Privacy Policy

Summary

• We collect only what you choose to send us, plus a small amount of technical and campaign information needed to run the website and to understand which of our ads lead to a request.
• We use it to respond to you, prepare the assessments you request, run our business and keep the website secure.
• If we invite you to the Framework client portal, we use your name, email address and the business information you enter to sign you in, deliver our services to your organization, give you support and keep the portal secure. Each organization sees only its own information.
• We send promotional emails only if you separately and explicitly agree. We do not sell personal information.
• Advertising measurement (the Meta Pixel) is off unless you allow it, and you can change your mind at any time.
• We keep assessment inquiries and related prospect information for up to 24 months after our last meaningful interaction, and you can ask us to access, correct or delete your information at hello@frameworkco.ca.

Who we are and what this policy covers

This policy applies to the Framework website at frameworkco.ca, including the free Online Presence Assessment request, the client feedback form, our contact details and the website itself. It also applies to the Framework client portal, the invitation-only area where clients sign in (described in “The client portal” below). Framework is a business strategy, brand and website studio operating in Alberta, Canada. In this policy, “Framework”, “we” and “us” mean Framework, and “you” means a visitor to the website, a person who contacts us or completes one of our forms, or a person we invite to the client portal.

We handle personal information in accordance with Alberta’s Personal Information Protection Act and other Canadian privacy and anti-spam laws that apply to us. This policy describes our practices; it is not a promise of compliance with every law in every place.

Information we collect

Information you give us

• Assessment requests: your business name, website address, city and province, type of business, your name and business email address; and, only if you choose to provide them, your phone number, the services you offer, your service area, links to social media or business profiles, your main concern and anything else you add. We also record that you acknowledged how we will use the information, and whether you ticked the separate, optional box about promotional emails.
• Client feedback: if you are a Framework client and complete our feedback form: ratings and written answers about your experience; an optional range for your business’s approximate annual revenue; a testimonial and your choice about whether we may use it publicly (and, if so, how it may be attributed); your name, job title and business name where you allow attribution; your choice about displaying your company name and logo; and the services you might use in future.
• Contact by email: our contact form does not send anything through the website. It opens your own email program with a message ready to send, so what you send reaches us as an ordinary email, including your name, email address and message.

Information collected automatically

• Technical information: like any website, our hosting provider (Cloudflare) processes your IP address, browser and device details, pages requested and similar server information to deliver the site and keep it secure.
• Spam protection: when you submit the assessment form we use simple checks, such as a hidden form field and how quickly the form was completed, and a one-way scrambled (hashed) version of your IP address to limit repeated submissions. A hash is not the IP address itself, but it is still treated as personal information, not as anonymous data. If we switch on Cloudflare Turnstile, a Cloudflare challenge also runs in your browser when you use the form.
• Campaign information: if you arrive from one of our ads or links, the campaign details in the link (for example the campaign name, or an advertising click identifier) and the website you came from are kept in your browser for that visit. They are sent to us only if you submit an assessment request, so that we know which campaign led to it.

Information in the client portal

If we invite you to the client portal, we collect and store the following:

• Account information: your email address, your name (if you give it to us, if our sign-in provider passes it on, or if you enter it in the portal), the organization you belong to, your role in it (Owner or Member), and when you were invited, joined and last signed in.
• Business Profile information: when you complete your Business Profile, we collect information about your organization, including its name, industry, location, products and services, target customers, business goals, competitors, online presence, primary contact and brand preferences. You may also choose to provide additional information about the Framework services you’re interested in, your preferred project timeline, your approximate budget and any existing brand materials or websites. These additional questions are optional. You may choose not to disclose a budget. We use this information to understand your business, assess your needs, prepare proposals, plan projects and deliver services. Your answers may include personal information about individuals you identify, so please provide only information that is relevant and appropriate to share.
• Portal feedback: if you use the “Send feedback” link, the message you write, the type of feedback and the section it is about, together with your organization and account.
• Sign-in and security records: when you sign in and out, the sign-in method used, a record of your session, and a one-way scrambled (hashed) value derived from your network address that we use to detect abuse. The hashed value is not the address itself, but we treat it as personal information.
• Activity records: short records of actions taken in the portal, such as accepting an invitation or saving a section of the Business Profile (who and when, not the answers themselves), so we can support you and show who had access.
• Invitation records: the email address and role we invited, who at Framework created it, when, and, where we sent it through a service, whether that service accepted it (we cannot confirm that it reached your inbox).

