Privacy Policy

Schkovl Technologies and Digital Systems Architecture ("Schkovl Tech", "we", "us", or "our") is a technology and digital services company based in Toronto, Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or engage our services.

1. Information We Collect

We may collect the following types of information. For each category collected through our forms, we state why we collect it and how long we keep it.

• Contact form: your name, email address, phone number, the service you are asking about, and your message or project description. Purpose: to respond to your inquiry and evaluate your request. Retention: up to 24 months.
• Intake form, business and contact details: business name, first name, last name, email address, and phone number (all required). Purpose: to identify the business, respond to you, and arrange the kickoff call described on the intake page. Retention: up to 24 months.
• Intake form, location: city, province or state, and postal or ZIP code (all required), plus a street address (required for retail and hybrid business models, optional for service-area businesses, and not requested for online-only businesses). Purpose: to understand where the business operates and to scope local search work. Retention: up to 24 months.
• Intake form, online presence: website URL, Google Business Profile URL, and social profile handles (all optional). Purpose: to review the existing online presence before the kickoff call. Retention: up to 24 months.
• Intake form, business profile: business model, primary service (required), secondary services, service areas, years in business, and team size (optional). Purpose: to scope the work we would propose. Retention: up to 24 months.
• Intake form, ideal customer profile (optional): gender, age range, household income range, home type, and free-text customer notes. These describe the customers the business wants to reach, in general terms. Please do not enter personal information about identifiable individuals in the notes field. Purpose: to scope market and search analysis. Retention: up to 24 months.
• Intake form, average job value: a value range for the business's typical job (required). Purpose: to scope the work and understand the size of the business. Retention: up to 24 months.
• Intake form, search goals and competitors (optional, shown only for search-related inquiries): the search terms you want to be found for, the terms you are already found for, the terms you think you are missing, and the business name and city of up to three competitors. Purpose: to prepare the search analysis for the kickoff call. Retention: up to 24 months.
• Intake form, inquiry tags: the problem you selected and the pricing plan, if you arrived through a link that carries them. Purpose: to tell us what your inquiry is about. Retention: up to 24 months.
• RMPG inquiry form, business and contact details: business name, first name, last name, business email address and storefront municipality (required), plus phone number and postal code (optional). Purpose: to respond to your inquiry and scope possible retail technology work. Retention: up to 24 months.
• RMPG inquiry form, project information (optional): revenue band under OCI's previous-three-tax-years test, full-time-equivalent employee band, business category, technology interest, project stage and project description (up to 1,000 characters). We do not request your actual Business Number, tax documents, bank details, full street address or customer records. Purpose: to understand your request and scope possible technology work. Retention: up to 24 months.
• RMPG preliminary screening answers are sent to Schkovl only if you explicitly choose to include them with your inquiry; that choice defaults to No. Completing the screen without electing to submit its answers does not transmit those answers to Schkovl. If included, we retain the answers and the screening question-set version for up to 24 months to understand your inquiry. This is preliminary screening, not an OCI application or eligibility decision.
• RMPG inquiry form, notice and analytics preference: the inquiry includes the displayed privacy-notice version and a snapshot of your current analytics preference (accepted, declined or unchosen). Purpose: to record the notice and preference accompanying the inquiry, separately from marketing permission. Retention: up to 24 months. This is not a history or proof of marketing consent.
• Spam-protection data: when the intake or RMPG inquiry form loads, Google reCAPTCHA processes information about your device and your interaction with the page, as described in Section 5. We receive a score, which we use only to accept or reject the submission, and we discard the reCAPTCHA token once it is checked. Purpose: to block automated and abusive submissions.
• Technical data such as IP address, browser type, operating system, and pages visited, collected automatically via server logs.
• Communications you send to us by email or through our website.

2. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and evaluate your project request.
• Arrange and prepare for the kickoff call described on the intake page.
• Provide, operate, and improve our services.
• Communicate with you about your project or our services.
• Comply with applicable laws and legal obligations.
• Protect the security and integrity of our systems.

