Privacy Policy

1. Introduction

Webblyfy ("we," "our," "us") is a digital agency based in Toronto, Ontario, Canada. We respect your privacy and are committed to handling personal information responsibly, in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and other privacy laws that apply to our business.

This Privacy Policy explains what personal information we collect, why, how we use and share it, and the choices you have. It applies to webblyfy.ca, our subscription apps (Webblyfy GridRank, Pulse, Forge, Atlas, Sphere, Beacon, and any other Webblyfy-branded software), and our professional services.

2. Information We Collect

We collect the categories of personal information described below. Whether we collect a given item depends on how you interact with us.

Category	Examples
Contact info	Name, business name, role, email, phone, mailing address.
Account info	Login credentials, profile preferences, subscription plan, billing history.
Project info	Project briefs, brand assets, campaign data, audience descriptions, content you upload to our Apps.
Payment info	Billing address, partial card data, payment status. Full card data is handled by our PCI-DSS-compliant payment processors — we do not store it.
Technical info	IP address, device and browser type, operating system, language, time zone, referring URL.
Usage info	Pages and features you use, time spent, clicks, search queries within the Apps, error logs.
Marketing data	Email engagement (opens, clicks), survey responses, communication preferences.
Communications	Messages, support tickets, call summaries, meeting recordings (with consent).

3. How We Collect It

• Directly from you — when you fill out forms, request a quote, sign a Statement of Work, subscribe to an App, email or call us, or upload content.
• Automatically — through cookies and similar technologies as you use the Site and the Apps (see Section 11).
• From third parties — including Google Ads, Meta, Google Analytics, Google Cloud, payment processors, CRM and email tools, identity providers, and publicly available business sources, where lawful.
• Through your clients or employees — when you ask us to operate accounts or campaigns that involve their personal information; in those cases you are the controller and we are the processor.

4. Why We Collect It (Purposes)

We collect personal information for purposes that a reasonable person would consider appropriate, including to:

• Provide, operate, secure, and improve the Site, Apps, and Services.
• Respond to inquiries, send quotes, and onboard new clients.
• Bill, collect payments, and prevent fraud.
• Send service emails, transactional notifications, and (with consent) marketing.
• Comply with legal obligations, enforce our Terms, and protect our rights.
• Generate aggregate analytics and benchmarks that do not identify you.

We will not use personal information for new purposes that are inconsistent with what you reasonably expect, without first obtaining your consent.

5. Consent

We rely on different forms of consent depending on the sensitivity of the information and the context:

• Express consent — for marketing communications (CASL), processing sensitive information, or anything where a reasonable person would expect to be asked.
• Implied consent — when you voluntarily provide information for a clear and obvious purpose (for example, sending us an email asking a question).
• Deemed consent — limited situations recognized under PIPEDA or CASL (for example, an existing business relationship).

You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may limit our ability to provide Services.

6. How We Use Information

We use personal information only for the purposes for which it was collected, or for compatible purposes. Common uses include account management, providing Services, sending alerts and updates, marketing to clients and prospects who have consented, analytics, security monitoring, and meeting our legal obligations.

We do not sell your personal information. We do not use your Client Content to train general-purpose AI models without your explicit permission. Where AI tools are used to deliver Services (for example, generating copy or analyzing campaigns), we choose providers that contractually commit to not training on customer data.

7. Sharing & Sub-processors

We share personal information only as needed and only with parties bound by appropriate confidentiality and security obligations. Categories include:

• Service providers and sub-processors — cloud hosting (Google Cloud), payment processing, customer support, email delivery, analytics, error monitoring, and AI providers.
• Ad and marketing platforms — when you authorize us to manage campaigns on your behalf (Google Ads, Meta, TikTok, LinkedIn, YouTube, etc.).
• Professional advisors — lawyers, auditors, accountants, and insurers under confidentiality.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, with appropriate safeguards.
• Authorities — when required by law, a valid legal demand, or to protect rights, property, or safety.

We will provide a current list of significant sub-processors on request to privacy@webblyfy.ca.

