SturdyIQ Public SolutionsDiscuss a project
Menu

Trust and governance

How we handle privacy, AI use, security responsibilities and the rules around our services.

Privacy Policy – SturdyCloud IT Ltd.

Effective Date: July 22, 2024

Last Updated: September 2, 2026

Legal Entity

For this policy, SturdyCloud IT Ltd. is the company legal name and the responsible legal entity unless a separate written agreement states otherwise.

Where this policy uses “SturdyCloud,” “we,” “our,” or “us,” it refers to SturdyCloud IT Ltd. and its websites, platforms, services, and client-facing systems.

1. Introduction

SturdyCloud IT Ltd. ("SturdyCloud", "we", "our", or "us") is committed to protecting your privacy and safeguarding your information using industry-aligned security and governance practices.

This Privacy Policy explains how we collect, use, disclose, and protect your information when you interact with our website, services, platforms, forms, portals, AI-enabled workflows, automation systems, scheduling pages, payment links, support channels, and related digital properties.

We comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), and align our practices with recognised security, governance, and accessibility standards, including SOC 2 readiness principles and WCAG accessibility guidelines.

Where applicable, we also design our practices to be CASL-aware for electronic communications and GDPR-aware when we handle personal data from individuals in the European Union, European Economic Area, United Kingdom, or other jurisdictions with similar privacy requirements.

2. Information We Collect

We collect only the information necessary to deliver our services effectively.

a. Personal Information

  • Name
  • Email address
  • Phone number
  • Company name
  • Job title
  • Billing and payment details, if applicable
  • Contact preferences
  • Meeting, intake, or scheduling information

b. Business & Operational Data

  • Company information submitted through forms
  • Project requirements, RFP responses, and workflow data
  • Uploaded documents, templates, and files
  • Current systems, tools, processes, and operational requirements
  • AI readiness assessment responses
  • Support requests, onboarding details, approvals, and project notes

c. Technical & Usage Data

  • IP address
  • Device and browser information
  • Pages visited and session activity
  • Cookies and analytics data
  • Form submission events
  • Approximate location derived from technical data
  • Login, access, and activity records where applicable

d. AI & System Input Data

When using our platforms, AI agents, AI Office systems, AI Operations Partner services, AI-native SaaS applications, call-answering workflows, or automation tools, we may process:

  • User inputs
  • Generated outputs
  • Prompt, workflow, and configuration data
  • Call transcripts, summaries, recordings, or call metadata where applicable and permitted
  • Scheduling, support, routing, lead qualification, and field logistics records
  • System or workflow status data

e. Consent & Communication Data

For CASL-aware communication practices, we may store:

  • Consent status
  • Source of consent
  • Date and time of consent
  • Communication preferences
  • Unsubscribe or opt-out requests
  • Records of service-related or commercial electronic messages

3. How We Use Your Information

We use your information to:

  • Deliver and operate our services
  • Respond to inquiries and provide support
  • Generate AI-driven outputs, proposals, documents, summaries, and workflows
  • Improve system performance, reliability, and user experience
  • Communicate service notices, project updates, support messages, and relevant offerings
  • Maintain security, monitor for threats, and prevent fraud
  • Manage billing, subscriptions, payments, documents, and service records
  • Operate scheduling, call-answering, support, and customer communication workflows
  • Maintain consent, unsubscribe, and communication preference records
  • Meet contractual, regulatory, and legal obligations

We do not sell personal information.

4. AI & Automation Use

SturdyCloud provides AI-powered tools and automation services.

  • Outputs are generated based on user-provided inputs and system configurations.
  • Users are responsible for reviewing and validating all outputs before use.
  • Users should avoid submitting sensitive personal or regulated data unless explicitly required under a secured agreement.
  • AI systems may support drafting, summarisation, routing, classification, scheduling, customer support, lead intake, proposal generation, business analysis, and workflow automation.

SturdyCloud does not guarantee the accuracy or completeness of AI-generated outputs and is not liable for decisions made based on such outputs.

Material decisions should remain subject to human review, especially decisions involving legal, financial, employment, healthcare, safety, public-sector procurement, regulated, or customer-impacting outcomes.

5. CASL-Aware Electronic Communications

SturdyCloud may send electronic communications, including emails, form responses, booking confirmations, newsletters, service updates, educational content, proposals, invoices, and commercial offers.

Where CASL applies, SturdyCloud aims to ensure commercial electronic messages include:

  • appropriate consent or another lawful basis for the communication
  • clear identification of SturdyCloud IT Ltd. as the sender
  • accurate contact information
  • an unsubscribe mechanism where required
  • prompt handling of unsubscribe or opt-out requests

Transactional, service, security, billing, legal, support, and project-related communications may still be sent where permitted or required to deliver services, manage agreements, or comply with obligations.

6. Information Sharing

We do not sell personal information. We may share information only as necessary with:

a. Authorised Service Providers

Including cloud infrastructure providers, communication and messaging providers, payment processors, scheduling tools, document-signing platforms, automation tools, AI providers, analytics systems, and support tools. Providers are selected based on security, reliability, operational fit, and compliance expectations.

b. Strategic Partners

Where required to deliver services, such as infrastructure, development, managed service, compliance, cabling, telecom, AI, or implementation partners, under appropriate confidentiality and data protection obligations.

c. Legal & Regulatory Authorities

When required to comply with applicable laws, legal processes, regulatory obligations, court orders, or enforceable government requests.

d. Business Transactions

In connection with mergers, acquisitions, restructuring, financing, due diligence, or sale of business assets, subject to confidentiality protections.

