Privacy Policy

We only collect what we need to run our website, our marketing, and our client conversations.

• Information you give us. When you fill in a lead form, book a call, or contact us: your name, work email, phone number, brand or company name, and anything you write in a message field.
• Newsletter details. Your name and email when you subscribe to The Saura Dispatch, plus your confirmation (double opt-in) timestamp.
• Technical and usage information. IP address, browser and device type, pages viewed, time on page, referring URL, and campaign parameters (UTM tags, click identifiers such as fbclid and gclid).
• Cookie and identifier data. First-party analytics identifiers and advertising cookies described in section 3.

We do not knowingly collect sensitive personal information (health, financial account, or government ID data) and we do not target our services to children.

• To respond to your enquiry and follow up about working together (see section 5).
• To send you the newsletter and marketing emails you consented to receive.
• To measure website performance and improve our content and pages.
• To plan, run, measure, and optimise advertising campaigns on Meta (Facebook and Instagram) and Google Ads (see section 4).
• To keep records, prevent abuse or fraud, and meet legal obligations.

Our legal basis in Canada is your consent — express consent for marketing email under CASL, and implied or express consent for analytics and advertising as described below. You can withdraw consent at any time (section 8).

Cookies are small files stored by your browser. We and our providers use them for the following purposes:

• Strictly necessary. Keep the site working, remember form state, and protect against abuse. These cannot be turned off from within the site.
• Analytics. Google Analytics 4 (_ga cookies) and Hotjar (_hj cookies) tell us which pages get read, how people scroll, and where they drop off. Hotjar records anonymised interaction data; we do not use it to identify individuals.
• Advertising. The Meta Pixel (_fbp, _fbc) and Google Ads tags let us measure conversions and show relevant ads to people who have visited the site.

You can block or delete cookies in your browser settings, use your browser's "do not track" or private mode, and opt out of interest-based advertising at YourAdChoices Canada. Blocking cookies may affect how parts of the site work.

We advertise on Meta platforms (Facebook, Instagram) and on Google Ads, including search and Performance Max campaigns. To know whether those ads work, we measure conversions in two ways:

• Browser-side tags. The Meta Pixel and Google tags load in your browser and record events such as page views, form views, lead submissions, and newsletter subscriptions.
• Server-side conversions. We also send the same events from our server to Meta's Conversions API (and to Google's conversion endpoints where applicable). This improves accuracy when browser tags are blocked. Contact details included in those events — email, phone number, first and last name — are hashed with SHA-256 in our systems before transmission, so the ad platform receives an irreversible code, not your plain contact details. We also transmit your IP address, user agent, and the Meta cookie identifiers so events can be matched and de-duplicated against the browser event.

These platforms use that data to attribute conversions, build audiences (including similar or lookalike audiences), and optimise delivery. Meta and Google act as independent controllers of the data they receive and process it under their own terms: Meta Privacy Policy and Google Privacy Policy.

We never sell your personal information, and we do not send special-category data (health, finances, sexual orientation, political views) to any advertising platform.

When you submit a form on this site, this is exactly what happens:

1. Your details are sent over an encrypted (HTTPS) connection to our server and stored in our CRM and email platform, Brevo, together with the campaign source that brought you here (UTM tags and referrer).
2. A member of our team — usually the founder — reviews the submission and replies by email, and by phone or text if you gave us a number, normally within one to two business days. This follow-up is a direct response to your request, so we treat it as a business communication you asked for.
3. If you ticked the marketing consent box or subscribed to the newsletter, Brevo sends you a double opt-in confirmation email. You are only added to our marketing list after you click the confirmation link — this is how we meet CASL's express consent requirement.
4. A hashed, de-identified version of the conversion event is sent to Meta and Google as described in section 4.

Every marketing email includes an unsubscribe link, our identity, and our contact details, as required by CASL. Unsubscribing stops marketing email; it does not stop replies to a conversation you started.

We share personal information only with providers who help us operate, and only for that purpose:

• Brevo — CRM, email delivery, newsletter consent records (EU).
• Supabase — database and storage for site content and form submissions.
• Google (Analytics, Ads) and Meta — measurement and advertising.
• Hotjar — anonymised usage analytics.
• Hosting and infrastructure providers — serving the website.
• Calendar and video tools when you book a call with us.

Some of these providers store or process data outside Canada, including in the United States and the European Union. While data is outside Canada it may be accessible to foreign courts, law enforcement, or regulatory authorities under the laws of that country. We use providers that apply contractual and technical safeguards comparable to our own.

We may also disclose information if required by law, to enforce our agreements, or in connection with a business transaction such as a merger or sale, in which case the recipient remains bound by this policy.

We keep lead and enquiry records for as long as we have an active or prospective relationship with you, and for up to 24 months after our last contact, unless you ask us to delete them sooner or we must keep them for legal or accounting reasons. Newsletter records are kept until you unsubscribe, plus a suppression record so we do not email you again. Analytics data is kept on the retention schedules set in Google Analytics and Hotjar.

We protect information with encryption in transit, access controls, role-based permissions on our database, and limiting access to the people who need it. No system is perfectly secure, but we will notify you and the Office of the Privacy Commissioner of Canada if a breach creates a real risk of significant harm, as PIPEDA requires.

Under Canadian privacy law you can:

• Ask what personal information we hold about you and request a copy.
• Ask us to correct information that is inaccurate or incomplete.
• Withdraw your consent and ask us to delete your information, subject to legal limits.
• Unsubscribe from marketing email at any time using the link in any email.
• Opt out of analytics and advertising cookies through your browser or the links in section 3.
• Complain to the Office of the Privacy Commissioner of Canada if you are not satisfied with our response.

Email hello@saura.io and we will respond within 30 days, as PIPEDA requires. We may need to verify your identity before acting on a request.

We update this policy when our tools or practices change. The date at the top always reflects the current version. Material changes will be highlighted on this page.

Privacy questions and requests go to our privacy contact:
Saura Labs INC
Toronto, Ontario, Canada
hello@saura.io

Prefer to talk it through? Get in touch.