8. International Transfers

Some of our service providers store or process information outside of Canada (for example, in the United States, the European Union, or other regions). When this happens, your personal information may become subject to the laws of those countries, including lawful access by foreign authorities. We use reasonable contractual, technical, and organizational measures to protect personal information in cross-border transfers.

9. Retention & Deletion

We retain personal information only as long as needed for the purposes described in this Policy or as required by law (including tax, accounting, and limitation-period obligations). Typical retention windows:

• Prospects — up to 24 months after last meaningful contact, then deleted or anonymized.
• Active clients — for the duration of the engagement plus 7 years for accounting records.
• App data — for the lifetime of the subscription, plus 30 days after cancellation, after which it is deleted unless we are legally required to retain it.
• Marketing lists — until you unsubscribe, then suppression records are kept to honour the opt-out.

You can request earlier deletion subject to legal and contractual constraints (see Section 13).

10. Security

We use reasonable physical, technical, and administrative safeguards to protect personal information, including:

• Encryption in transit (HTTPS/TLS) and at rest for sensitive data stores.
• Role-based access controls and the principle of least privilege.
• Multi-factor authentication on admin accounts.
• Regular backups, monitoring, and patching of our infrastructure on Google Cloud.
• Vendor due diligence and contractual security obligations.
• Employee confidentiality agreements and security awareness training.

No method of transmission or storage is 100% secure, but we work hard to maintain a safeguard level proportional to the sensitivity of the information.

11. Cookies & Tracking Technologies

The Site and Apps use cookies, local storage, pixels, and similar technologies to make things work, remember preferences, measure performance, and (with your consent) deliver marketing.

The categories we use:

• Strictly necessary — required for the Site to function (e.g., session, security, theme preference). These cannot be disabled.
• Analytics — help us understand how visitors use the Site (e.g., Google Analytics) so we can improve it. Aggregated and pseudonymized where possible.
• Marketing — used to measure ad performance and serve relevant ads (e.g., Google Ads, Meta Pixel). Only used with your consent where required.
• Functional — remember small preferences (e.g., dark/light mode).

You can control cookies through your browser settings and, where we offer one, through our cookie banner. Disabling certain cookies may affect Site functionality.

12. Marketing Emails (CASL)

When we send commercial electronic messages, we comply with CASL. That means we:

• Send only with your express or implied consent, or to an existing business or non-business relationship as defined by CASL.
• Clearly identify Webblyfy as the sender and include our contact information.
• Provide a working unsubscribe mechanism in every commercial email.
• Process unsubscribe requests within 10 business days.

To unsubscribe, use the link at the bottom of any marketing email or contact privacy@webblyfy.ca. Transactional and service-related messages will continue while you have an active relationship with us.

13. Your Rights

Subject to legal and contractual limits, you have the right to:

• Access your personal information and learn how it has been used and disclosed.
• Correct inaccuracies in your personal information.
• Withdraw consent for future processing (including marketing).
• Request deletion of personal information that is no longer needed.
• Object or complain to us, and to escalate to the Office of the Privacy Commissioner of Canada if your concern is not resolved.

To exercise any of these rights, email privacy@webblyfy.ca. We will respond within 30 days, or explain any delay or refusal in writing.

14. Children

Our Site, Apps, and Services are intended for businesses and individuals 18 or older. We do not knowingly collect personal information from anyone under 13, and we do not market to minors. If you believe a child has provided personal information to us, please contact us so we can delete it.

15. Breach Notification

If a breach of security safeguards creates a real risk of significant harm to affected individuals, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA. We will also keep records of all breaches of security safeguards for at least 24 months.

16. Changes to this Policy

We may update this Privacy Policy as our business, services, and applicable laws evolve. We will post the new version on this page, update the "Last updated" date, and where the change is material, provide reasonable notice to active users and clients (typically by email).

17. Contact Our Privacy Officer

Webblyfy's Privacy Officer is available to answer questions about this Policy or your personal information.

Privacy Officer — Webblyfy
Toronto, Ontario, Canada
Email: privacy@webblyfy.ca
General: hello@webblyfy.ca