7. Data Storage & Residency

  • Data may be processed and stored in Canada or other jurisdictions depending on infrastructure, service, vendor, and client requirements.
  • Where possible, SturdyCloud prioritizes Canadian data residency.
  • Cross-border data transfers are protected using contractual, organizational, and technical safeguards where appropriate.
  • Some third-party providers may process or store information outside Canada.
  • Client-specific residency, retention, and hosting requirements should be documented in the applicable agreement, proposal, statement of work, or data processing terms before implementation.

8. GDPR-Aware Processing

Where the GDPR or similar privacy laws apply, SturdyCloud aims to handle applicable personal data using recognised privacy principles, including transparency, purpose limitation, data minimisation, security, accountability, and appropriate rights handling.

Depending on the service and relationship, SturdyCloud may act as a controller, processor, service provider, or subcontractor. Client-specific roles and obligations should be documented in the applicable agreement where GDPR or similar international requirements are in scope.

Where applicable, individuals may have rights to request access, correction, deletion, restriction, portability, objection, or withdrawal of consent, subject to legal, contractual, security, and operational limits.

9. Security & SOC 2 Readiness Alignment

SturdyCloud aligns its security practices with SOC 2 Trust Services Criteria, focusing on:

  • Security – protection against unauthorised access
  • Availability – reliable system performance and uptime
  • Confidentiality – protection of sensitive information

Our safeguards include:

  • encryption in transit and at rest where applicable
  • role-based access controls and authentication
  • continuous monitoring, logging, and alerting where applicable
  • secure cloud architecture and infrastructure hardening
  • vendor risk awareness and controlled integrations
  • separation between public demo environments and client data
  • secrets management and controlled administrative access

We continuously improve our controls as part of our SOC 2 readiness programme.

10. Accessibility — WCAG 2.2 AA Development Target

SturdyCloud is committed to providing an accessible digital experience. Our websites, landing pages, funnels, portals, documents, AI-enabled interfaces, and client-facing workflows should be designed with reference to WCAG 2.2 AA where applicable.

Development should take accessibility into consideration from the beginning, including:

  • semantic HTML and clear document structure
  • keyboard navigation
  • visible focus states
  • sufficient colour contrast
  • form labels and accessible error messages
  • meaningful link and button text
  • alt text for meaningful images
  • captions, transcripts, or text alternatives for video and audio where practical
  • responsive layouts that support zoom and mobile use
  • accessible authentication, scheduling, signing, and payment flows
  • testing with automated tools and manual review where practical

If you experience accessibility barriers, please contact us for assistance.

11. Your Rights — PIPEDA, CASL, and GDPR-Aware Requests

You have the right to:

  • access your personal information
  • request corrections to inaccurate data
  • withdraw consent, subject to legal and contractual limits
  • request deletion of your information where applicable
  • unsubscribe from commercial electronic messages where required
  • request information about how your data is used or shared
  • exercise GDPR-related rights where applicable and legally required

To exercise your rights, contact: contact@sturdyiq.ca

12. Cookies & Tracking Technologies

We use cookies and similar technologies to:

  • improve website performance
  • analyse usage and engagement
  • enhance user experience
  • support forms, scheduling, lead capture, and conversion measurement

You may manage cookie preferences through your browser settings. Where required, SturdyCloud may provide additional cookie notice, consent controls, or analytics options.

On sturdyiq.ca, Google Analytics 4 is an optional analytics service using measurement ID G-8ZXG4ZCRTV. The analytics tag does not load until a visitor accepts optional analytics. If accepted, Google Analytics may process page URLs, device and browser information, approximate location, session information, and interaction events. This website disables advertising storage, Google signals, and advertising-personalisation signals in its tag configuration. Visitors may decline analytics or reopen Analytics preferences from the website footer. Google processes accepted analytics data under its own terms, policies, and configured retention controls.

13. Third-Party Services & Integrations

Our services may integrate with third-party platforms such as:

  • CRM systems
  • automation tools, including n8n, Zapier, or similar platforms
  • AI providers, including OpenAI, Anthropic, Google AI, self-hosted models, or other approved providers
  • scheduling platforms, including self-hosted Cal.com or related tools
  • document-signing platforms, including DocuSeal
  • payment processors, including Stripe
  • communication providers, including email, SMS, phone, or voice providers
  • hosting, object storage, monitoring, and security providers

These providers operate under their own privacy policies, terms, and security controls.

14. Data Retention

We retain information only as long as necessary to:

  • deliver services
  • meet legal and contractual requirements
  • resolve disputes and enforce agreements
  • maintain security, billing, audit, and operational records
  • comply with tax, accounting, regulatory, or procurement obligations

Users may request data deletion or export at any time, subject to legal, contractual, backup, security, and operational obligations.

15. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.

16. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be posted on this page with a revised "Last Updated" date.

The effective date of this policy remains July 22, 2024. The September 2, 2026 update adds the optional Google Analytics disclosure and visitor analytics preferences. Earlier updates addressed CASL, GDPR-aware, WCAG 2.2, AI, automation, and service-delivery clarifications.

17. Contact Information

SturdyCloud IT Ltd.

Email: contact@sturdyiq.ca

Website: https://sturdyiq.ca

Location: Ontario, Canada

With your permission, Google Analytics helps us understand which public information is useful. No analytics tag loads until you accept. Read our Privacy Policy.