Privacy Policy

This Privacy Policy explains how Tscale Solution collects, uses, stores, and protects personal information across everything we do: our website, our digital-marketing services, the customer dashboard we operate, and the public link-hub pages we host for our clients. It is organized around the ten fair information principles of Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and the provincial privacy laws that apply where we operate.

1. Who we are

Tscale Solution ("tscale", "we", "us") is a Canadian company, federally incorporated under the Canada Business Corporations Act (CBCA), with its head office in New Westminster, British Columbia. We serve customers across Canada, with operations centred in Metro Vancouver.

We provide website design and production, digital marketing (including Google Ads, Google Local Services Ads, search engine optimization, and social media), a customer dashboard at dash.tscale.ca, and public link-hub pages that our clients use to share their services.

2. Who this policy covers

This policy applies to:

• Website visitors — people who browse tscalesolution.com and the sites we build.
• Dashboard customers — businesses with an account on our customer dashboard.
• Link-hub visitors — people who open a public link-hub page we host for a client.
• Prospective customers — people who contact us through a form, the chat widget, or a tracked phone number.

3. Information we collect

We collect only what we need for the purposes described in this policy:

Two details are worth calling out:

• Phone inquiries: we record the caller number, time, duration, and whether the call was answered. Calls are not recorded. Tracking numbers simply forward to the business's regular phone line and note which advertising source the call came from.
• Website analytics are aggregate: the site-usage data above is collected via Google Analytics 4 while you browse — before and regardless of whether you contact us — and is not linked to your name or contact details.

4. Our roles: controller and service provider

We play two different roles depending on whose information is involved:

• As the organization responsible (controller) — for personal information collected through our own website, marketing, and dashboard accounts, we decide the purposes and are accountable for it under this policy.
• As a service provider (processor) — for lead data that individuals submit to our clients through the tools we build and operate for them, we process that data only on the client's behalf and under the client's instructions.

If you submitted your information to one of our clients (for example, through a clinic's own contact form) and want to access, correct, or delete it, that client is the organization responsible for it — we will direct your request to them and assist as needed.

5. Why we collect it and our legal basis

We collect and use personal information to respond to your inquiry; to route it to the right business and staff member; to follow up if a call was missed; to deliver the website and marketing services you have engaged us for; to operate and secure the customer dashboard; and to measure, in aggregate, how visitors use this website and which marketing channels inquiries come from.

Our legal basis under PIPEDA is your consent and, where applicable, the performance of a contract with you. We do not sell personal information, and we do not use it to advertise to you.

6. How we handle your information — PIPEDA's ten principles

The following ten sections track the fair information principles of PIPEDA, which govern how we collect, use, disclose, and protect personal information.

Principle 1 — Accountability

We are responsible for the personal information under our control. We have designated a Privacy Officer who is accountable for our compliance with this policy and applicable privacy law:

Principle 2 — Identifying purposes

We identify why we collect personal information at or before the time of collection. The purposes are those described in Section 5; if we ever want to use your information for a new purpose, we will identify it and, where required, seek your consent.

Principle 3 — Consent

By submitting a form, starting a chat, or calling a tracked number after seeing the posted notice, you consent to the collection and use of your information for the purposes above. Aggregate website analytics are collected when you browse this site and are not tied to submitting an inquiry. You may withdraw your consent at any time by contacting our Privacy Officer, subject to legal or contractual limits; we will explain any consequences of withdrawal.

Principle 4 — Limiting collection

We collect only the information needed for the purposes we have identified, by fair and lawful means.

Our own visitor counting on link-hub pages sets one cookie, and it only counts visits. It is a first-party analytics cookie holding a randomly generated number — no name, no email, no IP address — so the business whose page it is can estimate how many different people opened the page and how many came back. It expires after about 13 months. Apart from that, these pages record first-party counts of page views and link taps, a coarse device class (for example mobile or desktop), and a hash of the visitor's IP address and browser user-agent taken with a salt that changes daily and is deleted after 48 hours — the hash is what allows a single day to be counted when there is no cookie, it cannot be linked across days or pages, and neither the IP address nor the user-agent is stored. Every visitor number produced this way is an estimate, not an exact count. Our counting uses no advertising pixels, performs no cross-site tracking of visitors, and does no device fingerprinting. Visitors can switch all of this off — cookie and counting alike — from the "Cookies" link at the bottom of any link-hub page, which opens our Cookie Policy; declining stores one further cookie that holds the value 1 and no identifier, so that we remember the refusal. Nothing is set and nothing is recorded at all when a browser sends a Do Not Track or Global Privacy Control signal.

