Privacy Policy

1. Information We Collect

We collect only the minimum personal and technical information necessary to deliver our consulting services, evaluate your current software stack, and execute reliable infrastructure migrations.

Information you provide directly

• Contact details: Name, email address, phone number, company name, and job title when you contact us, book a call, or request a quote via our website contact forms or direct communications.
• Business information: Details regarding your current proprietary software subscriptions (e.g. Google Workspace, Microsoft 365, Dropbox, 1Password, Slack), monthly software spend, active team size, operational workflows, and migration timelines — provided voluntarily during discovery calls or through our SaaS audit intake form.
• Account credentials: During migration projects, you may share administrative credentials or API access to existing systems (e.g., email routing, file-sharing platforms, identity providers) solely for the purpose of executing the agreed migration. We treat these credentials as highly sensitive under dedicated security protocols (see Section 5).

Information collected automatically

• Website analytics: Pages visited, referring pages, browser type, device and operating system, approximate location (city, region or country), and simple actions such as form submissions or clicks on our phone number. This is collected through Google Analytics 4 and Google Tag Manager, and through our web host's standard server logs. See Section 10.
• Cookies: We use essential browser storage for core website functions (such as remembering your light/dark theme preference and that you have seen our cookie notice), and Google Analytics cookies to measure site use. We do not use advertising or remarketing cookies. See our Cookie Policy.
• Third-party scorecard: Our free Software Cost & Flexibility scorecard is provided by ScoreApp, a third-party service embedded on our site. When you use it, ScoreApp processes your answers and may set its own cookies under its own privacy policy.
• Phone calls: If you call us, the call may be answered by our AI phone receptionist and recorded and transcribed. See Section 9.

Information from third parties

If you connect or authorize a third-party tool during an active implementation project, we receive only the access scopes and data you explicitly authorize. We do not purchase, license, or enrich records from commercial data brokers.

2. How We Use Your Information

We use personal and corporate information strictly to:

• Respond to your initial inquiries, deliver custom Big Tech escape assessments, and issue fixed-price proposals.
• Deliver consulting, open-source migration, cloud provisioning, and managed infrastructure services you have engaged us for.
• Schedule, coordinate, and conduct technical discovery sessions, architecture reviews, and sprint debriefs.
• Issue project milestone communications, service advisories, and invoices.
• Continuously improve website performance, documentation accuracy, and migration tooling.
• Comply with applicable legal, accounting, tax, and contractual requirements in Canada.

3. Legal Basis and Consent

Where Canadian privacy law (PIPEDA) or other applicable data protection regimes require a lawful basis for processing, we rely on:

1. Your Informed Consent: Manifested when you contact us, complete an intake form, request an architecture review, or engage our consulting desk.
2. Performance of a Contract: Processing necessary to fulfill obligations under your signed Engagement Agreement, Statement of Work, or Managed Maintenance SLA.
3. Legitimate Business Interests: Maintaining network security, preventing fraud or system abuse, and fulfilling statutory business recordkeeping obligations.

You may withdraw your consent at any time for non-essential communications by emailing privacy@openstackforge.ca. To stop marketing emails, use the unsubscribe link in the email or write to unsubscribe@openstackforge.ca.

4. How We Share Information

We share information solely under the following limited conditions:

• With you: Providing complete audit logs, configuration runbooks, and records of your migrated data.
• With vetted service providers: Specialized infrastructure sub-processors who assist us in operating our business (e.g. edge hosting infrastructure, secure email delivery, transactional accounting) under strict confidentiality and non-disclosure agreements that meet or exceed this policy.
• Legal compliance: When mandated by valid Canadian court order, search warrant, subpoena, or statutory legal requirement, or when necessary to protect our legal rights, property, and system integrity.

Service providers we use include Netlify (website hosting and form handling), Google (Google Analytics 4 and Google Tag Manager), ElevenLabs (AI phone receptionist, call recordings and transcripts), ScoreApp (our free online scorecard), and our email and scheduling providers. A current list is available on request from privacy@openstackforge.ca.

5. How We Protect Client Data and Credentials

Given the critical and sensitive nature of business IT migrations, server provisioning, and password vault transitions, we apply rigorous administrative, technical, and physical safeguards:

• Documented, Auditable Migration Procedures: Data migrations (emails, documents, calendars, contacts, vault items) are processed using idempotent scripts with verifiable hash verification. We do not retain copies or backups of your migrated content on our local machines or intermediate servers beyond what is strictly necessary to verify complete transfer.
• Least-Privilege Role-Based Access: Access is provisioned on a strictly needed basis with MFA enforcement. Administrative credentials and SSH keys are systematically revoked the moment an engagement reaches completion or upon client request.
• Zero-Telemetry Architecture: Deployed open-source platforms (Nextcloud Hub, Vaultwarden, Mattermost) are configured with telemetry disabled and client-owned encryption keys. Fastmail, where used for email, manages its own encryption.
• Incident Notification: In the unlikely event of a security breach or unauthorized access affecting client records, we will notify affected organizations without undue delay in accordance with applicable Canadian notification requirements under PIPEDA.

Please note: While no electronic transmission over the internet or cloud storage environment can guarantee 100% absolute security, we use industry-standard safeguards proportional to the high sensitivity of the data handled.

6. Data Retention Schedules

We adhere to strict data minimization principles. We do not keep your information longer than necessary to serve business, operational, and statutory legal purposes.

