Privacy Policy

Scope and Accountability

This policy explains how Guitard Inc. collects, uses, discloses, retains, and protects personal information associated with guitard.ca, its operated subdomains, and direct communications with us.

Guitard Inc. is accountable for personal information under its control. The Privacy Officer is responsible for overseeing privacy compliance and responding to questions, access requests, and complaints.

This policy reflects the fair information principles in Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and is intended to support compliance with other applicable privacy laws. The law that applies depends on the circumstances, jurisdiction, nature of the organization’s activities, and location of the individual.

Information We Collect

Information you provide

We may collect information you choose to provide when you contact us, submit a security or accessibility report, exercise a privacy right, or otherwise correspond with us. This may include:

• your name, pseudonym, organization, and contact details;
• the content of your message and attached material;
• technical details needed to investigate a report;
• your communication, accessibility, or acknowledgement preferences; and
• records of our correspondence and response.

Information collected automatically

When you access the site, our hosting, content-delivery, security, and analytics provider may process technical information needed to deliver and protect the service. Depending on the request and enabled features, this may include:

• IP address and approximate country or region;
• request date and time, hostname, path, referring site, and response status;
• browser, operating system, device type, and user-agent information;
• network, performance, and page-load timing information;
• security signals, bot-detection results, and challenge outcomes; and
• necessary cookie or similar challenge identifiers.

We do not ask you to provide sensitive information unless it is genuinely necessary. Please do not send passwords, authentication tokens, private keys, government identifiers, payment-card information, health information, or unrelated personal information by ordinary email.

Purposes and Legal Bases

We collect and use information only for identified and appropriate purposes, including to:

• deliver, operate, maintain, and improve the website;
• protect the website, users, infrastructure, and communications from abuse or security threats;
• measure aggregate traffic, reliability, and page performance;
• receive, investigate, and respond to messages, requests, and vulnerability reports;
• provide requested accessible formats or communication supports;
• establish, exercise, or defend legal rights;
• meet legal, regulatory, accounting, and security obligations; and
• carry out other purposes explained when information is collected, with consent where required.

Where consent is the appropriate basis, you may withdraw it subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing already lawfully completed.

Where European Economic Area or United Kingdom data-protection law applies, our legal bases may include consent, performance of a contract or steps requested before a contract, compliance with a legal obligation, and legitimate interests in operating, securing, measuring, and responding through the site, balanced against the individual’s rights.

Cloudflare, Analytics, and Cookies

Guitard Inc. uses Cloudflare to provide DNS, content delivery, traffic management, website security, bot mitigation, challenge services, and web analytics.

Web Analytics

Cloudflare Web Analytics measures page performance and aggregate usage. According to Cloudflare, its Web Analytics service collects timing metrics and reporting dimensions without using cookies or localStorage for usage metrics and without fingerprinting individuals. Analytics may include the requested host and path, referring host, country, device type, browser, operating system, navigation type, and performance measurements. Query strings are not intentionally included in Cloudflare Web Analytics reporting.

Necessary security cookies

Cloudflare security and Challenge Platform features may set strictly necessary cookies, including cf_clearance and, where applicable, other __cf* cookies. These cookies help distinguish legitimate traffic, record successful challenges, mitigate malicious automation, apply rate limits, and maintain service availability. Their presence and duration depend on the Cloudflare features triggered by a request.

Non-essential cookies

Guitard Inc. does not currently use advertising cookies or cross-site behavioural advertising on this website. If non-essential cookies or materially different analytics are introduced, this policy and any required consent controls will be updated before or when those technologies are used.

Browser settings may block or delete cookies. Blocking cookies required for security challenges may prevent access to protected pages. Because we do not sell personal information or use it for targeted advertising, browser-based opt-out signals such as Global Privacy Control do not currently change those activities; we will honour such signals where applicable law requires.

