Privacy Policy

1. Who we are

Into the Flavor Inc. ("Into the Flavor," "we," "us," or "our") is an Ontario corporation that provides website design, monthly website care (retainer), and related digital services to small businesses, primarily in Ontario, Canada. We operate the website intotheflavor.com and related pages and subdomains under our control (collectively, the "Site").

For privacy questions or requests, contact:

• Email: [email protected]
• Phone: (249) 499-0309
• Mailing location: Wasaga Beach, Ontario, Canada

2. Scope of this policy

This Privacy Policy describes how we collect, use, disclose, retain, and safeguard personal information in connection with the Site and our business operations. It is intended to align with Canadian private-sector privacy principles under thePersonal Information Protection and Electronic Documents Act(PIPEDA) and applicable provincial rules, as they may apply to our activities.

This policy applies to visitors and prospective clients who use the Site or contact us. If you become a client, additional project communications may also be governed by a written proposal, statement of work, or service agreement. Where those documents say something different about a specific engagement, they control for that engagement to the extent permitted by law.

This page is a business disclosure, not legal advice. Laws change. If you need advice about your own privacy obligations, consult a qualified professional.

3. What personal information we collect

"Personal information" means information about an identifiable individual. Depending on how you interact with us, we may collect:

3.1 Information you provide directly

• Contact and inquiry details, such as name, email address, phone number, business name, service interest, and the content of your message, typically through our Site contact form, email to [email protected], or a similar channel.
• Scheduling details if you book an intro call through our calendar tool (for example name, email, and any notes you add when booking).
• Call-related information if you phone us or leave a voicemail, including your phone number and the content of the conversation or message, as reasonably needed to respond.
• Client project materials you choose to send (logos, photos, copy, brand guidelines, login credentials you provide for the work, feedback, and similar materials) once we are working together.
• Billing and administrative information needed to invoice and get paid (for example business name, billing email, and payment confirmation). We do not process card payments on the Site itself. Payments, if any, are handled through agreed methods outside the Site or via payment tools we designate in writing.

3.2 Information collected automatically

• Technical and usage data, such as pages viewed, approximate location derived from network data, referrer, browser and device type, and timestamps. We use Cloudflare Web Analytics (a privacy-oriented analytics product) to understand aggregate traffic patterns.
• Server and security logs generated by our hosting and network provider (Cloudflare) as part of operating a public website, which may include IP addresses and request metadata for security, reliability, and abuse prevention.
• Cookies and similar technologies that are strictly necessary for the Site to function, or that support limited analytics as described in Section 7. We do not operate a third-party advertising pixel network on the Site for behavioural ad profiling.

3.3 Information we do not intentionally collect on the Site

We do not require you to create an account to browse the Site. We do not intentionally collect sensitive government identifiers, health information, or payment card numbers through the public contact form. Please do not submit sensitive personal information (such as SIN, passport numbers, or detailed medical information) through the Site form.

4. Purposes for which we use personal information

We use personal information for purposes that a reasonable person would consider appropriate in the circumstances, including to:

• Respond to inquiries, schedule calls, and prepare quotes or proposals;
• Enter into and perform client agreements, including design, build, launch, retainer care, and custom automation work;
• Communicate about projects, invoices, support, and service changes;
• Operate, secure, troubleshoot, and improve the Site and our services;
• Maintain business records for accounting, tax, audit, and legal compliance;
• Protect our rights, prevent fraud or misuse, and respond to lawful requests from authorities;
• With your consent or as otherwise permitted by law, send limited commercial electronic messages about our services (see Section 10 on Canada's Anti-Spam Legislation).

We do not use contact-form submissions for unrelated third-party marketing, and we do not sell, rent, or trade personal information.

5. Consent and our legal basis for collection

Where required, we collect, use, and disclose personal information with your consent (express or implied), or as otherwise permitted or required by law. For example:

• Submitting the contact form, emailing us, booking a call, or leaving a voicemail is generally treated as consent to use that information to respond and follow up about our services.
• Technical and security data is collected as reasonably necessary to operate a public website and protect it from abuse.
• You may withdraw consent for optional uses (such as marketing emails), subject to legal or contractual restrictions and reasonable notice. Withdrawal will not usually affect processing that is necessary to provide a service you requested or that we are required by law to keep.

