Privacy Policy

Who we are

Canopytech Resources Ltd. is an IT services provider based in the Greater Toronto Area, Ontario, Canada. This policy explains what happens to personal information when you use canopytech.ca.

It covers this website only. If you are a client, the handling of data inside systems we manage for you is governed by your service agreement with us, not by this page.

What we collect

There are three ways this website deliberately collects information from you. Two further things happen as a by-product of running a website at all — IP addresses used for rate limiting, and our CDN provider seeing connection data — and both have their own sections below.

• Information you type into a form

  Our contact form asks for your name, email address, phone number, company and message. The whitepaper download form asks for your name, email address, phone number and company. That is all either form collects, and all of it is optional in the sense that you can simply not use the form — nothing on this site requires an account.

• A domain name, if you use the Email Spoofing Check

  That tool needs to look up public DNS records, which cannot happen inside your browser, so the domain you type is sent to our server. We look up its SPF, DKIM and DMARC records using public resolvers and return the result. We do not store the domain, and we do not keep a record of who checked what.

• Ordinary web analytics

  Which pages are viewed, roughly where visitors come from, and what kind of device they used. This is described in its own section below, because it is the part where a third party is involved.

What we deliberately do not collect

Our calculators run entirely inside your browser — the IT Risk Calculator, the Managed IT Quote Checker, and the backup cost calculator on our backup solutions page. Your answers are never sent to us, never stored, and never logged. That is not a promise resting on good intentions: an automated check runs every time this site is built, and it fails the build if any of those scripts gains a way to transmit or save an answer.

For the same reason, Google Analytics is not loaded at all on any page under our free tools section. Those pages' "email these results" links put your answers into a message you send yourself, and we would rather not have a third-party tracker anywhere near them. Our own analytics is configured to ignore those links. To be precise about the one exception: the backup cost calculator sits on a services page rather than under free tools, so analytics does run on that page — but its answers stay in your browser exactly like the others, and it has no share link.

We do not sell personal information, and we do not use it to build advertising profiles or target ads at you. Google's advertising features — Google Signals and ad personalisation — are switched off in our configuration of Google Analytics, which means the cross-device and remarketing side of that product is not active for this site.

Why we collect it, and your consent

Form submissions are used to answer you, to prepare a quote or proposal, and to keep a record of the conversation. If you ask us for something specific, such as a whitepaper, we send you that.

We may follow up about the enquiry you made. We do not add you to a marketing list on the strength of a contact form alone, and anti-spam law in Canada is the reason: marketing email needs your consent, asked for separately, and you can withdraw it at any time.

Analytics is used to understand which pages are useful and where people get stuck. It informs what we write next; it is not used to target you.

Analytics and cookies

This site uses two analytics tools, and they are not equivalent from a privacy standpoint.

• Matomo — self-hosted, on our own infrastructure

  Matomo runs on a server we operate at analytics.canopytech.ca. The data it collects stays with us and is not shared with the vendor or anyone else, because there is no third party in the path.

• Google Analytics 4 — a third party, outside Canada

  Google Analytics collects your IP address, a randomly generated client identifier stored in a cookie, the pages you view, the site that referred you, and general device and approximate location information. This is processed by Google, including on servers in the United States, and is therefore subject to the laws of that country. Google's advertising and cross-device features are disabled in our configuration, and Google Analytics is not loaded on our free tools pages at all.

Both tools set cookies in your browser, and you can block or delete them in your browser settings. Matomo can be configured to honour a browser's "do not track" signal, and Google Analytics does not act on it at all — which is one more reason we run our own.

If you would rather not be measured by Google at all, a browser-level content blocker is the most reliable way to achieve that, and nothing on this site will break if you use one.

Who else is involved

• Our own CRM

  Form submissions go into a customer system we host and operate ourselves. It is not a third-party sales platform, and your details are not uploaded to one.

• Cloudflare

  This site is served through Cloudflare, which sits between your browser and our server. Cloudflare processes connection information, including your IP address, in order to deliver the site and protect it from attack.

• Google

  Analytics only, as described above.

• Calendly

  Our booking page embeds Calendly so you can pick a meeting time. Anything you enter into that widget is handled by Calendly under their own privacy policy, not this one. Every other page on this site works without it.

• Public DNS resolvers

  The Email Spoofing Check queries public DNS resolvers operated by Cloudflare and Google. They see the domain being looked up, which is public information by design, and they see our server rather than you.

IP addresses

Our contact form and Email Spoofing Check apply rate limits so they cannot be abused to send bulk mail or hammer DNS. Doing that requires recognising repeat requests, which we do using your IP address.

Those records are held in the server's memory only. They are never written to disk, they expire within minutes, and they are erased entirely whenever the application restarts. They are not used to identify you or linked to anything else.

How long we keep things

• Form submissions and client records

  Kept for as long as we are working together and for a reasonable period afterwards, so we can honour warranties, answer questions about past work, and meet our record-keeping and tax obligations. You can ask us to delete yours at any time, subject to those obligations.

• Analytics

  Retained according to each tool's configured retention period, after which it is deleted or aggregated so that individual visits are no longer distinguishable.

• Rate-limiting records

  Minutes, in memory, as described above.

• Free tool answers

  Never collected, so there is nothing to keep.

How we protect it

The site is served over HTTPS only, so what you send from your browser is encrypted in transit. Form submissions are rate limited and validated before they reach our systems, and access to the customer system holding them is limited to the people who need it for their work.

We are a security company and we would rather be straightforward than reassuring: no system is immune. If personal information in our care were compromised in a way that created a real risk of significant harm, we would notify the people affected and the Office of the Privacy Commissioner of Canada, as the law requires.

Your rights

Under Canadian privacy law, principally the Personal Information Protection and Electronic Documents Act, you have the right to ask us what personal information we hold about you and to have it corrected if it is wrong. You can also withdraw your consent at any time, including consent to marketing contact, and every marketing email we send includes a way to do that. Separately from those statutory rights, you can ask us to delete what we hold, and we will unless we are required to keep it — see how long we keep things above.

Ask us using any of the methods below. We will respond within thirty days, and we will not charge you for a reasonable request. If you are not satisfied with how we have handled it, you are entitled to complain to the Office of the Privacy Commissioner of Canada.

Children

This site is aimed at businesses. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact us and we will remove it.

Changes to this policy

If we change what this site collects, we update this page and the date at the top of it. Material changes are worth re-reading; the date is there so you can tell whether anything has moved since you last looked.