We do not ask you for payment card details or government identification in the portal.

How we use personal information

• To respond to your messages and requests, including preparing and emailing the assessment you asked for.
• To send you transactional emails about a request you made, such as our confirmation that we received it. These are not promotional.
• To send promotional emails, but only if you have explicitly agreed (see “Marketing emails” below).
• To review feedback, improve our services and, with your permission, publish testimonials and show clients in our portfolio.
• To understand which of our advertising and links lead to requests, and to measure advertising where you have allowed it.
• To keep the website and our systems secure, prevent spam and abuse, and meet legal obligations.
• For the client portal: to invite you and administer your organization’s access; to sign you in and keep your session secure; to use the Business Profile and your feedback to understand your business, assess your needs, prepare proposals, plan projects and deliver services, and give you support; and to keep records of access and changes for security and accountability. We do not use portal information for advertising and we do not sell it.

We do not sell personal information.

Assessment requests

The Online Presence Assessment is prepared by our team, not generated automatically. We use the information you submit, together with publicly available information about your business, website and competitors, to prepare your report and email it to you. We may also contact you about your request. Submitting a request does not subscribe you to any mailing list, and your acknowledgement of this policy is not consent to promotional email.

Your request is stored in a Cloudflare database that only authorised Framework staff can access, and a copy is emailed to Framework. We use an email service provider to send that notification and the confirmation message we send to you.

Client feedback, testimonials and logos

Feedback is optional and goes to Framework in a private database. We use it to understand how we are doing. We publish a testimonial only if you chose to allow it, and only in the form you chose (with your name and business, with your business only, or anonymously). We display your company name or logo as a client only if you chose Yes. You can withdraw either permission by contacting us; we will stop further use, although we cannot recall material that has already been seen or shared by others.

If you share your approximate annual revenue, we keep it confidential. We use it only to calculate combined statistics about the businesses we work with, such as a combined total that may be shown on our website without naming any client. We do not publish an individual company’s figure or attribute it to your business.

The client portal

The client portal is available only to people we invite, and it is currently in a private beta, so some details may change as we learn. This section explains how it works. Everything else in this policy also applies to it.

Signing in

We use WorkOS, a sign-in provider, to sign people in. When you sign in, WorkOS emails a one-time code to the address we invited. WorkOS receives your email address and, if provided, your name, together with technical details such as your network address and browser, and it keeps its own sign-in records under its own privacy policy. We do not see or store your one-time codes. After WorkOS confirms who you are, our portal checks that you have been invited to an organization and then starts a session. Clients currently sign in with an email code only; we do not currently require a second sign-in step for clients. Framework’s own administrators are expected to use multi-factor authentication for the accounts that can reach client information.

Who can see what

• Each organization can see only its own information. Access is checked on every request, and it ends on your next request once we remove you from an organization.
• Everyone in your organization who uses the portal can view and edit its Business Profile, and Owners can see the list of people in the organization.
• Authorized Framework personnel can view client information in our private administration area only when needed to deliver services, give support, keep the portal secure, or administer accounts. The administration area is protected by Cloudflare Access and individual staff sign-in.
• We share portal information with the service providers listed below only so they can provide the service, and otherwise only as described in “Service providers and other third parties”.

Invitations and emails

We invite people by email. The invitation, or a message telling you how to sign in, may be sent by WorkOS, by Framework through our email service provider (Resend), or directly by a member of Framework from a Framework mailbox. These are transactional messages about your access, not promotional emails.

