Privacy Policy

BUILDWISE DIGITAL — web + AI automation, Brampton, Ontario. Last updated: 4 August 2026.

This policy explains how I handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA has no small-business exemption — it applies in full.

1. Who is accountable (Privacy Officer)

BUILDWISE DIGITAL is accountable for the personal information handled here. Questions, access requests, or complaints: [email protected].

2. What I collect, and why

Information	When	Why
Name, email, message	You email me or send an enquiry	To answer you and scope a possible project
AI assistant chat messages	You use the demo assistant	To generate a reply and monitor quality/cost
IP address + request counts	Automatically, on each assistant request	Security and abuse-prevention (rate limiting)
Social media account access (business account IDs, page IDs, access tokens)	You engage the social media management service and grant access	To publish posts you have approved, and to read your own post metrics for your monthly report
Photos and captions you send us	You submit them for posting	To prepare and publish social posts for your business
Public comments and reviews on your accounts	Where you ask us to help respond	To draft replies for your approval

I do not sell personal information and do not use it for advertising. I ask only for what the stated purpose requires.

2a. Social media management — what this service does and does not do

If you engage the social media management service, you grant access to your business's own social accounts (for example Instagram, Facebook Page, Google Business Profile) so that posts you have approved can be published on your behalf.

• Access is granted by you, and revocable by you at any time — through Meta Business Suite or Google Business Profile. I never ask for, store, or use your account password.
• I act only on your own business accounts, never on those of anyone else, and only for the purposes you have engaged me for.
• I access only what the service needs: publishing approved content, and reading metrics for your own posts and page to produce your report.
• I do not collect or store your followers' or customers' personal information, do not build audience profiles, and do not use any data obtained through these platforms for advertising, resale, or training AI models.
• Nothing is published without your approval, unless you explicitly enable automatic approval in writing in your agreement.
• Access tokens are stored encrypted in server-side environment configuration, never in client-side code, and are deleted when your engagement ends.

Content you supply for posting remains yours. You are responsible for holding the rights to photos you send, and for the accuracy of factual claims about your own business.

3. Consent

I collect and use personal information with your consent. Using the assistant or emailing me is your consent for the purposes above. For any new purpose, I would ask again first. You may withdraw consent at any time (subject to legal limits) by emailing the Privacy Officer.

4. Third parties & cross-border processing

The AI assistant sends your chat messages to Anthropic PBC (United States) for the AI response, hosted via Vercel Inc. (United States). Your information is therefore processed outside Canada and may be accessible under U.S. law. These vendors are configured to exclude your data from AI model training where that setting is offered.

For the social media management service, additional processors are involved: Meta Platforms, Inc. (United States) for Instagram and Facebook publishing and metrics, and Google LLC (United States) for Google Business Profile. Captions are generated using Anthropic PBC (United States). Your information is therefore processed outside Canada and may be accessible under U.S. law. Your use of Instagram and Facebook also remains subject to Meta's own privacy policy.

5. How long I keep it

• Enquiry emails: kept for the life of the enquiry, then deleted.
• Assistant usage logs (including IP): kept only as long as needed for security and cost monitoring — target 90 days — then purged.
• Project records: kept as needed for the engagement and tax/legal record-keeping, then deleted.
• Social media access tokens: deleted within 30 days of your engagement ending, or immediately on request. You may also revoke access yourself at any time from your Meta or Google account.
• Photos and draft captions you send: kept for the life of the engagement, then deleted on request. Published posts remain on your own accounts, under your control.

6. How I protect it

Access is limited to the Privacy Officer. API keys live only in server-side environment variables, never in client code. Connections use HTTPS. The data footprint is deliberately small (short retention, nothing sold).

7. Your rights

You may ask what personal information I hold about you, ask me to correct it, or ask me to delete it. Email the Privacy Officer; I respond within a reasonable time (generally 30 days).

8. Complaints

If you are not satisfied with my response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376).

9. Changes

I may update this policy; the "last updated" date shows the current version.