Privacy Policy | Twirling Umbrellas™

Overview

Twirling Umbrellas Ltd. respects your privacy and is committed to protecting personal information in a responsible, transparent, and reasonable way.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, contact us, use our forms, subscribe to our communications, download resources, or otherwise interact with Twirling Umbrellas.

In this Policy, “Twirling Umbrellas,” “we,” “us,” and “our” mean Twirling Umbrellas Ltd. “You” and “your” mean any person whose personal information we collect, use, or disclose.

1. Who We Are

Twirling Umbrellas Ltd. is a digital agency based in Kelowna, British Columbia. We provide web strategy, design, development, WordPress, hosting support, maintenance, accessibility, privacy, security, content, and related digital services.

Our mailing address is:

Twirling Umbrellas Ltd.
Kelowna Innovation Centre
201-460 Doyle Avenue
Kelowna, BC V1Y 0C2
Canada

2. Scope of This Policy

This Policy applies to personal information we collect through:

our website;
website contact forms and inquiry forms;
newsletter, resource, event, or marketing signups;
email, phone, video call, social media, and other business communications;
analytics, cookies, pixels, tags, logs, and similar website technologies;
proposal, sales, and business development activities;
client, prospect, supplier, partner, and contractor relationship management; and
other interactions that refer or link to this Policy.

This Policy does not apply to websites, applications, platforms, portals, or digital services that we build, host, maintain, or support for clients, unless those services expressly link to this Policy as their applicable privacy policy.

When we process personal information on behalf of a client, we do so according to our agreement with that client and, where applicable, the client’s own privacy policy, instructions, and legal obligations.

This Policy also does not apply to third-party websites, platforms, or services that we do not own or control.

3. What Personal Information Means

“Personal information” generally means information about an identifiable individual.

Depending on the context, this may include your name, contact details, business role, inquiry details, online identifiers, device information, usage information, communication history, preferences, and other information that can identify you directly or indirectly.

Some privacy laws distinguish business contact information from other personal information. Even where business contact information is treated differently under applicable law, we still handle it responsibly and use it only for reasonable business purposes.

4. Personal Information We Collect

The personal information we collect depends on how you interact with us.

Information You Provide to Us

We may collect information that you choose to provide, such as:

name;
organization name;
job title or role;
business email address;
business phone number;
mailing address;
website address;
project details;
budget, timeline, and service interests;
messages, questions, feedback, or inquiry details;
newsletter, resource, event, or marketing preferences;
proposal, procurement, or RFP-related information;
meeting details and communication history;
files or materials you choose to send us;
job application information, if you apply for a role with us; and
any other information you choose to provide.

Please do not send us confidential, sensitive, regulated, proprietary, or highly private information through general website forms unless we have specifically asked you to do so or we have a written agreement in place that governs that information.

This includes passwords, access credentials, payment card details, health information, sensitive employment information, private client records, regulated data, or confidential business materials.

Information Collected Automatically

When you visit our website, we and our service providers may automatically collect technical and usage information, such as:

IP address;
browser type and version;
device type;
operating system;
referring website or campaign source;
pages viewed;
links clicked;
forms started or submitted;
time and date of visits;
approximate location based on IP address;
interaction data, such as scrolling, clicks, and page engagement;
cookie identifiers and similar online identifiers;
error logs;
server logs;
security logs; and
other information about how the website is accessed and used.

Where available, we may use approximate country information derived from an IP address to display limited regional content, such as a homepage greeting. We do not request precise device location, store this country signal in a visitor profile, or use it for advertising.

Some of this information may not identify you on its own, but it may be personal information if it can reasonably be connected to you.

Information From Third Parties

We may receive information about you from third parties, such as:

someone in your organization who contacts us about a project;
referral sources;
business partners;
publicly available sources;
social media or professional networking platforms;
event organizers;
marketing, CRM, analytics, or advertising platforms; and
service providers that help us operate our business.

When you provide us with information about another person, you are responsible for ensuring that you have the right to do so.