7. Your Privacy Rights

Under Canadian privacy laws (including PIPEDA) and comparable international standards, you have substantive rights regarding your personal information:

• Right of Access: You may request confirmation and an itemized copy of the personal information we maintain concerning you.
• Right of Rectification: You may request immediate correction of inaccurate, outdated, or incomplete records.
• Right of Deletion / Erasure: You may request the deletion of your personal data, subject to mandatory statutory tax, legal, or accounting retention obligations.
• Right to Withdraw Consent: You may revoke consent for voluntary processing activities at any time without retroactive penalty.
• Right to Lodge a Complaint: If you believe our information handling practices fail to meet statutory standards, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

8. Cookies and Web Storage

Our website uses a small number of cookies and browser storage items:

• Essential: your light or dark theme choice (localStorage 'osf-theme'), whether you have dismissed our cookie notice (localStorage 'osf-cookie-notice'), and spam protection on our forms.
• Analytics: Google Analytics 4 cookies, loaded through Google Tag Manager, to count visits and see which pages are used. See Section 10.
• Scorecard: our free Software Cost & Flexibility scorecard is provided by ScoreApp, a third-party service. When you use it, ScoreApp processes your answers and may set its own cookies under its own privacy policy.

We do not use advertising or retargeting cookies, social media tracking pixels, or fingerprinting scripts. You can block or delete cookies in your browser settings. The site will still work, though your theme choice may reset. Full details are in our Cookie Policy.

9. Phone Calls, Call Recording and Our AI Phone Receptionist

When you call our business line at 902-706-8753, your call may be answered by an AI phone receptionist. The receptionist can answer common questions, take a message, and help book a call with our team. You will hear a notice at the start of the call that it is an automated assistant and that the call may be recorded.

What we collect on a call

• Call recording and transcript: an audio recording of the call and a written transcript of what was said.
• Call details: your phone number (caller ID), the date, time and length of the call.
• What you tell us: your name, business name, contact details and the reason for your call, if you share them.

Why we collect it

• To answer your question, return your call or book the meeting you asked for.
• To keep an accurate record of support requests and what was agreed.
• To check the quality of the answers the AI receptionist gives and improve them.

Who provides it and where it is stored

The AI phone receptionist is provided by ElevenLabs, a third-party voice AI service. ElevenLabs processes the call audio to run the conversation, and stores call recordings and transcripts in the United States. Information stored in the United States is subject to United States law and may be accessed by authorities there under that law. ElevenLabs handles this information under its own privacy policy and its agreement with us.

Your choices

• If you do not want your call recorded or handled by the AI receptionist, you can hang up and email us at info@openstackforge.ca instead, or ask in your message for a person to call you back.
• You can ask us to delete a recording or transcript of your call by emailing privacy@openstackforge.ca. We will delete it unless we need to keep it for a legal or contractual reason, and we will tell you if that is the case.

We keep call recordings and transcripts only as long as we need them for the purposes above, in line with the inquiry retention period in Section 6.

10. Website Analytics: Google Analytics 4 and Google Tag Manager

We use Google Analytics 4 to understand how people use our website, and Google Tag Manager to load and manage that analytics code. Both are services of Google LLC.

What is collected

• Pages you visit, how long you stay, and the page or site that referred you.
• Your browser, device type, screen size, operating system and language.
• Your approximate location (city, region or country), worked out from your IP address. Google Analytics 4 does not log or store full IP addresses.
• Simple actions on our site, such as submitting the contact or support form, clicking our phone number or email address, or starting the free scorecard. We record that the action happened. We do not send the contents of your form to Google Analytics.
• A random identifier stored in a first-party cookie (for example _ga and _ga_<ID>) so visits from the same browser can be counted together.

Why we use it

We use this information to see which pages are useful, fix pages that are not, and measure whether people can reach us easily. We do not use Google Analytics for advertising, we have not turned on Google advertising features or remarketing, and we do not try to identify individual visitors.

Where it is processed

Google may process this information in the United States and other countries where it operates. Google keeps our analytics data under its own terms and privacy policy, available at policies.google.com/privacy.

How to opt out

• Install the Google Analytics opt-out browser add-on.
• Block or delete cookies in your browser settings, or use a browser or extension that blocks analytics scripts. Our site will still work.
• Turn on your browser's privacy or "Do Not Track" style settings where available.

For more detail on the cookies we use, see our Cookie Policy.

11. Children's Privacy

Our website and professional services are exclusively intended for commercial enterprises, business owners, and corporate IT professionals. We do not knowingly solicit or collect personal information from individuals under 16 years of age. If you become aware that a minor has submitted personal information to our site, please contact us immediately for immediate investigation and removal.

12. International and Inter-Provincial Data Transfers

Open Stack Forge is based in Lower Sackville, Nova Scotia, Canada, serving clients throughout Canada and select international organizations. Your information may be processed and stored on cloud infrastructure located within Canadian provinces or other jurisdictions where our edge hosting partners operate. In particular, Google Analytics data and our AI phone receptionist\'s call recordings and transcripts (ElevenLabs) are processed and stored in the United States.

When data is transferred across provincial or international borders, it remains protected under contractual safeguards and the standards defined in this policy, subject to the lawful disclosure rules of the destination jurisdiction.

13. Changes to This Policy

We review and update this Privacy Policy periodically to reflect technological enhancements, operational changes, or statutory legal developments. Whenever updates are published:

• We will post the revised policy on this page and refresh the "Last updated" date at the top of this document.
• For material modifications that materially alter how personal data of active clients is processed, we will provide advance direct notification via email.

14. Contact & Privacy Officer

For questions, data access requests, or inquiries regarding our privacy compliance practices, please reach our Privacy Officer:

Privacy Officer, Open Stack Forge Limited (Nova Scotia Registry ID 4850470), Lower Sackville, Nova Scotia · privacy@openstackforge.ca · 902-706-8753