Where it is stored

Portal accounts, organizations, Business Profile answers, feedback, and sign-in and activity records are stored in a Cloudflare database that only the portal and authorized Framework staff can reach. The portal runs on Cloudflare’s network. See “Where information is processed” for the limits of what we can say about location.

Marketing emails and consent

We send promotional emails only to people who have given explicit consent, for example by ticking the separate, unticked box on the assessment form or by asking us directly. That box is optional and has no effect on your assessment. We record whether you opted in when you submitted your request. Every promotional email will identify us and include a working way to unsubscribe, and you can also withdraw consent at any time by emailing hello@frameworkco.ca. Emails about a request you made (such as a confirmation that we received it, or your assessment) are not promotional.

Cookies, browser storage and analytics

• Cookies: we do not set cookies on the public pages of this website ourselves. Cloudflare may use security cookies or similar technology when needed to protect the site, and Cloudflare Access sets a login cookie for our staff when they sign in to the private administration area.
• Client portal cookies: when you sign in to the client portal we set two strictly necessary cookies on this site. __Host-fw_auth keeps a sign-in attempt secure while you are sent to our sign-in provider and back, and expires after 10 minutes. __Host-fw_portal keeps you signed in; it ends after 12 hours without activity, after 14 days at most, or when you sign out. They are used only to provide the portal, not for tracking or advertising. WorkOS may set its own cookies on its sign-in pages.
• Browser storage: on the assessment page we keep campaign details (described above) in your browser’s session storage for that visit, which is cleared when you close the tab. If advertising measurement is available and you make a choice, we remember your choice in your browser’s local storage so we do not keep asking. You can clear either at any time in your browser settings.
• Website analytics: we do not currently use website analytics or tracking tools on this website, other than the Meta Pixel described below, and only if you allow it. If we add analytics, we will update this policy first and ask for your consent where the law requires it.

Advertising measurement (Meta Pixel)

We may run advertising on Facebook and Instagram. To understand which ads lead to an assessment request, the assessment page can use the Meta Pixel, a tool provided by Meta Platforms. It is switched off by default. It loads only after you click Allow on the notice shown on that page. If you click No thanks, or your browser sends a Global Privacy Control or Do Not Track signal, it does not load.

If you allow it, your browser connects to Meta, which can collect information such as your IP address, browser and device details, cookies or identifiers Meta sets, the page you viewed, and the fact that you submitted an assessment request. We do not send the contents of your form to Meta. Meta handles that information under its own privacy policy and may use it for its own purposes. You can change your choice at any time using the controls below or the “Privacy preferences” link in the footer of the assessment page; declining or withdrawing does not affect your assessment request or any other part of the website.

Service providers and other third parties

We use service providers to run the website and our business. They may process personal information for us only to provide their services:

• Cloudflare: hosting and delivery of the website, security, the database where assessment requests and client feedback are stored, staff sign-in to the administration area, and technical logs. For the client portal, Cloudflare also hosts the portal and the database that stores portal accounts, Business Profile answers and portal feedback. Cloudflare Turnstile spam protection if we switch it on.
• WorkOS: sign-in for the client portal (the emailed one-time code, the record that you signed in and, for invitations to people without an account, the invitation itself).
• Resend: the email service that sends the notification to Framework and the confirmation email to you after an assessment request, and, in some cases, a client portal invitation.
• Our email provider: emails you send to us, and copies of the notifications above, are held in Framework’s mailbox.
• Fontshare: the fonts used on every page, including the client portal, are loaded from this third-party font service, which receives your IP address and browser details when the page loads.
• Meta Platforms: only if you allow advertising measurement, as described above.
• Embedded previews: our portfolio page can show live previews of websites we built for clients, loaded from a Framework address.

We may also disclose personal information where required or permitted by law, or to protect our rights, and to professional advisers under confidentiality. If our business changes hands, information may be transferred to the new owner under this policy.

