DRAFT draft-2026-10b: written in plain language for review by a lawyer before launch. Not legal advice.

Privacy Policy for honestlocalweb.ca

This policy explains how Honest Local Web (Steven Taylor, sole proprietor, Pain Court, Ontario) handles personal information about our clients and visitors to honestlocalweb.ca, under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Each client site is run by its owner, who is responsible for their own visitors' information; see their site's privacy page.

Who to contact

Our privacy contact is Steven Taylor: privacy@honestlocalweb.ca, 6310 Grande River Line, Pain Court, ON.

What we collect

• Account: your name, email, password (stored only as a scrambled hash), 2-step code settings, business details and everything you put on your site.
• Billing: handled by Stripe. Stripe collects your card, billing name and address. We receive your billing name, address, the card brand and last 4 digits, and payment status. We never see or store your full card number.
• Logs and security: IP address, browser, pages requested, sign-ins, and an audit log of account actions (sign-up, publish, edits, reports, downloads) with date, time and IP.
• Reports: the reason and details someone gives when reporting a site, and their IP address (to stop abuse).
• Cookies: one essential sign-in/session cookie for the portal. We don't use advertising cookies on honestlocalweb.ca.
• Google services you connect: if you connect Google Search Console or Google Analytics 4 to your site, we store the connection details and the statistics needed to show them to you. If we use Google Analytics on honestlocalweb.ca itself, it sets cookies to count visits; you can block them in your browser.
• Lead counts: for your site we count form sends and phone/email taps (type, page, date only; no visitor identity).

Why we use it

To create and run your account and site; to bill you and process refunds; to verify who holds an account and prevent fraud and abuse; to send service emails (receipts, publishing results, reports, outage, renewal and policy-change notices); to respond to complaints, copyright notices and legal requests; to keep the service secure; and to meet legal and tax obligations. We don't sell personal information and don't send marketing email without your consent.

Who we share it with

• Stripe (payments), IONOS (web hosting, database and email), and Google (only if you connect Search Console or Analytics). They process information for us under their own privacy and security terms.
• Copyright owners, complainants, police or courts, where the law requires or permits it (for example, forwarding a copyright notice or answering a court order).
• A buyer or successor business (including a corporation we set up) if the service is transferred.

Where it's stored

Our hosting provider, IONOS, runs its shared web hosting from data centres in the United States and Europe, not in Canada, and Stripe and Google also process data outside Canada. Your information may be stored and processed outside Canada and may be accessible to courts and authorities there under their laws.

How long we keep it

Account and site data: while your account is open, plus up to 90 days after it ends. Nightly backups: rolled over automatically. Audit log: 2 years. Billing records: as long as tax law requires (generally 6 years in Canada). Copyright notice records: 6 months, or longer if legal proceedings start. Anything tied to a complaint or legal request: until it's resolved.

Your rights

You can see and correct most of your information in the portal, download your site at any time, and ask us for a copy of the personal information we hold about you, to correct it, or to withdraw consent (which may mean closing your account). Email privacy@honestlocalweb.ca; we'll answer within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

Security and breaches

We use encryption in transit (HTTPS), hashed passwords, optional 2-step sign-in, limited access and backups. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected people and the Privacy Commissioner as soon as feasible, as PIPEDA requires, and keep a record of every breach for 24 months.

Changes

We'll post changes here and email account holders about important ones.