5. How We Use Personal Information

We use personal information for reasonable business purposes, including to:

operate, maintain, secure, and improve our website;
respond to inquiries and messages;
evaluate whether we may be a good fit for a project or relationship;
prepare proposals, estimates, recommendations, and related materials;
communicate with prospects, clients, suppliers, partners, contractors, and other business contacts;
provide guides, templates, downloads, event materials, or other resources you request;
send newsletters, updates, invitations, and marketing communications where permitted by law;
manage subscriptions, preferences, and unsubscribe requests;
understand website usage, performance, and content effectiveness;
improve our services, website, content, resources, and user experience;
identify and fix website errors;
monitor, prevent, and respond to security issues, spam, fraud, abuse, or unauthorized access;
manage our CRM, records, operations, and internal administration;
manage hiring and contractor inquiries, where applicable;
enforce our Terms of Use and other agreements;
comply with legal, accounting, tax, regulatory, insurance, and reporting obligations; and
establish, exercise, or defend legal rights.

We do not sell personal information.

We do not knowingly collect personal information through the website for the purpose of selling it to unrelated third parties or allowing unrelated third parties to market their own products or services directly to you.

6. Consent

We collect, use, and disclose personal information with your consent, where consent is required by applicable law.

Consent may be express, such as when you subscribe to marketing communications, or implied, such as when you submit a contact form and we use the information you provided to respond to your inquiry.

You may withdraw consent at any time, subject to legal, contractual, and practical limits. For example, if you withdraw consent for us to use your contact information, we may no longer be able to respond to an inquiry, provide requested information, or maintain a business relationship with you.

You can unsubscribe from marketing communications using the unsubscribe mechanism in the communication or by contacting us.

7. Enquiries and Marketing Communications

When you submit our contact form, we use your information to respond to your enquiry and manage our relationship with you. Our website sends your email address, first and last name, organisation, and any linked TwirlingGPT business context and AI-written question summaries to Customer.io to create or update a contact profile and record the enquiry. This server-side step does not depend on optional website cookies. We do not send the complete message or telephone number to Customer.io. Making an enquiry does not subscribe you to email updates.

A contact enquiry does not subscribe you to our newsletter. A newsletter signup separately records your subscription choice, the consent wording and page, and the signup time. Accepting Marketing cookies also does not subscribe you to email. We send commercial electronic messages only where we have the consent or other authority required by applicable law.

When you allow Marketing tracking, Customer.io can associate website activity with your contact profile after you identify yourself through a supported form. This can include earlier anonymous activity recorded while Marketing consent was in place. Declining browser tracking does not prevent us from receiving and responding to your enquiry.

We use Customer.io to administer email subscriptions and communications. Our workspace is configured to require opt-in consent for email open tracking and to tie link tracking to that consent. Where permitted by your tracking preference, email pixels and tracked links can record opens and clicks. Email software and privacy features can affect the accuracy of these records.

Use the unsubscribe or preference link in our emails, or contact [email protected], to change your email choices. We may still send requested replies, project communications, service notices, and legally required messages. Website Cookie Preferences control browser tracking; they do not replace email subscription and tracking preferences.

8. Cookies and Similar Technologies

We use cookies and similar technologies to operate the website, understand how it is used, improve performance, support security, remember preferences, measure campaigns, and improve our content and services.

Cookies and similar technologies may collect information such as device details, browser details, IP address, pages visited, referral source, approximate location, and interactions with website content.

Some cookies are necessary for the website to function. Others support analytics, performance measurement, marketing, or user experience.

You can usually set your browser to block or delete cookies. Some website features may not function properly if cookies are disabled.

Please see our Cookie Policy for more information about the cookies and similar technologies we use.

9. Website Measurement

With Analytics consent, Google Analytics measures page visits, referral sources, device and browser information, approximate location, and website interactions. Search measurement may include the search terms you enter. Please avoid personal or confidential information in website searches. Google Analytics receives general TwirlingGPT categories, without chat questions or answers. Our own conversation review is described in section 10.

With Marketing consent, Customer.io records website activity and may associate it with a contact profile, as described in section 7. Campaign attribution records help us understand which sources lead to enquiries. The OpenAI Ads Measurement Pixel measures visits and conversions associated with advertising in ChatGPT. Advertising measurement is separate from processing a TwirlingGPT conversation.

Cloudflare also provides cookieless performance reporting through its Web Analytics beacon. It runs before optional tracking consent and reports page-performance measurements. Cloudflare states that this service does not use cookies, local storage, or fingerprinting to track individuals. Our separate use of Cloudflare for website delivery and security can involve network addresses and request logs.

