What we collect, why, and how to get it back.

This policy explains how pomasoft — a technology studio based in British Columbia, Canada — handles personal information collected through this website. It covers this site only. Work delivered under a signed engagement is governed by that agreement.

Two Canadian laws apply. British Columbia’s Personal Information Protection Act (PIPA) governs information collected in the course of our activity in BC. Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) applies as well, because information you send us crosses a border — see storage outside Canada. If you are in the EU, EEA, or UK, the additional rights section applies to you.

Only what you type into the contact form, and only because you chose to send it:

• Your name and email address — required, so we can reply.
• Company — optional.
• What you need — the option you pick from the list.
• Your message — free text. Please read what not to send us before writing it.

Separately, Cloudflare — our CDN — collects aggregate traffic and performance measurement through Web Analytics / Browser Insights. See cookies and site measurement. We do not run advertising pixels or social media trackers, we do not build profiles of visitors, and we have no accounts for you to create. Our hosting provider also keeps standard technical logs, which can include your IP address, for security and reliability.

Under BC PIPA, work contact details such as your name, title, and business email are treated as contact information rather than personal information. We mention it for completeness, not to narrow our obligations: the message field can hold anything, so we treat what you send as personal information throughout.

Four purposes:

• To answer you. For EU/UK visitors, the lawful basis is steps taken at your request before entering a contract (GDPR Article 6(1)(b)).
• To send you an automatic confirmation that your note arrived, and that we aim to reply within 48 hours. Same basis.
• To keep a record of business inquiries and to guard against spam and abuse — our legitimate interests (GDPR Article 6(1)(f)).
• To understand aggregate traffic and performance via Cloudflare Web Analytics / Browser Insights, so we can keep the site reliable — our legitimate interests (GDPR Article 6(1)(f)).

We will not add you to a mailing list, send you marketing you did not ask for, or sell, rent, or trade your information. If we ever want to send you something promotional, we will ask first.

Submitting the form is your consent to us using the information to reply. You can withdraw it at any time by emailing [email protected]. The practical consequence is simple: we stop processing your inquiry, and we delete it on request.

Service providers that help us operate this site:

• Google Cloud Firestore (Google LLC) stores submissions, in the us-central1 region in the United States. See Google Cloud’s privacy notice.
• Resend (Resend, Inc.) delivers the notification to us and the confirmation to you, from the United States. See Resend’s privacy policy.
• Cloudflare (Cloudflare, Inc.) serves the public site at the edge and processes Web Analytics / Browser Insights (RUM) for aggregate traffic and performance. Measurement is typically injected by Cloudflare at the CDN edge rather than by a script we ship in this application. See Cloudflare’s privacy policy and Web Analytics docs.

They are bound by data processing agreements where those apply. Handing information to a provider does not hand off our responsibility for it — we remain accountable.

Otherwise we disclose personal information only where the law requires it, such as a valid legal demand, or where it is necessary to establish or defend a legal claim. If the studio were ever sold or merged, records could transfer to the successor, who would remain bound by this policy.

Information you send through this site is stored and processed in the United States. You should know what that means before you use the form.

While your personal information is outside Canada, it is subject to the laws of the country where it is held. The governments, courts, and law enforcement or regulatory agencies of that country may be able to obtain disclosure of it under those laws, including through legal process that does not involve you or us being notified.

For transfers from the EU, EEA, or UK, our providers’ data processing agreements incorporate the European Commission’s Standard Contractual Clauses. Canada holds an EU adequacy decision for organizations subject to PIPEDA.

If you would rather not have your information leave Canada, email us at [email protected] instead of using the form, and say so in your message.

Contact submissions are deleted 24 months after we receive them, automatically. Where an inquiry becomes a client engagement, the related records are kept for as long as that relationship and our tax and legal obligations require.

BC PIPA sets a floor: where we used personal information to make a decision that directly affects you, we keep it for at least one year so that you have a genuine opportunity to ask for access.

You can ask us to delete your information sooner, at any time. One honest caveat: our email provider keeps its own delivery logs on its own schedule, so deleting a record on our side does not necessarily purge every upstream copy immediately.

Traffic to this site is encrypted in transit with TLS. Submissions are encrypted at rest by Google Cloud. They are written by the server only — the browser has no write access — and they can be read by one authenticated studio account and no other, enforced by database security rules rather than by the interface.

No transmission over the internet and no method of storage is completely secure, and we will not claim otherwise. We do not accept payment through this site and never ask for payment details here.

The contact form is a front door, not a secure channel, and submissions are not confidential. Please do not send health information, government identifiers such as a SIN, financial account or card numbers, passwords, or anyone else’s personal information.

If your inquiry genuinely needs to include something sensitive, send a short note first and we will arrange a proper channel.

Strictly necessary. The hosting platform needs a small amount of storage to serve pages securely. We also keep one entry in your browser’s local storage recording that you saw this notice, so we do not ask again on every visit. That preference is kept for six months, never leaves your browser, and is not used to identify you.

Cloudflare Web Analytics / Browser Insights (RUM). The public site is served through Cloudflare. We use Cloudflare’s Web Analytics (also called Browser Insights) for aggregate traffic counts and performance measurement — for example page views and Core Web Vitals. Cloudflare is the processor. The measurement beacon (static.cloudflareinsights.com/beacon.min.js, reporting to /cdn-cgi/rum) is typically injected at the CDN edge, not by a script we ship in this application. This Next.js app has no hook that can load or unload that beacon, so the preferences panel cannot turn it off. Control sits in the Cloudflare dashboard for the zone.

Per Cloudflare’s documentation, the RUM / Web Analytics beacon does not use cookies, localStorage, or similar client-side storage to collect metrics, and is not designed to fingerprint individuals for analytics display. It sends ephemeral performance and usage signals from the current page view. We do not use it to identify you, build a marketing profile, or run advertising.

We do not load advertising pixels, social media trackers, or a separate first-party analytics product of our own. If we later add a first-party analytics script that this app can gate, it will stay behind an explicit opt-in and this section will be updated before it ships.

You can reopen the preferences notice anytime through the Cookie preferences link at the bottom of any page. That notice discloses Cloudflare measurement; declining or closing it does not stop the edge beacon while Insights remains enabled in Cloudflare.

You can ask what personal information we hold about you, how we have used it, and who we have given it to. You can ask us to correct anything inaccurate, and to delete it.

Email [email protected]. We respond within 30 days under PIPEDA, and within 30 business days under BC PIPA. We may ask you to confirm your identity first, so that we do not disclose your information to someone else. In the narrow cases where PIPA allows a minimal fee for access, we will tell you the amount before doing the work, and you can withdraw the request.

In addition to the above, you have the right to access your data; to have it corrected; to have it erased; to restrict or object to how we process it; to receive it in a portable form; and to withdraw consent at any time.

Exercising any of these costs nothing and will never affect the quality of the reply you get from us. You also have the right to complain to your local supervisory authority.

This is a business-to-business site, not directed to children, and we do not knowingly collect information from them. If you believe a child has sent us something, tell us and we will delete it.

If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report it to the appropriate commissioner as the law requires, and we will keep records of breaches as PIPEDA obliges us to.

If we change how we handle personal information, we will update this page and move the “last updated” date. Material changes — a new service provider, a new purpose, analytics — will be described here before they take effect, not quietly after.

The person accountable for privacy at pomasoft is the Privacy Officer:

Privacy Officer, pomasoft
[email protected]

Come to us first — most concerns are a misunderstanding we can clear up quickly. If we cannot resolve it, you can escalate:

• Office of the Information and Privacy Commissioner for British Columbia
• Office of the Privacy Commissioner of Canada