Overview
This Privacy Policy explains how Twirling Umbrellas Ltd. (“we”, “us”, or “our”) handles personal information through our website, enquiries, communications, and business relationships. Personal information means information about an identifiable individual.
We are a digital agency based in Kelowna, British Columbia. Information we process on a client’s behalf is governed by the applicable client agreement and Data Processing Addendum. Clients are responsible for the privacy notices for their own websites and services.
1. Information We Collect
The information depends on how you interact with us:
- Information you provide: names, contact details, organisation and role, project requirements, budgets, timelines, messages, files, meeting records, subscription preferences, and application information if you seek work with us.
- Website information: network address, device and browser information, pages viewed, referral and campaign sources, searches, interactions, approximate location, identifiers, and operational or security logs. Optional measurement follows the choices described below.
- Information from others: referrals, information supplied by colleagues or business partners, public professional information, and records from providers supporting our business.
We may use an approximate country signal for regional website content. We do not request precise device location or store that country signal in a visitor profile for advertising.
Provide only information you are entitled to share. Please do not include passwords, payment details, health records, or other sensitive or confidential material in general website forms, searches, or TwirlingGPT. If such information is needed for client work, we can arrange a suitable channel.
2. How We Use Information
We use personal information for reasonable purposes connected with our business, including to:
- respond to enquiries, assess requirements, and prepare proposals;
- deliver services and manage client, supplier, partner, and contractor relationships;
- provide requested resources and administer subscriptions and permitted marketing communications;
- operate, measure, improve, and secure our website and tools;
- manage projects, billing, records, recruitment, and internal administration; and
- meet legal obligations, prevent misuse, and establish or defend legal rights.
We do not sell personal information. We collect, use, and disclose it with consent where required by law. Consent may be express, such as a subscription choice, or implied by a request to respond to an enquiry. Withdrawing consent may limit our ability to provide a requested service, subject to applicable legal and contractual requirements.
3. Enquiries and Email Communications
Submitting an enquiry allows us to respond and manage the relationship. Our website sends your name, email address, organisation, and any linked TwirlingGPT business context and AI-written question summaries to Customer.io to create or update a contact profile. It does not send the full enquiry message or telephone number to Customer.io. This server-side processing happens independently of optional browser tracking.
An enquiry or acceptance of Marketing cookies does not subscribe you to our newsletter. Newsletter signup separately records your subscription choice, the consent wording and page, and the signup time. We send commercial electronic messages where we have the consent or other authority required by law.
With Marketing consent, Customer.io can associate website activity with your contact profile after a supported form identifies you, including earlier activity recorded while that consent was in place. Declining browser tracking does not prevent you from contacting us.
Customer.io also manages our email communications. Our workspace requires opt-in consent for email open tracking and ties link tracking to that choice. Where permitted by your preference, pixels and tracked links record opens and clicks; email privacy features can affect their accuracy.
Use an email’s unsubscribe or preference link, or contact us, to change email choices. Requested replies, project communications, service notices, and legally required messages may continue. Website Cookie Preferences govern browser tracking separately.
4. Website Measurement and Cookies
Use Cookie Preferences in the footer to change Analytics and Marketing choices. Our Cookie Policy describes the storage, lifetimes, and controls.
- Analytics consent: Google Analytics measures visits, sources, devices, approximate location, searches, and website interactions. Search events may include the words you enter. General TwirlingGPT events do not include chat questions or answers.
- Marketing consent: Customer.io records website activity and relevant chat summaries and business context as described in Sections 3 and 5. Campaign records and the OpenAI Ads Measurement Pixel support advertising attribution and conversion measurement. The advertising pixel is separate from the AI chat service.
- Delivery and performance: Cloudflare provides network security and cookieless Web Analytics performance reporting. The performance beacon runs before optional consent. Cloudflare states that Web Analytics does not use cookies, local storage, or fingerprinting to track individuals. Delivery and security services separately process network and request information.
Google Tag Manager controls configured tags; loading its container does not enable every optional tag. We do not currently use heatmaps or session replay.
5. AI-Assisted Tools and TwirlingGPT
Business tools
We may use AI tools for tasks such as drafting, summarising, organising information, code review, and research. This can involve prompts or relevant information from connected email, documents, project systems, or repositories. We limit information and access to the task and use safeguards appropriate to its sensitivity. Client information remains subject to the client agreement and instructions. Business workspaces, coding tools, and APIs have different data terms.
Website chat
TwirlingGPT is an optional chat about our agency. Your recent conversation is sent to the provider for the selected model, which may be OpenAI, Anthropic, or Google, to generate a response. Processing may occur in the United States or other countries where the provider operates. We attempt to remove email addresses and phone-like numbers before sending conversation text, but this does not reliably remove all personal information. Do not include sensitive or confidential information.