We do not currently use heatmaps or session replay on this website. Our Cookie Policy lists the technologies, storage periods, and available controls.

10. AI-Assisted Tools

We may use AI-assisted tools to support our internal business operations, such as organizing information, drafting internal notes, summarizing non-sensitive materials, improving workflows, assisting with code review, or supporting content and strategy work.

When we use AI-assisted tools, we take reasonable steps to limit the personal information shared with those tools to what is necessary for the relevant purpose. We also consider the nature of the information, the sensitivity of the information, the tool’s settings, and the contractual or technical safeguards available.

We do not intentionally submit highly sensitive personal information received through general website forms to AI-assisted tools unless there is a specific business need and appropriate safeguards are in place.

Client confidential information, regulated data, production credentials, and sensitive project materials should not be submitted through general website forms.

AI processing can include information retrieved from connected email, documents, project systems, or code repositories, as well as information entered in a prompt. Access should be limited to the authorized task. Business chat workspaces, coding tools, and APIs have different storage, retention, and training terms; the TwirlingGPT API descriptions below do not describe every internal AI product. Processing on a client’s behalf remains subject to the client’s instructions and applicable agreement.

TwirlingGPT Website Chat

TwirlingGPT is an optional website chat that answers questions about Twirling Umbrellas. When you ask a question, the recent conversation is sent to the AI provider for the model you select, which may be Google, Anthropic, or OpenAI. The provider uses that information to generate the answer. Processing may take place in the United States or another country where the provider operates.

We remove email addresses and phone-like numbers before sending conversation text to a provider, on a best-effort basis. This process may not identify every kind of personal information. Please do not include personal, confidential, sensitive, regulated, or proprietary information in a TwirlingGPT conversation.

We keep TwirlingGPT questions, answers, AI-written question summaries, retrieved sources, and business context for up to 30 days from the start of a server conversation. Our team reviews this information to improve the advice, identify questions our website does not answer well, and understand how the tool helps visitors. Up to 20 recent chats are also saved in your browser; chats inactive for 30 days are removed the next time you open the chat page. Your selected model stays until you clear this site’s browser data.

To maintain the conversation and prevent abuse, we keep access credentials, request status, response timing, model information, and a short-lived answer cache. Daily limits use a one-way code derived from your network address, with a counter and last general topic retained for up to 24 hours. We keep aggregate conversation, follow-up, and enquiry counts for up to 90 days. Aggregate counts do not contain questions or answers. Infrastructure and AI providers may keep separate security or diagnostic records under their own retention rules.

If you accept Analytics cookies, Google Analytics may receive general chat events, such as the model used, whether a question was answered, response time, and link activity. If you accept Marketing cookies, Customer.io may receive chat activity, short AI-written summaries of your questions, and business details you supply, such as your organisation, industry, public website, platform, project stage, and main challenge. This helps us personalise communications and associate relevant activity with an existing contact profile. We do not infer a person’s identity from a website address. The integration does not send full chat transcripts to Google Analytics or Customer.io.

TwirlingGPT may ask a relevant follow-up to understand your organisation or project. Details you provide are remembered to tailor the conversation. These details are extracted from your words and are not independently verified. You can correct a detail or ask the chat to forget it. Sharing a website address does not mean TwirlingGPT has inspected that website.

If you go on to contact us from the same browser session, we may link the conversation to your enquiry and contact profile. Supplied business context and short AI-written question summaries are attached as internal enquiry details, separately from the message you write. These summaries describe the questions you asked; they are not verified facts about you. Enquiries and customer profiles follow the retention criteria in section 16, separately from the 30-day chat history.

Use Clear all chats to remove the chat records accessible from that browser and cancel queued enrichment. Expired chats become inaccessible at expiry and are removed by scheduled cleanup. Removing one remembered business detail does not erase earlier transcript text, submitted enquiries, or information previously delivered to a service provider. Contact our Privacy Officer to request access, correction, or deletion of those separate records, or to discuss your privacy choices. Backup copies may remain until their normal replacement cycle.

