Privacy Policy
1. About this policy
MapleGrowth Digital (“we”, “us”, “our”) is a digital marketing agency based in Mississauga, Ontario, Canada. This policy describes how we collect, use, share, and protect personal information when you visit our website at www.maplegrowthdigital.ca and interact with our forms.
This policy applies to our website only. Engagements with us as clients are governed by the separate agreements we sign with you.
We aim to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Law 25 where applicable, Canada’s Anti-Spam Legislation (CASL), the General Data Protection Regulation (GDPR) for EEA/UK visitors, and the California Consumer Privacy Act (CCPA/CPRA) for California residents.
2. Information we collect
Information you provide
- Newsletter signup — your email address (and optionally first name) when you subscribe to The Maple Brief.
- Configure-your-engagement wizard — your name, email address, business stage, primary goal, interested services, budget range, and any free-text notes you choose to include.
- Booking widget — your name, email, time zone, answers to any custom questions associated with the booking type, and the selected meeting time. Booking records are managed by our calendar provider, TidyCal.
Information collected automatically
- IP address — temporarily logged by our rate limiter (Upstash Redis) to prevent abuse of our forms and booking endpoint.
- Browser and device data — user agent string, referring page, and pages you visit, used by our analytics provider (Vercel Analytics) in aggregated form.
- CAPTCHA challenge data — Cloudflare Turnstile evaluates browser characteristics and behaviour to distinguish humans from bots before our forms accept submissions.
Local browser storage
- Theme preference (localStorage key
mgd:theme) — remembers your light/dark choice. - Cookie consent record (localStorage) — remembers your response to our cookie banner so we don’t re-ask.
- Session UI state (sessionStorage) — dismissal of the sticky bottom CTA and similar non-tracking UI state.
3. How we use information
- To deliver The Maple Brief newsletter to subscribers.
- To respond to inquiries and prepare for booked calls or project conversations.
- To schedule, confirm, reschedule, or cancel meetings.
- To understand how our website is used (aggregated, anonymised traffic patterns) so we can improve it.
- To prevent abuse, spam, and fraud (rate limiting, CAPTCHA, honeypots).
- To comply with legal obligations and respond to lawful requests.
4. Legal basis for processing (GDPR / UK GDPR)
If you are in the EEA or UK, our legal bases are:
- Consent — for the newsletter and any optional marketing communications. You can withdraw consent at any time.
- Contractual necessity — when you submit the wizard, ask for a quote, or book a meeting, we need your information to respond.
- Legitimate interests — for analytics, security, and abuse prevention. We balance these against your privacy rights.
- Legal obligation — when we must retain or disclose information by law.
6. How long we keep information
- Newsletter subscribers — until you unsubscribe or we close the audience.
- Wizard / inquiry submissions — up to 24 months after our last contact with you, unless a longer period is required to fulfil an obligation.
- Booking records — retained per TidyCal’s policy, typically as long as the booking history is meaningful for accounting and follow-up.
- Rate-limit IP records — automatically expire within minutes to hours (sliding window).
- Server logs — typically 30 days, longer if needed for security investigation.
7. International data transfers
Some of our service providers are based outside Canada (predominantly the United States). When we transfer your information internationally, we rely on the contractual commitments of those providers, including standard contractual clauses or equivalent safeguards where required by GDPR.
8. Your rights
You have the right to:
- Know what personal information we hold about you.
- Access and request a copy of it.
- Correct inaccuracies.
- Request deletion (subject to legal exceptions, e.g. we may need to keep certain records to comply with tax or anti-spam laws).
- Withdraw consent at any time.
- Object to processing based on legitimate interests.
- Receive a portable copy of information you provided.
- Unsubscribe from the newsletter — one-click link in every email.
- File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your local data protection authority.
To exercise any of these rights, email info@maplegrowthdigital.ca. We will respond within 30 days.
10. Children’s privacy
Our services are not directed at children under 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.
11. Security
We use HTTPS site-wide, modern security headers (HSTS, CSP, referrer policy, frame protection), CAPTCHA on public forms, and rate limiting to make abuse expensive. We restrict access to personal data to people who need it to do their jobs. No system is perfectly secure; we do our best.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where practical, give notice through the website. Continued use of the site after a change indicates your acceptance.
13. Contact us
Privacy questions, data requests, or concerns:
MapleGrowth Digital
363 Lakeshore Rd E, Mississauga, ON L5G 1H7, Canada
info@maplegrowthdigital.ca
+1 (431) 726-1578