Some link-hub pages use more features. A private page remembers for 7 days that you entered its password; a poll keeps a random code in your browser so you are not counted twice; maps, videos and music load from Google, YouTube or Spotify only after you tap them; and a business can add its own Google Analytics 4 or Meta Pixel, which loads only after you select "Allow analytics" on that page. For those analytics tools the business is the organization responsible: the information goes from your browser to Google and Meta in the United States under the business's accounts, Tscale does not receive it or send them our visitor number, and requests about it go to the business. Each of these is listed in our Cookie Policy.

Principle 5 — Limiting use, disclosure, and retention

We use and disclose personal information only for the purposes it was collected for, and we keep it only as long as needed:

• Raw attribution data (UTM): retained for 30 days, then deleted or reduced to aggregate counts.
• Ad-click identifiers: a Google click ID on the link you arrived through is kept for 90 days, then removed.
• Inquiries you send us through this website's contact form: the free-text message is automatically deleted 90 days after receipt; your contact details and our handling notes are kept as account and service-delivery data (below).
• Website support-request emails: what you send through this website's support-request form is delivered by email to our business mailbox and kept there as long as needed to respond to you, plus any period required for legal holds or business records, then deleted. Inquiries sent through the contact form are stored in our dashboard (see above), not emailed.
• Account and service-delivery data: kept for the duration of our engagement with you, plus any period required for legal holds or business records, then deleted.
• Client lead data (service-provider role): retained and deleted according to each client's instructions.
• Linkhub pages we host for businesses (free Basic or paid Pro): a business's page content and uploaded files (such as its name, logo, photos, text and links) are kept while its Linkhub page is hosted with us. When we close a page (see the Linkhub Terms), we keep them privately for 90 days so the page can be reopened if the business asks, then delete them; backups are handled as described in the next paragraph. The business can ask us to delete its page content sooner. Inquiries visitors send through a Linkhub page's form are the business's customer records (next paragraph). Billing, tax and dispute records are kept separately, as account data.
• PDF files on Linkhub pages: a business's PDF files are checked for unsafe content before they are published, are public on its page, and are kept and deleted with the rest of its page content (above).
• Marketing sign-ups (service-provider role): the record that a visitor agreed to receive a business's news (when, and which wording they saw) is kept even if their inquiry is deleted, so the business can show it had their consent; it is deleted with the business's other data when its account ends. If the business connects its own Mailchimp account, we add the visitor's email address to it and apply unsubscribes made there back to our record; Mailchimp keeps its own copy under the business's account. The business can download the list of sign-ups, with each person's status, and is responsible for using it under Canada's anti-spam law.
• Poll votes: counted per option; a vote is stored with a one-way code from your browser and no name, email or IP address, and votes are deleted with the page.
• Portal notification settings: kept until you turn notifications off on that device, until you are removed from the business's account, or until your browser's push service tells us the subscription no longer works. Notifications carry no customer details.

Our clients' customer records. By default, we keep a client's customer records (inquiries, customer profiles, bookings and notes) for as long as the client's account with us is active, or until the client deletes them. Clients can delete individual records or records older than a period they choose, and can export their records at any time. When a client's service with us ends, we keep their data for 90 days so it can be exported or the service restored, then delete it. Deleted data may remain for a limited time in our hosting provider's routine backups, which are overwritten on a rolling basis; we do not restore deleted client data from backups except to recover from a system failure. Some clients use third-party tools we connect for them (such as chat or call tracking); those providers keep their own copies under their own policies. When an inquiry is deleted, we keep the reference number from the connected tool so the same inquiry is not created again. Ad-click identifiers and campaign tags on the link a customer arrived through (for example a Google click ID) are kept for 90 days, then removed. To access, correct or delete information you gave one of our clients, contact that business; if you contact us instead, we will forward your request to the business within 5 business days.

