Privacy Policy

1. Who we are, and the two roles we play

Paragon Media Canada (“Paragon”, “we”, “us”) is a web design and digital marketing business in the Niagara Region of Ontario, Canada.

We handle personal information in two distinct roles, and which one applies changes your rights and who you should ask:

• As the organization responsible — for information about visitors to this website, prospects, our clients and their team members, and our outreach specialists. This policy governs it and you can bring requests directly to us.
• As a service provider to our clients — for information submitted by members of the public to a form on one of our clients’ websites. The client decides what is collected and why; we process it under their instructions. Section 8 covers this in full.

We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles, and with Canada’s Anti-Spam Legislation (CASL) for the email we send. Where a visitor is in a jurisdiction with additional rights — for example the EU or the UK under the GDPR — we will honour the access, correction, deletion and portability rights described in section 12.

2. Information we collect from website visitors

• What you type into a form. Our contact form, call-booking form and pricing enquiry collect your name, email address, phone number, business name and whatever you write in the message. If you use the pricing builder, we also record the services and options you selected and the totals you were shown, so we can quote you the same thing you saw.
• Technical information about your request. Our hosting provider records the IP address, browser user-agent, URL and timing of requests, as ordinary server logs.
• Cookies and local storage. The ones needed to sign you in and to remember your display preferences, plus — only if you accept the consent card — Google Analytics cookies used to count visits. We do not use advertising cookies or tracking pixels. See the Cookie Policy.

3. Information we collect about prospective clients

We research businesses that might be a fit for our services. This uses publicly available business information — business name, address, phone number, website, Google Business Profile listing, reviews — and the notes we make from our own calls and emails with you. Where a business name is also a person’s name, that information is personal information and this policy applies to it.

We also record whether a call was booked, attended or missed, and the answers you give in a pre-call questionnaire.

4. Information we collect from clients and portal users

• Account: your name, email address, role, whether two-factor authentication is enabled, sign-in sessions, and your profile picture if you sign in with Google.
• Business: business name, contact details, service address, packages and services you have bought, project and service status, deliverables, tasks and change requests.
• Onboarding: the answers you give in the intake questionnaire — brand preferences, competitors, target customers, existing accounts and similar.
• Files: documents, photographs, logos and other files you or we upload, stored in Google Drive under our business account and shared into your portal.
• Billing: invoices, proposals, subscription status and payment history. Card details are handled by Stripe and are never stored on our systems.
• Communications: emails we send you and their delivery status, in-app notifications, support tickets and internal notes about your account.

5. Information we collect about outreach specialists

If you work with us on commission, we hold your account details, your commission tier and rate, the deals and referrals attributed to you, your payout records, and the targets you set for yourself. Applications for the role are submitted through a third-party form and are not held in this platform.

6. Why we use personal information

• To answer enquiries, prepare quotes and schedule calls
• To deliver, support and bill for the services you buy
• To operate the client portal and keep accounts secure
• To send transactional messages such as sign-in links and booking confirmations
• To send commercial messages where we have consent, with an opt-out in every one
• To measure how our own business is doing — revenue, pipeline, delivery workload
• To detect and prevent spam, abuse and fraud
• To meet legal and tax obligations

We do not sell personal information. We do not use client data or lead data to build audiences, and we do not share it with advertising networks.

7. Administrator access to portal accounts (“view as user”)

Disclosed plainly because it matters. A Paragon administrator can open the client portal as your account, in order to see the problem you are describing. This does not require your password and does not prompt you at the time.

The controls around it:

• Only an administrator can do it. It is refused for anyone else, and the attempt is recorded.
• It reduces what the administrator can do rather than increasing it: while active, they have exactly your account’s permissions and lose their own administrative ones.
• An administrator cannot open another administrator’s account this way.
• Every change made during such a session is written to an audit log — the real administrator’s identity, your account, what was done, when, from which IP address and browser, and whether it succeeded. Starting and ending the session are logged too.
• You may ask us at any time for a record of every time your account was accessed this way, and we will provide it.

Separately, administrators can see client records directly in our CRM as part of normal service delivery. That is ordinary administrative access to our own business records and is covered by section 4.

Multiple people on one client account. A client account can have an owner plus additional managers and read-only viewers. Anyone with access can see that business’s leads, files, invoices and project information. If you are added to a client account, the account owner — not Paragon — decides who has access. Ask them to remove you, or contact us and we will confirm with the owner.

8. Lead capture on our clients’ websites

This is the part of what we do that involves the most personal information about people who have never dealt with Paragon directly, so it is set out in detail.

Many of our clients’ websites send their contact-form submissions to an endpoint we operate. If you filled in a form on a local business’s website and are reading this, that is probably why you are here.

Whose information it is

It belongs to the business whose website you used. They decided what to ask you and what to do with your answer. We process it on their instructions, as their service provider. We do not use it for our own marketing, do not sell it, and do not combine it with anything else.