3. Sharing of Information

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:

• With service providers who assist us in operating our website or conducting our business. Vercel hosts this website. Intake and RMPG inquiry form submissions are saved to a Google spreadsheet we control through Google Workspace; Resend delivers an internal notification to build@schkovl.com after storage succeeds; Google reCAPTCHA provides spam protection (see Section 5). Contact form submissions are sent as an email to our contact mailbox by Google Workspace and are not saved to a spreadsheet. Unsubscribe requests sent through the website are also emailed to build@schkovl.com through Resend.
• Schkovl does not automatically submit RMPG form data to OCI. If you follow an OCI or Formstack link and submit information there, that separate submission is governed by the receiving service's privacy practices.
• When required by law, court order, or governmental authority.
• To protect the rights, property, or safety of Schkovl Tech, our clients, or others.

4. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Contact form, intake form and RMPG inquiry form submissions, including voluntarily included screening answers, are retained for up to 24 months and may be deleted upon request. Contact build@schkovl.com to request access, correction or deletion from the submission spreadsheet and controlled notification mailboxes, subject to legal retention requirements.

5. Cookies and Tracking

Our website uses Google Analytics 4 to help us understand aggregate website usage and performance. Analytics is activated only after you consent through the analytics banner. If you decline or do not make a choice, Google Analytics does not load and sends no requests. You can withdraw or change your consent at any time by reopening Analytics preferences and selecting Decline or Accept.

When enabled, Google Analytics collects device, browser, and website activity data and uses first-party cookies containing pseudonymous client identifiers. Google acts as our data processor for this information. Google Analytics retains event data according to our property's configured retention setting.

Optional RMPG analytics events contain static page, action and question-set identifiers only. Form field values, contact details, business financial or employee bands, screening responses or outcomes and project text are never included in these events. RMPG page measurement uses a page location without query strings or fragments. Your analytics preference is stored as a single choice in this browser's localStorage; we do not keep a browser consent-change history. If storage is unavailable, optional analytics stays disabled.

Vercel Speed Insights also loads only after analytics consent to measure website performance. Declining or withdrawing analytics consent disables subsequent optional measurement. These preferences do not grant permission to send promotional messages.

We do not use Google Analytics for advertising personalization or to create cross-site advertising profiles. Advertising consent signals remain denied, and we disable Google Signals and advertising personalization in the tag configuration. Apart from Google reCAPTCHA on the intake and RMPG inquiry forms, described below, our website does not use advertising cookies or third-party tracking pixels. Basic server-side logging may capture technical data (IP address, browser, referrer) for security and diagnostic purposes only.

Spam protection (Google reCAPTCHA): the intake and RMPG inquiry pages load Google reCAPTCHA v3 to tell human visitors from automated software, independently of optional analytics consent. It runs in the background without a checkbox. Google receives information such as your IP address, device and browser details, and how you interact with the page, and may set or read cookies. Our server sends the resulting token to Google and receives a score back, which we use only to accept or reject the submission. Google's use of this information is governed by the Google Privacy Policy and Google Terms of Service. reCAPTCHA is not used for advertising personalization.

6. Google User Data in Schkovl OS

Schkovl OS (app.schkovl.com) is the client workspace we provide to our clients. A client administrator may choose to connect a Google account. Connecting is optional, is started only by that administrator, and can be ended at any time. If you connect, we ask Google for only the following access:

• Google Account (openid, email): the email address and Google account ID of the connected account, where available, so we can identify which account is connected.
• Google Calendar (calendar.events.readonly and calendar.calendarlist.readonly): your upcoming events for the next 30 days, including title, start and end time, location, and organizer and attendee email addresses. We show them to the person who connected Google in the workspace. We cannot create, change, or delete events, and we do not persist full client Calendar event records. The calendar.calendarlist.readonly permission is requested for intended calendar selection but is currently unused; the workspace reads the primary calendar.
• Google Drive (drive.file): only the files you choose with the Google Picker. We save each chosen file's name, type, link, and Google file ID so your project team can refer to it. We do not download or store the contents of your files.
• Gmail (gmail.readonly): the scope technically allows reading whole messages, but the client-workspace Inbox and lead-email rules request message metadata, not message bodies or attachments. The subject, sender, and date of your 10 most recent Inbox messages are shown live to the person who connected Google; this live display is not persisted as full message records. If you set up a lead-email rule, for matching lead-notification emails we save selected header and lead metadata: subject, sender, date, reply-to address, Gmail message and thread identifiers, and whether and when the lead was answered (the reply times). No Gmail message bodies are stored for these rules.
• Google Business Profile (business.manage): Google's scope also allows managing a profile, but Schkovl OS only reads the Business Profile of the business that connected it (locations, posts, reviews, photos and performance figures) to report on them in the workspace.
• Schkovl's own Google account: Schkovl separately connects its own business Google account for its internal CRM, with gmail.readonly and calendar.readonly (read-only). Participant email addresses are used to match emails and calendar events to CRM contacts. For matching items we store the date, subject or event title, Google item identifier and, for emails, Gmail's short message preview (snippet). That is not a client connection and does not give Schkovl access to a client's Google account.

