Privacy Policy

We only collect what we need to run our website, our marketing, and our client conversations.

• Information you give us. When you fill in a lead form, book a call, or contact us: your name, work email, phone number, brand or company name, and anything you write in a message field.
• Newsletter details. Your name and email when you subscribe to The Saura Dispatch, plus your confirmation (double opt-in) timestamp.
• Technical and usage information. IP address, browser and device type, pages viewed, time on page, referring URL, and campaign parameters (UTM tags, click identifiers such as fbclid and gclid).
• Cookie and identifier data. First-party analytics identifiers and advertising cookies described in section 3.

We do not knowingly collect sensitive personal information (health, financial account, or government ID data) and we do not target our services to children.

• To respond to your enquiry and follow up about working together (see section 5).
• To send you the newsletter and marketing emails you consented to receive.
• To measure website performance and improve our content and pages.
• To plan, run, measure, and optimise advertising campaigns on Meta (Facebook and Instagram) and Google Ads (see section 4).
• To keep records, prevent abuse or fraud, and meet legal obligations.

Our legal basis in Canada is your consent: express consent for marketing email under CASL, and your choice in our cookie banner for analytics and advertising (section 3). You can withdraw consent at any time (section 8).

Cookies are small files stored by your browser. We and our providers use them for the following purposes:

• Strictly necessary. Keep the site working, remember form state, and protect against abuse. These cannot be turned off from within the site.
• Analytics. Google Analytics 4 (_ga cookies) and Hotjar (_hj cookies) tell us which pages get read, how people scroll, and where they drop off. Hotjar records anonymised interaction data; we do not use it to identify individuals.
• Advertising. The Meta Pixel (_fbp, _fbc) and Google Ads tags let us measure conversions and show relevant ads to people who have visited the site.

Your choice comes first. Visitors in Canada, the European Union, the UK and Switzerland, and anyone whose location we can't tell, see a cookie banner. Analytics and advertising tools stay switched off until you say yes, and saying no is just as easy. Elsewhere these tools are on by default and you can switch them off at any time. If your browser sends a Global Privacy Control signal, we treat it as a no to advertising.

You can change your mind whenever you like through Cookie settings (also at the bottom of every page). Switching something off takes effect right away and removes its cookies from your browser. We keep a dated record of each choice (a random ID, what you chose, your country and the version of this notice) as proof of consent.

You can also block or delete cookies in your browser settings and opt out of interest-based advertising at YourAdChoices Canada.

We advertise on Meta platforms (Facebook, Instagram) and on Google Ads, including search and Performance Max campaigns. To know whether those ads work, we measure conversions in two ways:

• Browser-side tags. The Meta Pixel and Google tags load in your browser and record events such as page views, form views, lead submissions, and newsletter subscriptions.
• Server-side conversions. For visitors who allowed advertising, we also send the same events from our server to Meta's Conversions API. This recovers events the browser missed; it never reaches people who said no. We send your IP address, browser type and the Meta cookie IDs so each event is counted once. Only if you said yes to advertising in our cookie banner do we also include your email, phone number and name, hashed with SHA-256 in our systems before transmission, so Meta receives an irreversible code rather than your plain details. If you later book a call, we tell Meta that too, unless you have since switched advertising off.

These platforms use that data to attribute conversions, build audiences (including similar or lookalike audiences), and optimise delivery. Meta and Google act as independent controllers of the data they receive and process it under their own terms: Meta Privacy Policy and Google Privacy Policy.

We never sell your personal information, and we do not send special-category data (health, finances, sexual orientation, political views) to any advertising platform.

When you submit a form on this site, this is exactly what happens:

1. Your details are sent over an encrypted (HTTPS) connection to our server and stored in our CRM and email platform, Brevo, together with the campaign source that brought you here (UTM tags and referrer).
2. A member of our team — usually the founder — reviews the submission and replies by email, and by phone or text if you gave us a number, normally within one to two business days. This follow-up is a direct response to your request, so we treat it as a business communication you asked for.
3. If you ticked the marketing consent box or subscribed to the newsletter, Brevo sends you a double opt-in confirmation email. You are only added to our marketing list after you click the confirmation link — this is how we meet CASL's express consent requirement.
4. If you allowed advertising cookies, the conversion event is sent to Meta as described in section 4. If you came from a Meta (Facebook or Instagram) lead form, we tell Meta whether that lead went on to book a call, using the reference Meta gave us. Email hello@saura.io to opt out.

Every marketing email includes an unsubscribe link, our identity, and our contact details, as required by CASL. Unsubscribing stops marketing email; it does not stop replies to a conversation you started.

We share personal information only with providers who help us operate, and only for that purpose:

• Brevo — CRM, email delivery, newsletter consent records (EU).
• Supabase — database and storage for site content and form submissions.
• Google (Analytics, Ads) and Meta — measurement and advertising.
• Hotjar — anonymised usage analytics.
• Hosting and infrastructure providers — serving the website.
• Calendar and video tools when you book a call with us.

Some of these providers store or process data outside Canada, including in the United States and the European Union. While data is outside Canada it may be accessible to foreign courts, law enforcement, or regulatory authorities under the laws of that country. We use providers that apply contractual and technical safeguards comparable to our own.

We may also disclose information if required by law, to enforce our agreements, or in connection with a business transaction such as a merger or sale, in which case the recipient remains bound by this policy.

We keep lead and enquiry records for as long as we have an active or prospective relationship with you, and for up to 24 months after our last contact, unless you ask us to delete them sooner or we must keep them for legal or accounting reasons. Newsletter records are kept until you unsubscribe, plus a suppression record so we do not email you again. Analytics data is kept on the retention schedules set in Google Analytics and Hotjar.

We protect information with encryption in transit, access controls, role-based permissions on our database, and limiting access to the people who need it. No system is perfectly secure, but we will notify you and the Office of the Privacy Commissioner of Canada if a breach creates a real risk of significant harm, as PIPEDA requires.

Under Canadian privacy law you can:

• Ask what personal information we hold about you and request a copy.
• Ask us to correct information that is inaccurate or incomplete.
• Withdraw your consent and ask us to delete your information, subject to legal limits.
• Unsubscribe from marketing email at any time using the link in any email.
• Switch analytics and advertising cookies on or off anytime through Cookie settings (section 3).
• Complain to the Office of the Privacy Commissioner of Canada if you are not satisfied with our response.

Email hello@saura.io and we will respond within 30 days, as PIPEDA requires. We may need to verify your identity before acting on a request.

We update this policy when our tools or practices change. The date at the top always reflects the current version. Material changes will be highlighted on this page.

Privacy questions and requests go to our privacy contact:
Saura Labs INC
Toronto, Ontario, Canada
hello@saura.io

Prefer to talk it through? Get in touch.