Principle 6 — Accuracy

We keep personal information as accurate, complete, and up to date as is necessary for the purposes for which it is used. You can ask us to correct information that is inaccurate or out of date.

Principle 7 — Safeguards

We protect personal information with safeguards appropriate to its sensitivity, including:

• Encryption in transit (TLS) for data moving between your browser and our systems.
• Role-based access so staff can reach only the data their role requires.
• Row-level security enforcing per-tenant isolation, so one business's data cannot be reached from another's context.
• Access logging — every view of your contact details is recorded.

Principle 8 — Openness

We make our privacy practices readily available. This policy describes what we collect, why, who processes it, and how to reach our Privacy Officer, and we keep it current.

Principle 9 — Individual access

You may request access to the personal information we hold about you, ask us to correct it, or withdraw your consent. Contact our Privacy Officer (see Principle 1). We respond within 30 business days. For information you submitted to one of our clients, see Section 4.

Principle 10 — Challenging compliance

If you have a concern about how we handle your personal information, please raise it with our Privacy Officer first. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for matters within its jurisdiction, the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

7. Google user data (Google Calendar integration)

We are building an optional Google Calendar integration for the customer dashboard. If you choose to connect your Google account, the following applies.

• Scope requested: https://www.googleapis.com/auth/calendar.readonly (read-only access).
• What we access: your calendar event titles, times, and basic event details.
• Why: to display your today's and upcoming schedule inside your customer dashboard.
• How it is handled: this information is displayed in your dashboard and is not stored beyond the temporary caching needed to display it. It is never shared with third parties and is never sold.
• Not used for AI/ML: we do not use Google Calendar data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

You can revoke tscale's access to your Google account at any time at myaccount.google.com/permissions.

8. Service providers and international transfers

We use a small number of service providers under contract to deliver and secure our services:

Some of the providers above store or process information outside Canada (currently the United States). While outside Canada, information may be subject to the laws of those jurisdictions, including lawful access by their authorities. We choose providers with strong contractual and technical protections regardless of location, consistent with our accountability obligations under Canadian privacy law.

Services a business or you choose to use. Some Linkhub features connect to services that are not our service providers and handle information under their own policies: a business can add its own Google Analytics 4 or Meta Pixel to its page (they load only with the visitor's permission and send information to Google LLC and Meta Platforms, Inc. in the United States under the business's accounts); a business can connect its own Mailchimp account, and we then send it the email addresses of visitors who agreed to receive that business's news, which Mailchimp may process outside Canada, including in the United States; maps, videos and music on a page load from Google Maps, YouTube or Spotify only after the visitor taps them; and if you turn on notifications in the customer dashboard, your browser's push service (run by its maker, for example Apple, Google or Mozilla) delivers them.

9. Children's privacy

Our services are directed at businesses, not to minors. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact our Privacy Officer and we will delete it.

10. Changes to this policy

We may update this policy as our services and legal obligations evolve. When we do, we will revise the "Last updated" date above. Material changes will be communicated through our website or the customer dashboard.

11. How to contact us

For any question about this policy or your personal information, contact our Privacy Officer, Daniel Kim, at daniel.kim@tscalesolution.com. We respond within 30 business days.

12. Provincial privacy rights

Depending on where you live in Canada, a provincial privacy law may apply in addition to, or instead of, PIPEDA:

• British Columbia: our pilot operations are in BC and are governed by BC's Personal Information Protection Act (PIPA). Complaints may be made to the Office of the Information and Privacy Commissioner for BC (oipc.bc.ca).
• Alberta: for Alberta residents, Alberta's Personal Information Protection Act (PIPA) applies, overseen by the Office of the Information and Privacy Commissioner of Alberta.
• Ontario, Manitoba, Saskatchewan, and other provinces: PIPEDA applies as the default federal law, overseen by the Office of the Privacy Commissioner of Canada.
• Quebec: we do not currently serve customers in Quebec. If and when we do, we will comply with Quebec's Law 25, including making this policy and the relevant services available in French.

You may escalate an unresolved concern to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).