Privacy Policy

Who we are

BuildSites ("BuildSites", "we", "us") designs, builds and maintains websites, automations and software for small businesses. Our offices are at 7 Bishop Avenue, North York, Ontario and 1001 Rue Lucien-L'Allier, Montréal, Quebec H3G 0G7. This policy explains what personal information we collect through buildsites.io and our services, why, and what choices you have. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (Law 25).

Our privacy officer is reachable at hello@buildsites.io or (437) 476-9312.

What information we collect

• Details you give us. Name, email address, phone number, business name and anything you type into our contact form, booking calendar, calculators, promo pop-up or emails to us.
• Service information. Once you are a client: your domain, hosting and account logins we manage on your behalf, website content, invoices and payment records, and the messages exchanged in your automations.
• Technical information. IP address, browser and device type, pages viewed, referring site and approximate location, collected by our hosting provider's logs and any analytics we run.
• Preferences stored in your browser. Your light or dark theme choice, whether you have seen our promo pop-up, and the area you picked on our resource pages. These stay on your device and are not sent to us.

How we use your information

• To reply to your inquiry, book and hold calls, and prepare quotes.
• To deliver the services you buy: building, hosting, monitoring and editing your website, and running your automations.
• To send service messages (booking confirmations, invoices, outage notices) and, with your consent, marketing messages.
• To keep the site secure, measure how it performs and improve it.
• To meet legal, tax and accounting obligations.

We rely on your consent, on the contract we have with you, or on our legitimate business needs, as PIPEDA and Law 25 allow. We never share personal information with anyone for their own marketing, and we do not use it for automated decisions with legal effects.

SMS opt-in and text message consent

BuildSites runs two text message (SMS) programs. Each has its own consent, collected separately, and neither is required to submit our form, book a call or buy anything from us.

1. BuildSites Customer Messages (non-marketing)

Conversational and transactional texts about your inquiry, appointment scheduling and reminders, project updates and account notifications such as invoices, payment confirmations and outage alerts. You opt in by ticking the first consent box on our contact form at buildsites.io/contact, which reads: "By checking this box, I consent to receive SMS text messages from BuildSites regarding my inquiry, appointment scheduling, project updates, account notifications, and occasional promotional offers. Message frequency varies. Message & data rates may apply. Reply STOP to unsubscribe or HELP for assistance. Consent is not a condition of purchase." You can also opt in by texting us first, or by agreeing verbally during a call or in writing, which we record with the date and time.

2. BuildSites Promotions (marketing)

Marketing and promotional texts such as special offers, discounts and new product or service updates. You opt in by ticking the second, separate consent box on the same form, which reads: "By checking this box, I consent to receive Marketing and promotional messages from BuildSites including special offers, discounts, new product updates among others. Message frequency may vary. Message & Data rates may apply. Reply HELP for help or STOP to opt-out." We never send marketing texts to anyone who has only opted in to customer messages.

How consent is collected and stored

• Both consent boxes are unchecked by default and are optional. Ticking either box is not a condition of submitting the form, booking, or purchasing any product or service.
• Consent is collected only from the person who provides the phone number. We do not buy, rent or import phone numbers or consent from anyone else.
• We record the date, time, page and wording of every consent so we can prove it on request.

Message frequency, rates and how to stop

• Message frequency varies. Customer messages: up to 4 messages per month, more only while a project or booking is active. Promotions: up to 4 messages per month.
• Message and data rates may apply according to your mobile plan.
• Reply STOP to any message to unsubscribe from that program. You will receive one confirmation message and nothing further. Reply HELP for assistance, email hello@buildsites.io or call (437) 476-9312.

Full program terms are in our Terms & Conditions.

Email. Commercial emails follow Canada's Anti-Spam Legislation (CASL): we send them only with your express or implied consent, identify ourselves in every message, and include a working unsubscribe link.

No sharing of mobile information or SMS opt-in data

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We do not sell any of your personal data. Not your phone number, your email address, your name or anything else you give us, to anyone, for any reason.

