Privacy policy

This site is operated by EP System Solutions (trading as EP Systems), a sole proprietorship based in Alberta, Canada. We are the organisation responsible for the personal information described on this page.

You can reach us at epkg16@gmail.com about anything on this page, including a request to see or delete your information.

What you type. The project form asks for your name, email address, and optionally your phone number, your business name, what you need built, and how you handle leads today. The booking form asks for your name, email, and the slot you picked. Nothing on either form is collected that you weren't shown a field for.

Where you came from. When you arrive with campaign tags on the URL (utm_source, utm_medium, utm_campaign, and the Google/Meta click identifiers), we hold those in your browser's session storage and attach them to your submission, along with the page you submitted from. This tells us which ad or link actually produced an enquiry. It is cleared when you close the tab, and if you never submit anything it never leaves your browser.

Technical request data. Our form and booking endpoints record the IP address a submission came from, for rate limiting and spam defence. Our host keeps standard server logs.

We do not ask for, and have no field for, payment card numbers, government identifiers, or any sensitive category of information.

We do not sell, rent, or trade your information. We do not share it with data brokers or advertising networks. We do not add you to a newsletter or a drip sequence you didn't ask for.

This site runs no third-party analytics and no advertising pixels — there is no Google Analytics tag, no Meta pixel, and no session-recording script on any page. The only cross-site request a normal visit makes is the anti-spam challenge described below.

We set no advertising or analytics cookies, so there is no consent banner to click through. Two things do use your browser's storage:

Session storage holds the campaign tags described above until the tab is closed. Cloudflare Turnstile, the anti-spam challenge on our forms, sets its own short-lived token to confirm you're not a script. Turnstile is used precisely because it does not profile visitors or track them across sites.

We use what you send us to reply to your enquiry, to prepare for and hold the call you booked, to quote work, and — if you become a client — to run the engagement. We use the attribution data in aggregate to judge which marketing is worth continuing.

Under Canadian privacy law (PIPEDA and Alberta's Personal Information Protection Act) our basis is your consent: you gave us the information for the purpose printed on the form, and we use it for that purpose. If we ever wanted it for something else, we would ask first.

We keep the list of service providers deliberately short. Each one handles data on our instructions only:

Vercel — hosts this site and processes the requests to it. Cloudflare — runs the Turnstile anti-spam check. Supabase — the database behind the EP Systems platform, our own lead tracker, where your submission lands. Resend — the email service that carries your submission to us if the lead tracker is unreachable, so that a form you filled in is never quietly lost.

Some of these process data on servers outside Canada, principally in the United States. That means the information can, in principle, be reached by the courts and authorities of the country it sits in. We mention this because Alberta's legislation asks us to, not because anything unusual happens to it.

We will disclose information without your consent only where the law requires it — a court order, a warrant, or a comparable legal demand.

Enquiries that don't turn into work are kept for 24 months and then deleted, so that we can pick up a conversation you left and go back a year later. If you become a client, we keep the records for as long as we work together and for seven years after that, because Canadian tax and business records rules require it.

Rate-limiting records and server logs roll off within days. Spam submissions are discarded, not stored.

You can ask us to show you what we hold about you, correct anything wrong, or delete it entirely. Email epkg16@gmail.com and we'll act on it within 30 days — usually the same day. There is no form and no fee.

Deletion means deletion: the lead record and the message go, and we stop contacting you. The only thing that can survive is what we are legally required to keep, such as an invoice.

If you think we've handled your information badly and we haven't put it right, you can complain to the Office of the Privacy Commissioner of Canada or, in Alberta, to the Office of the Information and Privacy Commissioner of Alberta.

Submissions travel over HTTPS. Access to the lead tracker is restricted to accounts we control, protected by a password and row-level database rules. Our forms are gated by a CAPTCHA, a honeypot, and per-address rate limits.

No system is perfect. If a breach ever created a real risk of significant harm to you, we would notify you and the Privacy Commissioner, as Canadian law requires.

When we build and run a system for a client, we handle that client's customer data on their behalf, under their own privacy policy and our contract with them — we don't use it for our own purposes, and we never merge it with anything here. The EP Systems platform at ep-systems.app publishes its own privacy policy covering that role.

If we change this policy we'll update the date at the top. For a change that materially affects what we do with information we already hold, we'll email the people it affects rather than relying on you to re-read the page.