The short version

This site collects almost nothing. It has no analytics, no advertising, no tracking pixels, and no cookies of its own. Client engagements are confidential by default: engagement data, findings, and evidence are handled under the terms agreed in each engagement's written scope and, where applicable, an NDA.

What is collected

Contact email. If you email hello@siddicky.ca or book a scoping call, the email address and correspondence are kept to answer you and scope work. Payment and invoicing records are kept as required for accounting and tax.

Payment data — never on this site. Payments run through Stripe (stripe.com). Card details go to Stripe under its own privacy policy and are never stored on siddicky.ca or on engagement systems. Stripe may set cookies on its own checkout pages; that happens under Stripe's policies, not this one.

Engagement data. Assessments require access to your systems and produce findings about them. That data is collected under your written authorization, held on isolated infrastructure, shared only with the people you name, and returned or destroyed at engagement close unless an agreement says otherwise.

What is not collected

No analytics, no advertising identifiers, no fingerprinting, no social-media trackers, no behavioral profiling. Pages are served as static files; the only third-party requests are Google Fonts (typefaces) and, on checkout pages, Stripe.

How engagement data is protected

Testing runs on isolated rigs with seeded accounts. Client data is accessed only with written authorization, encrypted at rest where stored, and covered by confidentiality terms in every engagement agreement. Evidence packages move under NDA. Access is limited to the principal.

Google sign-in (customer portal)

Customers using the report portal sign in with Google. Google shares the account's email address and name for authentication only; it is used to match the account to an active engagement or subscription and for nothing else. Google's own privacy policy applies to your Google account.

Retention and your choices

Contact correspondence is kept until the conversation ends or an engagement begins (then under the engagement agreement). Engagement data follows the retention terms of each agreement. You can ask for a copy, correction, or deletion of your contact information at any time at hello@siddicky.ca. Canadian privacy law (PIPEDA) and British Columbia's PIPA apply to this business.

Changes

Material changes to this policy will be reflected on this page with a new effective date. Questions or requests: hello@siddicky.ca.