In practice: your phone number and your text message consent are used only by BuildSites to send you the messages you opted in to. The messaging platform that delivers our texts (HighLevel and its carrier partners) processes your number solely to send and receive those messages on our behalf, as a support subcontractor. Nobody else receives it, and it is never used by anyone for their own marketing.

Who we share it with

We use trusted providers to run our business. Each may process your information only to deliver its service to us:

• Hosting and delivery: Vercel (website hosting), Cloudflare (DNS).
• Customer relationship and messaging: HighLevel (CRM, forms, SMS and email), Google Workspace (email), Mailgun (transactional email).
• Payments: Interac e-Transfer and our card processor. We never store full card numbers.
• Maps, analytics and advertising: CARTO and OpenStreetMap (the map on our contact section), Microsoft Clarity (site usage analytics) and Meta Platforms (ad measurement; see Cookies and tracking below).

Some of these providers store data in the United States. Where information leaves Canada it is protected by contract and by the provider's own safeguards, and you can ask us for details. We may also disclose information when the law requires it, or to protect our rights or someone's safety.

Cookies and tracking

buildsites.io uses browser storage for the preferences listed above and may set analytics cookies to understand traffic.

Microsoft Clarity. We use Microsoft Clarity to understand how visitors use the site. Clarity records how pages are used, including session recordings (a replay of scrolling, clicks and mouse movement) and heatmaps, and sets cookies to recognise a returning browser. Personal details are masked: the name, phone number and email you type into our forms are never captured in a recording. Microsoft processes this data under its privacy statement. You can opt out of Clarity by blocking cookies from clarity.ms in your browser.

Meta Pixel and Conversions API. We use the Meta Pixel and the Meta Conversions API to measure how our ads perform and to show our ads to people likely to be interested in our services. When you submit a form, we send Meta your email, phone number and name in hashed (encrypted, one-way) form, plus technical details such as your IP address and browser type, so Meta can match the inquiry to an ad. Meta may use cookies to recognise visits from people who clicked our ads. Meta processes this data under its privacy policy. You can opt out through your Facebook or Instagram ad preferences, by blocking cookies from facebook.com in your browser, or by contacting us at hello@buildsites.io.

You can clear or block storage in your browser settings; the site keeps working, you simply lose your saved preferences.

How long we keep it

Inquiries we do not pursue are deleted within 24 months. Client records are kept for the life of the relationship and for seven years afterward to meet tax and accounting rules. Website logs are kept for up to 90 days. Automation message history is kept as long as the automation runs and deleted within 90 days of cancellation, unless you ask us to keep or export it.

Your rights: unsubscribe, update or delete your information

You are in control of your information at any time:

• Unsubscribe. Reply STOP to any text message, click the unsubscribe link in any email, or email us. We process opt-outs immediately.
• Update. Ask us to correct or update your name, phone number, email or any other detail we hold.
• Access. Ask us to show you the personal information we hold about you and how we use it.
• Delete. Ask us to delete your information, or to stop using it for a particular purpose. We keep only what the law requires us to keep (for example, tax records).
• Withdraw consent. Withdraw consent to marketing at any time without affecting the services you have bought.
• Complain. Quebec residents may lodge a complaint with the Commission d'accès à l'information du Québec; anyone in Canada may complain to the Office of the Privacy Commissioner of Canada. Quebec residents may also request their information in a portable format.

To exercise any of these rights, write to hello@buildsites.io or call (437) 476-9312. We respond within 30 days.

Data security practices

We protect your information with technical and organisational safeguards: every site we host uses HTTPS encryption in transit; form submissions and messages are stored in access-controlled systems protected by strong passwords and two-factor authentication; access to client accounts is limited to the people working on your project; sites are monitored every minute, receive security updates within 24 hours of release and are backed up nightly; and the providers we use are chosen for their own security certifications. No system is perfectly secure. If a breach creates a real risk of serious harm we will notify you and the relevant regulator as the law requires.

Children and age restriction (18+)

Our services are for businesses. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy as our services or the law change. The date at the top shows the current version. Material changes will be flagged on this page and, for clients, by email.