Owners ask us fair questions before they hand over their website, ad accounts or customer list. Who can see our data? What happens if we leave? Are your AI tools reading our customers' messages? Are the texts you send for us legal? This page answers those questions in plain language and explains how we work.
It describes our standard practice. It is not legal advice, and it does not replace your own legal or privacy advisor.
Privacy: PIPEDA
PIPEDA is the federal law that covers how most Canadian businesses collect, use and share personal information. When we build a website, a form, a CRM or an AI agent for you, we work to these habits:
- Collect only what is needed. Forms ask for what you will actually use to serve the customer, not everything that might be handy one day.
- Say why. Your site gets a clear privacy policy explaining what is collected and why, and forms link to it.
- Limit access. Our team gets access only to the systems a project needs, with individual logins and two-factor authentication where the platform supports it. We do not share logins over chat or email.
- Remove access when work ends. When a project or engagement finishes, our access is removed or handed back to you.
- Tell you quickly. If we become aware of a possible breach in a system we manage for you, we tell you promptly so you can meet your own reporting duties.
Quebec Law 25 (Gatineau and Quebec clients)
Quebec's privacy law sets stricter rules than PIPEDA for businesses that handle personal information of people in Quebec. For clients in Gatineau and across Quebec we:
- Keep tracking off until consent. Analytics and ad-tracking tools that can identify or profile visitors are set up so they do not run before the visitor agrees.
- Help you name a privacy lead. Law 25 expects a person in charge of personal information, by default the most senior person in the business. We help you publish their contact details.
- Flag data leaving Quebec. Many tools store data outside the province. We tell you where a tool stores data so you can assess it before personal information is transferred.
- Write consent in clear French and English. Consent requests and privacy notices are written so a customer understands them.
Email and text campaigns: CASL
Canada's Anti-Spam Legislation applies to commercial emails and text messages. In campaigns and follow-up sequences we run for you:
- We only message people with consent, express or implied, and we record how and when consent was given in your CRM.
- Every message identifies your business and includes contact information.
- Every message has a working unsubscribe, and unsubscribes are processed automatically.
- We do not buy or rent contact lists for your campaigns.
Accessibility: AODA and WCAG
Ontario's AODA requires larger organisations to make their public websites accessible. Our target for every website we build, whatever your size, is WCAG 2.1 AA: readable colour contrast, keyboard navigation, alt text on meaningful images, labelled forms, and headings that make sense to screen readers. We test key pages before launch and tell you about anything that falls short, such as third-party widgets we do not control.
You own your accounts and data
Whatever we build or run for you stays yours. Our standard approach:
- Domain: registered in your business's name, with you holding the account.
- Website: you own the content, design files and site. If you move to another provider, we hand it over.
- Ad accounts: Google Ads and Meta Business accounts are in your name, and we are added as a partner. Spend is billed to your card, so you see exactly what went to the platforms.
- CRM and customer data: the CRM is in your name where the platform allows, and you can export your contacts and history at any time.
- Admin access: for IT and business systems such as Microsoft 365 or Google Workspace, you keep top-level admin access to your own environment, even when we manage it day to day.
How we use AI
We use AI tools to work faster, for drafting, research, code and analysis. Our rules:
- Business-grade tools only. We use business versions of AI tools whose terms say customer inputs are not used to train their models.
- No customer personal information in prompts. We do not paste your customers' names, contact details, health or financial details into AI tools. When we need real examples, we remove identifying details first.
- A person reviews the work. AI drafts are reviewed and edited by a person before they reach you or your customers.
- AI agents we build for you are clear and limited. They tell customers they are automated, hand off to a person when needed, collect only what the job requires, and are reviewed regularly. If you want a written policy for your own team, start with our AI use policy guide.
Security basics we follow
Two-factor authentication on our own accounts, a password manager instead of shared spreadsheets, up-to-date devices, and least-privilege access to client systems. For your office, the small office cybersecurity routine and the cybersecurity checklist cover the same habits.
Three ways to start
- Check yourself, free: run the website checkup to see your site's privacy, tracking and accessibility basics.
- Done with you: we review your forms, tracking, consent and accounts with you and give you a short list of fixes.
- Done for you: we put the fixes in place on your website, CRM and campaigns as part of a fixed-quote project.
If you have a privacy question about work we do for you, email info@1club.ca or call +1 613-777-5737. This page explains our usual practice and is not legal advice; for your own obligations, speak with a lawyer or privacy professional.