We retain questions, answers, AI-written question summaries, retrieved sources, and supplied business context for up to 30 days from the start of a server conversation. Our team may review these records to improve the tool, identify gaps in our website, and understand visitor enquiries. Up to 20 recent chats are also stored in your browser. Chats inactive for 30 days are removed when you next open the chat page; your model preference remains until site data is cleared.
The chat may remember details you supply about your organisation, website, industry, platform, project stage, or needs to tailor responses. These details and AI-written summaries are not independently verified. You can correct or ask the chat to forget a remembered detail. Supplying a website address does not mean the chat has inspected it or identified you personally.
With Marketing consent, Customer.io may receive chat activity, short question summaries, and supplied business context for relevant communications and contact-profile enrichment. Google Analytics receives only general chat events with Analytics consent. These integrations do not send full chat transcripts to those services.
If you contact us from the same browser session, we may associate your conversation with the enquiry. Business context and short question summaries can be added as internal enquiry details and passed to Customer.io as described in Section 3, separately from your written message. Those enquiry records follow Section 7 and may outlast the chat history.
Use Clear all chats to remove the chat records accessible from that browser and cancel queued enrichment. Forgetting a detail does not remove it from earlier messages or information already sent elsewhere. Contact us about separate enquiry or provider records. Backup copies may remain through their normal replacement cycle.
To run the chat and prevent abuse, we also process access credentials, request status, timing, model information, and temporary cached answers. Daily limits use a one-way code derived from your network address; associated counters and the last general topic remain for up to 24 hours. Aggregate usage and enquiry counts remain for up to 90 days and do not contain questions or answers.
AI providers may retain separate security or diagnostic records. Their terms explain retention and training practices: OpenAI API data controls, Anthropic commercial data retention, and Gemini API data controls. These terms vary by product and service tier; we do not promise zero provider retention.
6. Providers and Other Disclosures
We use providers to operate our website, communicate, and deliver and administer our services. Our shared provider list, maintained in Section 5 of the DPA, identifies these tools and their purposes. Providers receive information relevant to their role, and we use contractual and other reasonable measures to protect information processed for us.
We also use relevant design, collaboration, accounting, payment, and professional service providers. Information may be shared with authorised personnel, contractors, advisers, or authorities for the purposes in Section 2, or in a business sale or reorganisation with appropriate safeguards and as permitted by law.
Providers may process or store information outside Canada, including in the United States, Europe, and other locations where they operate. Information there may be accessible to authorities under local law.
Independent websites and services you visit through links have their own privacy practices. Embedded content may send information to its provider and use its storage or tracking technologies. Their policies apply to that independent use.
7. Retention
We keep information for the purposes described in this Policy and applicable legal requirements. The period depends on the record:
- Website form submissions: normally 24 months in the website database. Separate email, contact, project, and backup records have their own retention periods.
- Enquiries, email, and project records: while needed for the relationship, instructions, service delivery, and relevant legal or contractual matters, considering the last substantive interaction and continuing need.
- Subscriptions and consent: while needed to administer communications and record consent. A minimal suppression record may remain after unsubscribe to prevent further unwanted messages.
- Accounting and legal records: for applicable recordkeeping and legal-hold periods.
- Logs and backups: according to the security purpose and service’s retention or replacement cycle. Backups are used for recovery and may not be deleted immediately when an active record is deleted.
- TwirlingGPT and browser storage: the periods in Section 5 and the Cookie Policy. Browser storage expiry does not delete information already received by a provider.
We delete or anonymise information when it is no longer needed, subject to required retention.
8. Safeguards and Incidents
We use reasonable administrative, technical, and physical safeguards appropriate to the information, including access restrictions, secure credentials, confidentiality duties, and suitable system protections. No transmission or storage method is completely secure.
If a privacy breach occurs, we take reasonable steps to assess and contain it and provide notices required by applicable law.
9. Your Choices and Requests
You may contact us about access, correction, withdrawal of consent, deletion, or a complaint. We respond according to applicable law and may need to verify your identity and locate the relevant records. Rights and available responses depend on the information and circumstances, including legal retention, confidentiality, privilege, and other people’s privacy.
You may also contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada, as applicable.
Our website is intended for business and professional audiences, not children. Contact us if you believe a child has provided personal information so we can address it.
10. Updates and Contact
The version and effective date above identify this Policy. We update it when practices change and provide additional notice or obtain consent where required by law.
For questions, requests, or complaints, contact our Privacy Officer at [email protected], or write to Twirling Umbrellas Ltd., Kelowna Innovation Centre, 201-460 Doyle Avenue, Kelowna, BC V1Y 0C2, Canada.