What is recorded with each submission

• The fields the form asked for — typically name, email, phone and a message
• The complete raw submission, including any additional fields the form sent
• The page the form was on, and the page that referred you to it
• Any campaign tags in the link you arrived through (for example utm_source)
• Your IP address and your browser’s user-agent string
• Any files you attached, which are stored in Google Drive under our business account
• The date and time

The IP address and user-agent are recorded to help the business tell a real enquiry from spam and to make sense of where an enquiry came from.

Who sees it

The business that owns the website, through their portal and by email; Paragon staff supporting that business; and the service providers in section 10 — our database and hosting providers, our email provider, Google Drive for attachments, and, where the business uses our spreadsheet-based lead pipeline, a Google Sheet the business and we both have access to. When a lead arrives we also post an internal alert to our own team channel on Discord.

Making a request about your information

Ask the business whose website you used — they decide. You may also contact us at the address in section 16 and we will pass your request to them and act on their instruction, unless the law requires us to act ourselves. Please tell us which website you used and roughly when, so we can find the right record.

Marketing

Filling in an enquiry form does not by itself give the business consent to send you marketing email. Under CASL, consent to market to you is separate from an enquiry, and our clients are responsible for obtaining it. We do not send commercial email to a client’s leads on their behalf without their confirmation that they have it.

9. Artificial intelligence

We use AI services from Anthropic (Claude) and Google (Gemini) to research prospective client businesses and to draft reports and summaries for our own use. What is sent to them is business information about the prospect — business name, website, location, industry and publicly available web research about them — together with our prompt. These services may perform live web searches as part of that research.

We do not send client lead data, portal files, intake answers or billing records to an AI provider for training, and the AI features in our internal console can only read our records — they cannot change them, and they cannot send anything to a client. Every AI output is reviewed by a person before it is used or shared. No decision that materially affects you is made by an AI system on its own.

10. Service providers who receive personal information

We use the providers below. Each acts on our instructions and is bound by its own agreement with us. Which ones apply depends on which of our services you use.

We may also disclose personal information where the law requires it, to enforce our agreements or protect our rights, or as part of a sale or reorganization of the business — in which case the buyer would be bound by this policy for information transferred to them.

11. Where information is stored and processed

Our providers operate in Canada, the United States and other countries. That means your personal information may be stored and processed outside Canada, including in the United States, and while it is there it may be accessible to the courts, law enforcement and national security authorities of that country under that country’s laws. PIPEDA permits this provided we use comparable protection, which we do through our agreements with each provider — but you are entitled to know it, so we are telling you.

12. Your rights, and how to use them

• Access — ask what personal information we hold about you, how it has been used, and to whom it has been disclosed.
• Correction — ask us to fix anything inaccurate or incomplete.
• Deletion — ask us to delete your information, subject to records we must keep for legal, tax or contractual reasons.
• Withdraw consent — including consent to marketing email, at any time. Withdrawing consent may mean we can no longer provide part of a service, and we will tell you if so.
• Portability — ask for a copy of your data in a usable format. Your leads and files can also be exported directly from the portal.
• An access record — as described in section 7, ask for the log of administrator sessions on your portal account.

Email us at the address in section 16. We will respond within the time PIPEDA allows — thirty days — and will verify your identity first. There is no charge for a reasonable request.

If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada.

13. How long we keep information

We keep personal information only as long as we need it for the purposes described here, or as long as the law requires. In practice:

• Client records — for the life of the engagement and afterwards for as long as we need them for tax, accounting and legal purposes.
• Leads captured from a client’s website — for as long as that client is with us, or until the client instructs us to delete them.
• Enquiries that never became clients — kept for a limited period so we can pick up a later conversation, then deleted on request.
• Email delivery records and audit logs — kept for as long as needed for security and accountability; audit logs of administrator access are deliberately kept, because deleting them would defeat their purpose.

Ask us and we will tell you what we hold and delete what we can. Please export anything you want to keep before your portal access ends.

14. Security

We protect personal information with measures appropriate to its sensitivity: encryption in transit (HTTPS) across the website, the portal and the lead endpoints; sign-in by one-time email link or Google account rather than reusable passwords; optional two-factor authentication on portal accounts; role-based access so people only reach what their role allows, enforced on our servers and not just hidden in the interface; audit logging of administrator access; and version-controlled, off-site copies of the code that runs our platform.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we will keep a record of the incident.

15. Other points

Children

Our website and services are for businesses and are not directed at children. We do not knowingly collect personal information from a child. If you believe a child has given us information, contact us and we will delete it.

Third-party websites

Our website and emails may link to other sites. We are not responsible for their privacy practices — read their policies before giving them information. Websites we build for clients are operated by those clients and have their own privacy notices.

Changes to this policy

We may update this policy. The current version is always on this page with its “Last updated” date, and for material changes affecting clients we will give notice by email or through the portal.

16. Contact us

For any privacy question, or to make a request under section 12, contact the person responsible for privacy at Paragon Media Canada:

Paragon Media Canada

Email: dax@paragonmediacanada.ca · Phone: +1 (905) 341-8775 · Serving the Niagara Region, Ontario, Canada

If you need to send us something by post, contact us first and we will provide a mailing address.