The providers apply their own API data terms:

OpenAI states that API data is not used to train its models unless the customer opts in. Its standard abuse-monitoring logs may contain prompts and responses and are retained for up to 30 days. TwirlingGPT also asks OpenAI not to store response application state.
Anthropic states that API inputs and outputs are deleted within 30 days under its standard commercial terms, subject to usage-policy, legal, feature-specific, or separately agreed exceptions. Anthropic says it does not use retained API data for model training without express permission.
Google’s Gemini Developer API data terms depend on the account and service tier. Paid-service terms say prompts and responses are not used to improve Google’s products, while unpaid-service terms differ. Limited abuse-monitoring retention may apply. We do not promise zero retention by any AI provider.

Provider terms can change. The current details are available in the OpenAI API data controls, Anthropic commercial data retention, and Gemini Developer API data controls.

11. Service Providers and Third Parties

We may disclose personal information to service providers and other third parties that help us operate our website, communicate with you, deliver services, manage our business, and comply with legal obligations.

These may include:

website hosting and infrastructure providers;
website platform, CMS, plugin, and development tool providers;
form, CRM, and marketing automation providers;
email and business productivity providers;
analytics, tag management, heatmap, and website performance providers;
security, spam prevention, firewall, backup, logging, and monitoring providers;
project management, file storage, and collaboration providers;
scheduling and video conferencing providers;
accounting, payment, invoicing, and bookkeeping providers;
professional advisers, such as lawyers, accountants, insurers, and consultants;
contractors and team members who support our work;
prospective purchasers, successors, or advisers in connection with a business transaction; and
regulators, courts, law enforcement, or other parties where required or permitted by law.

We require service providers to use personal information only for the purposes for which it was provided to them, subject to their own legal obligations and the terms of our arrangements with them.

12. Providers Used by This Website

The following providers support the website features described in this Policy. A provider receives information relevant to the feature you use and the choices you make; listing a provider does not mean every visitor’s information is sent to it.

Provider or product	Role and information involved
Pantheon	Hosts our WordPress website, including form records, site files, and operational logs.
Cloudflare	Delivers and protects the website, handles network and request information, and provides the separate cookieless performance reporting described in section 9.
Google Analytics and Google Tag Manager	Google Analytics measures consented website activity. Tag Manager manages when configured tags run; loading its container does not itself mean all analytics or advertising tags run.
Customer.io	Maintains enquiry and subscription profiles, sends communications, and records consented website and email activity as described in section 7.
OpenAI Ads Measurement Pixel	Measures advertising attribution and conversions with Marketing consent. This is separate from the AI chat service.
Google, Anthropic, and OpenAI APIs	Generate TwirlingGPT answers when you submit a question to the selected model. See section 10 for conversation processing and provider terms.

We also use business systems for email, project delivery, files, accounting, and professional support as described in section 11. Client information processed on a client’s behalf is subject to the applicable client agreement and Data Processing Addendum. Software installed on our servers, including WordPress, is not automatically a separate recipient of your information.

13. Embedded Content and Third-Party Links

Our website may include links to third-party websites, platforms, resources, social media pages, videos, maps, forms, or embedded content.

Embedded content from third-party websites may behave as though you visited that third-party website directly. Those third parties may collect information about you, use cookies, track your interaction with their content, and combine that information with other information they have about you.

We do not control third-party websites or services. Their privacy policies, cookie policies, terms, and practices apply to your use of those services.

14. International Processing and Storage

We are based in Canada, but some of our service providers may process or store personal information in Canada, the United States, the European Economic Area, the United Kingdom, or other jurisdictions.

When personal information is processed or stored outside your province, territory, or country, it may be subject to the laws of that jurisdiction, including lawful access by courts, regulators, law enforcement, or government authorities.

We use reasonable contractual, technical, and organizational measures to protect personal information handled by service providers.

15. Safeguards

We protect personal information using reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information.

These safeguards may include access controls, secure hosting practices, encryption where appropriate, authentication controls, staff and contractor access restrictions, confidentiality obligations, backups, monitoring, logging, security tools, and internal procedures.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, disposal, loss, and similar risks.

BC PIPA requires organizations to make reasonable security arrangements to protect personal information under their control.

16. Retention

We keep personal information for the purpose for which it was collected and for any additional period required by law. Retention depends on the record and the system holding it.