Where information is processed

Our service providers operate internationally. Your information may be processed or stored outside Alberta and outside Canada, including in the United States, and may be accessible to courts and authorities in those places under their laws, which may differ from Canadian law. We do not promise that your information stays in Canada. This includes the client portal: WorkOS and Cloudflare may process portal information in the United States and other countries, and we have not been able to confirm a specific location for it.

Security

We use safeguards that are appropriate to the sensitivity of the information, including encrypted connections to the website, a private database, restricted staff access to the administration area protected by Cloudflare Access and individual sign-in, spam and abuse controls, and keeping secret credentials out of the website itself. For the client portal, sign-in uses a one-time code sent to your email, sessions end automatically after a period of inactivity, each organization can see only its own information, and we remove access when a person leaves an organization or asks us to. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach that creates a real risk of significant harm, we will notify affected people and regulators as the law requires.

How long we keep information

• Assessment inquiries and related prospect information (including contact enquiries by email): up to 24 months after our last meaningful interaction with you. If we have recorded no interaction after you contacted us, we count from the date you submitted the request.
• Client feedback: up to 24 months after our last meaningful interaction with the client, except where one of the following applies: (a) the feedback includes a testimonial that you have authorized us to publish, in which case we keep the testimonial and the record of your permission for as long as the testimonial is in use; (b) we have an ongoing client relationship with you; or (c) we need to keep it to meet a contractual or legal requirement.
• Published testimonials: used only for as long as you permit. If you withdraw permission, we stop using the testimonial and remove it from the website. We keep the record of the permission and of its withdrawal for as long as we need to show what you agreed to.
• Other business records (for example client agreements, invoices and correspondence about a project): for as long as the business, tax and legal rules that apply to them require.
• Promotional email consent records: for as long as we need to show that you consented or withdrew.
• Client portal information (account details, Business Profile answers and portal feedback): kept while the client relationship continues, subject to any legal or contractual obligations. We review inactive beta accounts after 12 months, and delete information we no longer need, subject to the legal and operational retention requirements that apply.
• Portal sign-in, session and activity records: kept for as long as needed for security and to show who had access, then reviewed and deleted with the rest of the account. Records held by WorkOS are kept for the periods WorkOS sets.
• Technical and security logs: for the periods set by our service providers.

We review and delete records manually, not automatically, so a record may remain for a short time after these periods until the next review. We may keep information longer where the law requires it or to deal with a dispute.

What deleting a record does and does not remove. When we delete a record from our administration area, we remove that record from our main database. That does not by itself remove copies held elsewhere: email notifications and replies in our inbox, delivery logs at our email provider (Resend), Cloudflare database backups and Worker logs, sign-in records held by WorkOS, files we have exported, and any other third party that received the information. We review those locations separately when handling a deletion request, and we remove what we can, unless we need to keep it for a legal or contractual reason. Copies we cannot remove on request expire on those providers’ own schedules, which can be later than the main record.

Your choices: access, correction and deletion

Framework’s owner is our privacy contact and handles these requests. You can ask us to tell you what personal information we hold about you, to correct it, to delete it, or to withdraw a consent you gave (for example for promotional email or a testimonial). Email hello@frameworkco.ca. We may ask you to confirm who you are before acting, we handle requests manually, and we will respond within the time required by law. We aim to acknowledge a request within 5 business days and to complete an eligible deletion request within 30 calendar days. These are targets, not guarantees, and they are subject to legal and operational exceptions: for example, we may need to keep records for legal reasons, or copies in backups may remain until they expire. Portal users can also ask us to remove their access, which takes effect on their next request. There are limited cases where we can or must refuse a request, and if we do we will explain why. If you are not satisfied with our response, you can contact the Office of the Information and Privacy Commissioner of Alberta.

External links

Our website links to other websites, including those of our clients. We do not control them and are not responsible for their privacy practices. Please read their policies.

Changes to this policy

We may update this policy as our website or practices change. The effective date at the top shows when the current version took effect. If we make a significant change, such as adding analytics or new tracking, we will update this page before it starts and ask for your consent where required.

Contact us

Framework, Alberta, Canada
Email: hello@frameworkco.ca