How We Disclose Information

We do not sell or rent personal information. We may disclose information only as reasonably necessary:

• to service providers that host, secure, deliver, analyze, or support the website and communications;
• to professional advisers under duties of confidentiality;
• to affected vendors or service providers when coordinating a vulnerability or operational incident;
• to comply with law, legal process, regulatory requirements, or lawful government requests;
• to protect rights, safety, users, systems, and the public from fraud, abuse, or security threats;
• in connection with a proposed or completed corporate transaction, subject to appropriate protections; or
• with your direction or consent.

Service providers may use information only to provide contracted services or as otherwise permitted by law and their applicable terms.

International Transfers

Guitard Inc. is based in Canada. Our service providers may process or store information in Canada, the United States, and other countries where they or their subprocessors operate. Information processed outside your province or country may be subject to the laws of that jurisdiction and lawful access by courts, law-enforcement, or national-security authorities.

Where required, we use contractual, organizational, and technical measures intended to protect personal information during cross-border processing. When European or United Kingdom transfer rules apply, appropriate transfer mechanisms may include an adequacy decision, approved standard contractual clauses, or another lawful safeguard.

Retention

We retain personal information only as long as reasonably necessary for the identified purposes, including responding to requests, maintaining security and business records, meeting legal requirements, resolving disputes, and enforcing agreements.

Retention periods vary by record type, sensitivity, legal obligation, operational need, and whether a matter remains active. Security records may be retained long enough to detect patterns, investigate incidents, and demonstrate compliance. Analytics data may be aggregated or de-identified and retained according to configured service settings.

When information is no longer required, we will delete, destroy, or de-identify it using measures appropriate to its sensitivity, subject to backups and lawful retention requirements.

Safeguards

We use administrative, technical, and organizational safeguards appropriate to the sensitivity and context of the information. Measures may include access controls, encryption in transit, secure configuration, logging, traffic filtering, least-privilege practices, updates, backups, and service-provider review.

No Internet transmission, email system, or storage method is completely secure. If you need to send a sensitive vulnerability report, use the encryption option described in our Security Policy.

We maintain processes to assess privacy and security incidents and will notify affected individuals and regulators when required by applicable law.

Your Rights and Choices

Subject to applicable law and limited exceptions, you may ask us to:

• confirm whether we hold personal information about you;
• provide access to that information and information about its use or disclosure;
• correct inaccurate or incomplete information;
• delete information that is no longer required or lawfully retained;
• withdraw consent where processing depends on consent;
• restrict or object to certain processing;
• provide eligible information in a portable format; and
• explain a decision affecting your request.

To protect privacy, we may need to verify your identity and authority before completing a request. We will use only the information reasonably necessary for verification. We may decline or limit a request where permitted or required by law and will explain the reason when legally allowed.

You will not be discriminated against for exercising an applicable privacy right. Authorized agents may submit requests where the law permits and adequate proof of authority is provided.

International Privacy Rights

If the General Data Protection Regulation, United Kingdom GDPR, or similar law applies to our processing of your information, you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, as well as the right to complain to your local supervisory authority.

We do not currently use personal information from this website for solely automated decisions that produce legal or similarly significant effects.

Residents of jurisdictions with additional privacy rights may submit a request using the contact information below. We will assess and respond under the law applicable to the request.

Children’s Privacy

This website provides general corporate information and is not directed to children. We do not knowingly collect personal information from children through the website. If you believe a child has provided personal information, contact us so we can assess and, where appropriate, delete it.

Third-Party Sites

The website may link to third-party sites or services. Their privacy practices are controlled by their operators and are not covered by this policy. Review their privacy information before providing personal information.

Policy Changes

We may update this policy when our practices, services, providers, or legal obligations change. The effective date and version will be updated when material changes are made. Where required, we will provide additional notice or obtain consent.

Contact and Complaints

Questions, privacy requests, and complaints may be directed to:

Please describe your request and the information or interaction involved. Do not send unnecessary sensitive information by ordinary email.

We will investigate privacy complaints and respond within the period required by applicable law. If you are not satisfied, you may have the right to complain to the Office of the Privacy Commissioner of Canada, a provincial privacy regulator, or the supervisory authority in your jurisdiction.