Privacy Policy

Spearstone, Inc. (“Spearstone”, “we”, “us”) is a consulting and software development firm headquartered in Calgary, Alberta, Canada. This policy explains what personal information we collect through spearstone.partners, why we collect it, who we share it with, and the rights you have over it.

We have deliberately built this website to collect as little as possible. There is no user account, no advertising network, no tracking cookie, and no database of visitor records.

Summary

What we collect	Only what you type into our contact form, plus anonymous, aggregate usage statistics.
Cookies	Strictly necessary security cookies only. No analytics, advertising, or tracking cookies. See our Cookie Policy.
Analytics	Cookieless and anonymous. No profile is created for you and nothing is stored on your device.
Selling data	We do not sell or share personal information, and never have.
Contact	privacy@spearstone.partners

1. Information we collect

Information you give us

When you submit our contact form, we collect:

• Name — so we know who we are replying to.
• Email address — so we can reply.
• Telephone number — optional; only if you choose to provide it.
• Your message — the content of your enquiry.

If you contact us by email or telephone directly, or book a call through our scheduling provider, we receive whatever information you choose to provide through that channel.

Information collected automatically

• Server and security logs. Our infrastructure provider records standard request data, including IP address, user agent, requested URL, and timestamp. This is used to deliver the site, defend against attack and abuse, and diagnose faults.
• Anonymous usage statistics. We measure aggregate traffic — page views, referrers, approximate country, and performance metrics. This runs in a memory-only mode: no cookie or other identifier is written to your device, no visitor profile is created, and we do not attempt to identify you or link visits together.

We do not knowingly collect special category or sensitive personal information through this website, and we ask that you do not include any in a contact form message.

2. Why we use it, and our legal basis

Purpose	Information used	Legal basis (GDPR/UK GDPR)
Responding to your enquiry	Contact form fields	Consent, and our legitimate interest in replying to a business enquiry you initiated
Discussing and delivering services	Contact and correspondence details	Legitimate interests; performance of a contract, where one is entered into
Site security and abuse prevention	Server logs, bot-check results	Legitimate interest in protecting our systems and users
Understanding aggregate site usage	Anonymous statistics	Legitimate interest in maintaining and improving the site. As the data is anonymous, it does not identify you.
Meeting legal and regulatory obligations	As required	Compliance with a legal obligation

Under Canadian law (PIPEDA and Alberta’s Personal Information Protection Act), we rely on your consent, which you give by choosing to submit the contact form. We collect only what is reasonable for the purposes identified above.

We do not use your personal information for automated decision-making or profiling that produces legal effects for you.

3. Who we share it with

We do not sell, rent, or trade personal information. We share it only with service providers who process it on our instructions, and only as needed to run the site and respond to you:

Provider	Role	Processing location
Cloudflare, Inc.	Website hosting, content delivery, bot protection	Global edge network
Resend	Delivers contact form submissions to our inbox	United States
Google (Workspace)	Our business email	United States / global
PostHog	Anonymous, cookieless usage statistics	United States
Calendly	Call scheduling, if you choose to book	United States

We may also disclose personal information where required by law, court order, or a lawful request by a public authority; to establish, exercise, or defend legal claims; or in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honour this policy.

4. International transfers

We are based in Canada and use providers located in the United States and operating global infrastructure. Where personal information is transferred out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards — ordinarily the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or a valid adequacy decision. Canada benefits from an EU adequacy decision for commercial organisations. You may request details of the safeguards that apply.

5. How long we keep it

• Contact form submissions are delivered to our email inbox and are not written to any database. We keep the resulting correspondence for up to 24 months from our last exchange, unless it forms part of a client engagement record, in which case we keep it for as long as needed for that engagement and any applicable legal or professional retention requirement.
• Server and security logs are retained on our provider’s standard schedule, which is short-term and measured in days.
• Anonymous usage statistics contain no personal information and are kept in aggregate form.

When information is no longer needed, we delete it or irreversibly anonymise it.

6. Security

This site is served as static content from a hardened edge platform. It runs no content management system, no database, and no server-side scripting language of the kind commonly targeted by automated attacks. Contact form submissions are protected in transit by TLS, screened by a bot check, rate limited, and forwarded directly to email — which means there is no store of enquiry data to compromise.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulator where the law requires it.

7. Your rights

To exercise any right below, email privacy@spearstone.partners. We will respond within the period required by the applicable law — generally 30 days under PIPEDA, one month under the GDPR and UK GDPR, and 45 days under the CCPA/CPRA. We may need to verify your identity before acting, and we will not treat you differently for exercising a right.

Canada (PIPEDA and Alberta PIPA)

• Access the personal information we hold about you, and information about how it is used and disclosed.
• Request correction of inaccurate or incomplete information.
• Withdraw your consent, subject to legal and contractual restrictions.
• Complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner of Alberta.

European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

• Access (Art. 15) — obtain a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure (Art. 17) — have your data deleted.
• Restriction (Art. 18) — limit how we process it.
• Portability (Art. 20) — receive it in a machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent (Art. 7) — at any time, without affecting prior lawful processing.
• Complain to your supervisory authority, including the UK Information Commissioner’s Office.

California (CCPA / CPRA)

In the twelve months preceding the date of this policy we have collected the categories of personal information described in section 1: identifiers (name, email, telephone, IP address), internet activity information, and the contents of communications you send us. We collect it for the business purposes in section 2, from you directly and automatically through the site.

• Right to know the categories and specific pieces of personal information we have collected, and their sources, purposes, and recipients.
• Right to delete personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information, and of targeted advertising.
• Right to limit the use of sensitive personal information.
• Right to non-discrimination for exercising any of these rights.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. Because we do not sell or share, we do not offer a “Do Not Sell or Share My Personal Information” mechanism — there is nothing to opt out of. We honour the Global Privacy Control signal regardless. You may use an authorised agent to submit a request on your behalf, with proof of authorisation.

8. Children

This is a business-to-business website and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Third-party links

Our site links to external sites, including our scheduling provider, our technology partners, and professional networking profiles. We are not responsible for their privacy practices. Review their policies before providing personal information.

10. Changes to this policy

We may update this policy to reflect changes to our practices or to legal requirements. The “last updated” date above will change. Where a change is material, we will take reasonable steps to bring it to your attention. Continuing to use the site after a change takes effect means you accept the revised policy.

11. How to contact us

Our Privacy Officer is responsible for our compliance with this policy and can be reached at:

Privacy Officer
Spearstone, Inc.
330 – 5th Ave SW, Suite 1800
Calgary, Alberta, Canada T2P 0L4
privacy@spearstone.partners
877-638-4933

For legal notices other than privacy requests, use legal@spearstone.partners.