6. Service providers and disclosures

We use carefully selected service providers to help us run the business. They process information on our behalf or as independent controllers of their own platforms, under their own privacy policies. Categories currently include:

We may also disclose personal information:

• To professional advisors (legal, accounting) under confidentiality obligations;
• If required by law, regulation, court order, or lawful request of a public authority;
• To protect the rights, safety, or property of Into the Flavor, our clients, or others;
• In connection with a business transaction (for example sale or reorganization of the business), subject to appropriate safeguards.

We do not sell personal information to data brokers or advertisers.

7. Cookies, analytics, and similar technologies

The Site may use:

• Essential cookies or local storage needed for basic site function and security.
• Cloudflare Web Analytics, which is designed to provide aggregate insights (for example popular pages and traffic volume) with a privacy-focused approach and without building advertising profiles about you for us to sell.

You can control cookies through your browser settings. Blocking some cookies may affect Site functionality. We may update our analytics stack over time; material changes will be reflected in this policy.

8. Cross-border transfers

Some of our service providers process or store information on servers located outside Canada (including the United States). While information is outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by foreign authorities. We take reasonable steps to use reputable providers and to limit the personal information shared to what is needed for the service.

9. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy, or as required by law (for example tax and accounting records). As a general guide:

• Prospective-client inquiries: typically kept while the conversation is active and for a reasonable period afterward (often up to 24 months if no engagement starts), unless you request earlier deletion and we have no legal duty to keep the record.
• Client project files and correspondence:retained for the life of the engagement and a reasonable archive period after completion (often several years) for support, warranty, and legal reasons.
• Analytics and security logs: retained according to our providers' defaults and our operational needs, usually in aggregate or short-lived log form.

When retention is no longer needed, we take reasonable steps to delete or anonymize information, subject to backup and archival systems that may lag for a short period.

10. Canada's Anti-Spam Legislation (CASL)

If we send commercial electronic messages (for example promotional email), we intend to do so in compliance with Canada's Anti-Spam Legislation. That generally means we will have consent where required, identify ourselves, and include a working unsubscribe mechanism. Transactional or relationship messages (quotes, project updates, invoices) may still be sent as needed to provide services you requested.

11. Security

We implement reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information and the size of our business. These may include access controls, reputable cloud providers, TLS encryption in transit for the Site, and limited staff access to inquiry and client materials. No method of transmission or storage is perfectly secure. If we become aware of a breach that creates a real risk of significant harm, we will take steps consistent with applicable law, which may include notifying affected individuals and regulators where required.

12. Your rights and choices

Subject to legal limits, you may:

• Request access to personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion or de-indexing where appropriate;
• Withdraw consent for optional processing or marketing communications;
• Ask questions about how we handle your information.

To make a request, email [email protected]. Include enough detail for us to verify your identity and locate the records. We will respond within a reasonable time. We may refuse or limit a request where permitted by law (for example if disclosure would reveal confidential commercial information or another person's personal information).

13. Children

The Site and our services are directed to businesses and adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please contact us and we will take reasonable steps to delete it.

14. Third-party websites and client sites we build

The Site may link to third-party sites (for example Cal.com, portfolio client sites, or social profiles). Those sites have their own privacy practices. We are not responsible for their content or policies. Separately, websites we design and launch for clients are operated by those clients (or under their instructions). Each client is generally responsible for their own privacy policy, cookie practices, and compliance for their business, unless we have agreed in writing to handle a specific compliance task for them.

15. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes will be posted on this page. Continued use of the Site after an update means you are informed of the revised policy. For significant changes that affect how we handle personal information already collected, we will take additional steps where required by law (for example a notice by email for active clients).

16. Contact and complaints

Questions, requests, or complaints about this policy or our privacy practices:

Into the Flavor Inc.
Wasaga Beach, Ontario, Canada
[email protected]
(249) 499-0309

If you are not satisfied with our response, you may have the right to contact the Office of the Privacy Commissioner of Canada or another applicable regulator, depending on your circumstances.