Privacy Policy

1. Who we are

OnePoint Solutions Marketing Agency ("OnePoint", "we", "us", "our") is a marketing agency based in Edmonton, Alberta. Our registered address is 15020 116 Ave NW, Unit 2, Edmonton, AB T5M 3T4, Canada.

For anything privacy-related, contact our team at info@onepointsolutionsca.com or (780) 229-8464.

2. What personal information we collect

We only collect what you give us — never scraped, never bought from third parties. Specifically:

• Contact form & SEO Audit form: first and last name, email, phone number, business name, website URL, Google Business Profile URL or name, business address (street, city, province, postal code, country), and any goal or note you type in.
• Newsletter or blog signups: email address only.
• When you become a client: whatever's needed to deliver the service — billing details, brand assets, existing website credentials (if you hand them over), Google Business Profile access, social account access, etc. You control what you share.
• Automatic technical data: browser type, device type, referring page, IP address, and pages visited — collected by our analytics (Google Analytics 4) and hosting (Cloudflare) so we can see what's working on the site.

3. Why we collect it and how we use it

Every piece of info has a job to do:

• To reply to your enquiries and provide quotes for the services you ask about.
• To run the free SEO audit you requested — we submit your website to Google's PageSpeed Insights API and do our own on-page checks, then send the report to your email.
• To deliver contracted services — websites, SEO, social media, signage — under the agreement we sign with you.
• To follow up by email, phone, or SMS about the specific enquiry or audit you submitted.
• To improve our website using aggregate analytics data (never tied back to you personally).

We do not use your information for automated decision-making, profiling for advertising, or any purpose you didn't consent to. If we ever want to use your data for something new, we'll ask first.

4. Who we share your information with

We do not sell, rent, or trade your personal information to anyone. Ever.

We do share limited data with a small set of vendors we need to run the business:

• GoHighLevel (LeadConnector, USA) — our CRM. Stores contact info and audit results so we can follow up with you.
• Resend (Delaware, USA) — sends transactional email (audit reports, replies to forms).
• Google Workspace (USA) — our business email and calendar.
• Cloudflare (USA) — hosts our website and handles inbound email routing.
• Google Analytics 4 & Google PageSpeed Insights (USA) — aggregate site analytics and the SEO audit engine.
• Brevo (France) — SMTP relay for sending from our custom-domain email addresses.

Each of these vendors has their own privacy policy and is required by contract (or by us using their standard terms) to protect your data. We only share what's needed to make the service work.

We may also disclose your information if required by law (e.g., a court order, tax audit, or investigation by Canadian authorities). We'll only share what's legally required, no more.

5. Cookies and tracking

Our website uses a small number of cookies and similar technologies:

• Essential cookies — needed for the site to work (e.g., remembering you accepted a cookie notice).
• Analytics cookies (Google Analytics 4) — help us count visitors and see which pages people read. Anonymised at the IP level.
• Cloudflare cookies — used to protect the site from bots and DDoS attacks.

You can block cookies in your browser settings at any time. Blocking analytics cookies won't affect the site's functionality.

6. How long we keep your information

We only keep your personal information for as long as we need it:

• Enquiry / audit-only contacts — kept for 24 months after your last interaction, then deleted. If you never respond after our follow-up, we delete you sooner.
• Active clients — kept for the duration of our engagement plus 7 years afterwards, only because Canadian tax law requires us to keep business records that long.
• Backups & archives — automatic backups may hold your data for up to 90 days after deletion. Nothing you or we can do about that in real-time, but it does eventually clear.

7. Your rights under PIPEDA and PIPA

As a Canadian resident, you have specific rights over your personal information. You can email info@onepointsolutionsca.com to exercise any of them. We reply within 30 days at the latest — usually within a day or two.

• Access — ask us for a copy of the personal information we hold about you.
• Correct — ask us to fix inaccurate or incomplete information.
• Delete — ask us to remove your information from our systems (we'll comply unless we're legally required to keep it, e.g., for tax records).
• Withdraw consent — you can withdraw your consent to us using or sharing your information at any time. We'll act on it right away, though it may mean we can no longer provide certain services to you.
• Complain — if you think we've mishandled your information, you can complain to us first (we'll investigate), or directly to the Office of the Privacy Commissioner of Canada or the Alberta Office of the Information and Privacy Commissioner.

8. How we protect your information

Practical, honest security — not marketing fluff:

• All web traffic to onepointsolution.ca uses HTTPS (TLS 1.3).
• Passwords and API keys are stored as encrypted secrets in Cloudflare Workers or 1Password — never in code or spreadsheets.
• Access to your data in our CRM, email, and Google Workspace is limited to authorised staff on our team. We use least-privilege access — team members only see the data they need for the work they're doing.
• We use multi-factor authentication on every critical account (Google Workspace, GHL, Cloudflare, GitHub).
• Backups are encrypted at rest.

No system is perfectly secure. If we ever have a data breach that affects you, we'll notify you without unreasonable delay — as required by Canadian law under PIPEDA's breach reporting rules.

9. International data transfers

Most of our vendors (GoHighLevel, Resend, Google, Cloudflare) are based in the United States. By using our services, you consent to your personal information being processed in the US and in France (Brevo). These transfers rely on standard contractual protections and the vendors' own certifications (e.g., EU-US Data Privacy Framework where applicable).

10. Children

Our services are for businesses and their owners. We don't knowingly collect personal information from anyone under 13. If we learn we've received data from a child, we'll delete it immediately.

11. Changes to this policy

We may update this policy from time to time — for example, if we add a new vendor or change how we use information. When we do, we'll update the "Last updated" date at the top and, if the change is significant, email you directly (if we have your email) or post a notice on the site.

12. How to contact us

For anything privacy-related — questions, corrections, deletion requests, complaints — the easiest way to reach us is:

— The OnePoint Solutions team