How we store and protect it. What we store depends on what is connected: the connected account's email address, Google account ID where available, and the permissions you granted; picked-file details (Drive); selected lead-email header metadata, dates, message and thread identifiers and reply status (Gmail lead-email rules); the Business Profile reviews, posts, photo details and performance figures we sync for reporting; for Schkovl's own CRM account, the items listed above; and the access and refresh tokens Google issues. Full client Calendar event records and full messages from the live Gmail Inbox display are not persisted. Client-workspace access and refresh tokens are encrypted with AES-256-GCM. Business Profile tokens also use application-level encryption, except for a small number of older Business Profile connections whose stored tokens lack application-level encryption. We have not verified that all legacy tokens have been re-encrypted. Stored credentials are kept in server-only database tables that ordinary client and staff browser sessions cannot read. Data is encrypted in transit. Row-level security controls access to your business's stored data according to the user's role and authorized business access.

How we use and share it. We use Google user data only to provide the Calendar, Drive, Gmail and Business Profile features you see in the workspace and, for Schkovl's own account, its internal CRM. We do not sell it, do not use it for advertising, do not use it to train or improve artificial intelligence or machine learning models, and do not transfer it to anyone except as needed to provide those features, to comply with the law, or for security and abuse prevention. The service providers that host Schkovl OS act only as processors for us. Schkovl staff with authorized access to your business, including assigned staff, can see connection metadata, picked Drive file details and workspace Opportunities. They do not have ordinary app access to stored tokens, client Calendar event content or Gmail lead-email records. Client Calendar events and the live Gmail Inbox are restricted to the person who connected Google; Gmail-derived lead-email records are restricted to that connecting client administrator. Privileged database administration is separate from ordinary app access and can reach stored records and credentials. Any exceptional staff access to private Google data requires your explicit permission for specific data, a security or abuse investigation, or a legal requirement.

Retention and deletion. We retain the stored Google data while it is needed for the features described above, subject to the disconnect behaviour below. Choosing Disconnect in the workspace deletes stored client-workspace credentials and picked-file details, marks the connection disconnected and records the disconnect date. The connection record remains, including the account email, Google account ID where recorded, and granted scopes. Disconnect also requests deletion of Gmail-derived lead-email data; if that cleanup fails, the app retries it when the inbox is opened or refreshed and in its daily cleanup. Leads already added to your Opportunities are not deleted. The server attempts to revoke the Google grant when a usable token is available; this is best-effort and Google revocation is not guaranteed. Disconnecting Business Profile removes its stored credentials and attempts the same Google revocation; reviews, posts, photo details and performance figures already synced remain until you ask us to delete them. Schkovl's separate internal CRM records are not deleted by disconnecting a client workspace. You can also remove Schkovl OS at any time in your Google Account permissions (myaccount.google.com/connections). To ask us to delete retained data, contact build@schkovl.com.

Schkovl's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Your Rights (PIPEDA / Canadian Privacy Law)

As a resident of Canada or a user of our services, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Withdraw consent to the collection or use of your personal information (subject to legal or contractual restrictions).
• Request deletion of your personal information where we are not legally required to retain it.

To exercise any of these rights, contact us at build@schkovl.com.

8. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. However, no method of internet transmission is 100% secure, and we cannot guarantee absolute security.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

10. Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated Last Updated date. Continued use of our website after changes constitutes acceptance of the revised policy.

12. Contact Us

For questions or concerns about this Privacy Policy, please contact: