Legal
Privacy policy
Last updated 23 September 2026
This policy is not finished yet. The sections marked below are waiting on details that cannot be invented — a named privacy contact, a mailing address and confirmed retention periods. Until they are filled in, the assessment and contact forms should not be collecting anything in production.
Who this is about
Xpand Media (Calgary, Alberta, Canada) operates this website. This policy explains what personal information we collect through it, why, what we do with it, and how you can get it back or have it deleted.
We are subject to Alberta’s Personal Information Protection Act (PIPA) and, for information collected across provincial or national borders, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Commercial email is governed by Canada’s anti-spam legislation (CASL).
What we collect, and why
The Growth Assessment
When you work through the assessment we collect the answers you choose, and optionally your business name and website address if you enter them. These are used to produce the read you see on screen and to understand your situation before we speak.
Before you reach the contact step, your answers are stored against a random session identifier with no personal identifiers attached. If you never complete the flow, we have no way to contact you and we do not try to. Those partial records exist only so we can see which questions people abandon, and they are deleted automatically after 30 days.
At the contact step we ask for your email address, and optionally your name and phone number. Email is required only because it is how the written copy of your read is delivered. Phone is optional: a plan can be delivered by email, so making a phone number a condition of receiving it would not be defensible. You can skip the contact step entirely and still see your full result.
The contact form
Your name, the phone number or email you give us, and what you write. Used to reply to you. That is all.
Automatically
Standard web request information: IP address, browser and device type, the pages you visit and the page that referred you. We also record which steps of the assessment were viewed and completed, so we can tell where the flow is failing people.
We do not currently run Google Analytics, advertising pixels or any third-party tracking script on this site. The usage measurement described above is first-party: it is recorded by this site’s own server and is not shared with an advertising network. If that changes, this section will be updated before it changes.
What we do not do
- We do not sell your information. Not to anyone, at any price.
- We do not share it with advertisers or data brokers.
- We do not use abandoned, anonymous assessment sessions to contact or retarget anyone.
- We do not add you to a marketing list because you asked us a question.
Marketing email and consent
The written copy of your read is a reply to a request you made, so it is sent because you asked for it. Anything beyond that — occasional practical advice — requires your express consent, given by ticking a separate, unticked box. It is never bundled with the submit button and it is never pre-ticked.
Your read is sent whether or not you tick that box. Every marketing email carries a working unsubscribe link, actioned within ten business days at no cost to you. We keep a record of the exact consent wording you were shown, along with the date and time, because the burden of proving consent sits with us.
Outstanding: CASL requires the consent request itself to include a mailing address. Until one is published here, the marketing opt-in is not shown anywhere on this site and no marketing consent is being collected.
Who else touches your information
We use a small number of service providers to run the site: a hosting and edge network provider, and a transactional email provider that delivers your read and our reply. They process information on our instructions only. We will name them specifically here once the production stack is finalised.
How long we keep it
- Completed enquiries and assessment submissions: 24 months, then reviewed.
- Anonymous partial sessions: 30 days, then deleted automatically.
- In your own browser: your assessment answers are also saved locally on your device so you can come back to them. Clearing your browser data removes them, and they expire after fourteen days.
Getting access, corrections or deletion
You can ask what we hold about you, ask us to correct it, or ask us to delete it. We will respond within the timeframes PIPA sets.
Outstanding: Alberta PIPA requires a named individual responsible for privacy, with a contact method. That person has not been designated yet, and this section must be completed before the site collects anything in production.
Changes
If this policy changes in a way that affects what we do with information already collected, we will say so here and update the date at the top.