects based solely on automated processing. We may use AI tools to help our team draft, summarize or organize work; people remain responsible for decisions. When we build AI solutions for clients, the client determines how personal information is used, and our AI work is governed by our Master Services Agreement.

13. Marketing communications

We send marketing emails only to people who have given consent — for example, by ticking the marketing box on our contact form — or where otherwise permitted by Canada’s Anti-Spam Legislation (CASL) and other applicable laws. Every marketing email identifies us and includes a working unsubscribe link, and we process unsubscribe requests within 10 business days. Service messages about your account or projects are not marketing.

14. Children

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16 (or under 14 in Québec, where parental consent is required). If you believe a child has provided us with personal information, contact us and we will delete it.

15. Privacy Officer and complaints

Our Privacy Officer is the person in charge of the protection of personal information at Ablaze.Digital Inc. and can be reached at [email protected] (subject: “Privacy Officer”) or by phone at 1.855.4ABLAZE. Please contact us first so we can try to resolve your concern. You may also complain to:

• the Office of the Privacy Commissioner of Canada;
• the Office of the Information and Privacy Commissioner of Alberta;
• the Commission d’accès à l’information du Québec;
• your local data-protection authority in the EU/EEA, or the UK Information Commissioner’s Office; or
• your state attorney general or privacy regulator in the United States.

16. Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with a new effective date and, for material changes, notify clients and portal users by email or in the portal before the change takes effect. Version 3.0 replaces the policy effective August 8, 2025, and reflects our client portal, online checkout, consent-based analytics, and AI services.

This document is published in English and French; both versions have equal standing.