Website form records: our website database normally keeps submissions for 24 months. A daily scheduled job removes older submissions. This does not delete separate email, CRM, project, or backup copies.
Enquiries, email, CRM, and project records: we retain the information needed to respond, carry out the relationship, document instructions, and address legal or contractual matters. The relevant criteria are the status of the relationship, the last substantive interaction, the need for the record, and applicable legal requirements. These systems do not all follow the website’s 24-month deletion schedule.
Subscriptions and preferences: we retain subscription and consent records while needed to administer communications and demonstrate the basis for sending them. After an unsubscribe, we may retain a minimal suppression record to prevent further unwanted messages.
Accounting and legal records: we retain the records required by applicable tax, accounting, claims, and legal-hold requirements. These purposes do not justify keeping every copy of unrelated personal information.
Logs and backups: periods depend on the service, security purpose, and backup cycle. Backup copies may remain until the relevant cycle expires and are used for recovery rather than ordinary business activity. A deletion from an active system is not an immediate deletion from every backup.
TwirlingGPT: the browser, daily pseudonymous records, aggregate topic counts, and provider records have the separate periods described in section 10.
Cookies and browser storage: the Cookie Policy gives their lifetimes. Those lifetimes do not determine the retention of information already received by a provider.

When information is no longer needed, we delete or anonymize it, subject to required retention. You may contact our Privacy Officer about access, correction, deletion, or the retention of a particular record. We will explain any applicable limits.

17. Privacy Breaches

If we become aware of a privacy breach involving personal information under our control, we will assess the breach and take reasonable steps to contain it, investigate it, reduce the risk of harm, and prevent similar incidents where appropriate.

We will notify affected individuals, regulators, clients, service providers, or other parties where required by applicable law or where we determine that notification is appropriate in the circumstances.

For organizations subject to PIPEDA, breaches that pose a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada, affected individuals must be notified, and records of all breaches of security safeguards must be kept.

18. Your Privacy Rights

Subject to applicable law, you may have the right to:

request access to personal information we hold about you;
ask how we use or disclose your personal information;
request correction of inaccurate or incomplete personal information;
withdraw consent for certain uses or disclosures;
unsubscribe from marketing communications;
ask questions about our privacy practices;
make a complaint about how we handle personal information; and
contact a privacy regulator if you are not satisfied with our response.

We may need to verify your identity before responding to a request. We may also ask for enough detail to help us locate the relevant information.

We will respond to access and correction requests within the time required by applicable law. BC PIPA gives individuals access and correction rights and generally requires organizations to respond within 30 days, subject to permitted extensions.

Access may be limited in certain circumstances, such as where disclosure would reveal personal information about another person, reveal confidential commercial information, interfere with an investigation, breach legal privilege, or create security, legal, or safety concerns.

19. Accuracy and Correction

We make reasonable efforts to keep personal information accurate and complete where it is likely to be used to make a decision about you or disclosed to another organization.

You can contact us to request correction of personal information that you believe is inaccurate, incomplete, or out of date.

If we do not agree to make a requested correction, we will annotate the information as required by applicable law.

20. Children and Youth

Our website and services are intended for business, professional, and organizational audiences. They are not directed at children.

We do not knowingly collect personal information from children under 13 through the website. If you believe a child has provided us with personal information, please contact us so we can review and address the issue.

21. Business Transfers

We may disclose or transfer personal information as part of a proposed or completed business transaction, such as a sale, merger, reorganization, financing, acquisition, or transfer of all or part of our business or assets.

Where required, we will use reasonable measures to protect personal information in connection with the transaction.

22. Changes to This Policy

We may update this Privacy Policy from time to time.

When we update it, we will revise the “Last updated” date at the top of the page. The updated Policy will take effect when posted unless a later effective date is stated.

If required by law, we will provide additional notice or request consent for material changes.

23. Contact Us

For questions, requests, or complaints about this Privacy Policy or our privacy practices, please contact:

Privacy Officer
Twirling Umbrellas Ltd.
Kelowna Innovation Centre
201-460 Doyle Avenue
Kelowna, BC V1Y 0C2
Canada

Email: [email protected]

24. Complaints to a Privacy Regulator

We encourage you to contact us first so we can try to resolve your concern.

If you are not satisfied with our response, you may contact the privacy regulator that applies to your concern, which may include:

Office of the Information and Privacy Commissioner for British Columbia

Office of the Privacy Commissioner of Canada

The applicable regulator may depend on the nature of the information, where it was collected, where it was processed, and which privacy law applies.