Privacy Policy

• This website sets no cookies, runs no analytics and loads no tracking pixels.
• If you fill in the consultation form, we use your answers to prepare your lead brief and to reply to you. We do not sell them or add you to a marketing list.
• We research business contact information about people in their professional capacity, from public and licensed business sources, and provide it to the client who commissioned the research.
• We do not send outreach for clients. Clients send their own messages from their own accounts.
• Anyone can ask to be removed from our research and added to our permanent suppression list, at any time, through our Do Not Contact page.

[LEGAL ENTITY NAME], operating as SignalOrbit (“we”, “us”), is responsible for the information described in this policy. Our mailing address is [BUSINESS MAILING ADDRESS] and our privacy contact is [PRIVACY CONTACT EMAIL].

We operate from Canada and provide services to businesses in Canada and the United States. This policy is written to meet our obligations under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable United States privacy and anti-spam laws.

We deliberately keep this site free of tracking. It sets no cookies, uses no analytics product, and embeds no advertising or social media pixels. Fonts are served from our own domain, so viewing the site does not report your visit to a third party.

Our hosting provider records standard server logs when a page is requested, including:

• the IP address the request came from
• the page requested, the time, and the response
• the browser user agent string

These logs exist to keep the site running and secure, and are retained according to our hosting provider’s standard schedule. Our contact form endpoint also holds IP addresses in memory for roughly ten minutes to limit how many submissions one connection can make. That short-lived record is never written to disk or shared.

When you submit the consultation form, we collect:

• your name
• your work email address
• your company website
• the audience you want to reach, and the outcome you are aiming for, in your own words
• the time of submission and the browser user agent string, which help us spot automated abuse

We use this to prepare your lead brief, to quote for the work, and to reply to you about your enquiry. We do not use it for unrelated marketing, we do not sell it, and we do not add you to any list we supply to anyone else.

Submissions are delivered to our own inbox or customer records through the provider named in the list of service providers below. We keep enquiries for 24 months from your last contact with us, then delete them, unless you become a client and we need them for our records.

The core of our service is researching businesses that fit a client’s written target, and identifying the person who makes the relevant decision. About those people we may record:

• name, job title and employer
• a work email address, and sometimes a work phone number or a professional profile URL
• publicly reported facts about the business, such as a new location, a published job posting or an announcement, each stored alongside the source it came from

We collect this from public and licensed business sources. We do not:

• collect personal email addresses, home addresses or personal phone numbers
• collect information about anyone in a personal or consumer capacity
• collect sensitive information such as health, financial, biometric or political data
• take information from behind a login, a paywall, or any source whose terms prohibit it
• buy consumer marketing lists

Under PIPEDA, business contact information that is collected, used and disclosed solely to communicate with someone about their employment, business or profession is excluded from the Act’s consent requirements. Our research is intended to fall within that exclusion. We nevertheless apply the protections in this policy to those records, and we honour deletion requests regardless of whether the law obliges us to.

We provide each record only to the client who commissioned that research. We do not publish records, resell them, or supply the same record to several clients as a packaged list.

We keep prospect records for the duration of the client engagement and for up to 24 months afterwards, then delete them. There is one exception: when someone asks not to be contacted, we keep the minimum information needed to enforce that (typically the email address and domain) on a suppression list indefinitely, because deleting it would let the same person be researched and contacted again later.

We share information in four situations, and no others:

• With the client who commissioned the research, for prospect records only.
• With service providers who operate parts of our business under contract: our website host ([HOSTING PROVIDER — e.g. Vercel]), our form delivery and email provider ([EMAIL / CRM PROVIDER]), and our research data sources ([DATA SOURCES]). They may use the information only to provide their service to us.
• Where the law requires it, such as a valid court order or a lawful request from a regulator. We will tell you unless we are legally prohibited from doing so.
• If the business is sold or merged, in which case the buyer is bound by this policy until it gives notice of any change.

We do not sell personal information, and we do not share it for advertising.

Our website, records and email are hosted on servers located in Canada and the United States. Information stored in the United States, or handled by a provider based there, may be accessible to United States courts and law enforcement under that country’s laws. If you would prefer your enquiry not be processed on that basis, contact us at [PRIVACY CONTACT EMAIL] instead of using the form.

• All traffic to this website is encrypted in transit using HTTPS.
• Access to client and prospect records is limited to the people who need it to do the work.
• Accounts used to run the business are protected with multi-factor authentication where the provider supports it.
• We collect the minimum we need, which is the most reliable protection of all.

No method of transmission or storage is completely secure. If a breach occurs that creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Whoever you are, and wherever you are, you may ask us to:

• tell you what information we hold about you and where we obtained it
• correct anything inaccurate or out of date
• delete your information and stop researching you
• stop contacting you, permanently

Write to [PRIVACY CONTACT EMAIL] or use the Do Not Contact page. We respond within 30 days, as PIPEDA requires. We may ask you to confirm your identity before we release information, but never more than we need to match you to a record.

In Canada: if you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

In the United States: residents of California, Virginia, Colorado, Connecticut, Utah and other states with comprehensive privacy laws have rights to access, correct, delete and opt out of the sale or sharing of personal information. Those laws apply to us only if we meet their thresholds, which as a small business we may not. We honour access and deletion requests from anyone in the United States regardless, and we do not sell personal information or use it for targeted advertising.

This is a business-to-business service. It is not directed at children, and we do not knowingly collect information about anyone under 18. If you believe we have, tell us and we will delete it.

When we change how we handle information, we update this page and change the effective date at the top. If the change is material, we will say so plainly here rather than hoping you notice. Previous versions are available on request.