Privacy Policy

Effective Date: August 23, 2026 (v3.0 - Analytics Consent Update)

1. Introduction

This Privacy Policy explains how Federico A Cetraro Consulting Services ("we", "us", "Provider"), a sole proprietorship registered in Nova Scotia, Canada, operated by Federico Cetraro, collects, uses, stores, and protects your personal information when you use our website and services.

We are committed to protecting your privacy and handling your data in an open and transparent manner. This policy complies with applicable Canadian privacy laws.

2. Information We Collect

2.1 Personal Information Collected:

  • Email Address (required) - Used for service delivery, booking confirmations, and support communications
  • First Name (optional) - Used for personalization of emails and communications
  • Payment Transaction Records (required by law) - Transaction ID, amount, date, payment method, package purchased
  • Package Usage Data - Number of sessions booked, used, and remaining; expiration dates
  • Booking Information - Session dates and times (when you book via online scheduling system)
  • Feedback Information (optional) - Name, company, title, rating, testimonial text (if you submit feedback)
  • Conflict-of-Interest Records - If you tell us you are connected to a firm we have a professional relationship with, we record the firm name, the package you were interested in, and the outcome. This is an integrity record that protects both of us, and it is kept separately from your account data

2.2 Data Minimisation:

We collect the minimum information necessary to provide our services. In particular:

  • We do not require full legal names, phone numbers, physical addresses, or government IDs. A full legal name is anonymised after service delivery if you provide one.
  • Sessions are not recorded and not transcribed. We do not retain conversation content.
  • Payment card details and bank account details are handled entirely by our payment processors and never reach our systems.
  • Cryptocurrency wallet addresses are not stored after payment confirmation.
  • Material you share for review (pitches, code) is deleted after delivery unless you explicitly consent to its use in a testimonial.

2.3 Technical Information:

  • IP Address - Temporarily logged for rate limiting and fraud prevention (not permanently stored)
  • Browser Type - Standard HTTP headers for compatibility
  • Device Information - Basic device type for responsive design
  • Analytics Data (only with your consent) - Page views, traffic source, approximate location derived from IP address, device and browser type, and interaction recordings. Collected by Google Analytics 4 and Microsoft Clarity. See section 7.

3. How We Use Your Information

We use your personal information only for the following purposes:

  • Service Delivery - Sending booking links, session confirmations, package codes, and deliverables via email
  • Payment Processing - Processing payments, confirming transactions, and issuing refunds (if applicable)
  • Support - Responding to inquiries, resolving issues, and providing customer assistance
  • Legal Compliance - Maintaining transaction records for tax reporting (Canada Revenue Agency requirement)
  • Fraud Prevention - Detecting and preventing payment fraud, chargebacks, and abuse

We DO NOT: Sell your data, share it with third parties for marketing, use it for advertising, or send promotional emails (except service-related communications).

4. Data Storage and Security

4.1 Where Your Data is Stored:

  • Secure Cloud Infrastructure - Payment records, package usage data, booking information stored using industry-standard cloud services
  • Email Service Providers - Delivery logs held by Brevo (email addresses only). Copies of the emails we send you are kept in our own mailbox, as described in section 6.3
  • Payment Processors - Payment transaction records subject to their respective privacy policies

4.2 Data Security Measures:

  • All data encrypted in transit (HTTPS/TLS)
  • Access controls and security rules restrict access to authorized functions only
  • Payment data processed through PCI-compliant providers
  • No payment card details stored on our servers
  • Authentication required for all administrative functions
  • Payment provider event identifiers are recorded so the same payment notification cannot be replayed against us

4.3 Data Location: Our primary records (payment records, package usage, bookings, feedback) are stored in Google Cloud Firestore in the northamerica-northeast1 region, located in Montreal, Canada. Some of our service providers process data outside Canada: payment processing and scheduling in the United States, email delivery in the European Union, and, if you have consented to analytics, Google and Microsoft in the United States. By using our services you consent to these transfers.

5. Data Retention

5.1 Retention Periods:

  • Payment Transaction Records: 7 years (required by Canada Revenue Agency for tax compliance)
  • Email Addresses: Retained indefinitely for ongoing support unless deletion requested
  • Package Usage Data: Retained for duration of package validity plus 1 year
  • Booking Information: Retained for 1 year after session completion
  • Feedback/Testimonials: Retained indefinitely if consent provided; deleted otherwise
  • Conflict-of-Interest Records: Retained for 7 years, matching the transaction records they relate to

5.2 Data Deletion: You may request deletion of your personal data by contacting notifications@cetraro.solutions. Note that we must retain payment transaction records for 7 years for tax/legal compliance.

6. Third-Party Services

We use the following types of third-party services that process your data:

6.1 Payment Processors:

  • Stripe (Stripe, Inc., United States) - card payments, Apple Pay and Google Pay
  • Wise (Wise Payments Ltd., United Kingdom) - bank transfers
  • Cryptocurrency payments are settled on public blockchain networks with no intermediary processor
  • Store payment details (not accessible to us)
  • Subject to their respective privacy policies
  • PCI-DSS compliant for card data security

6.2 Scheduling Services:

  • Calendly (Calendly LLC, United States) - session booking, receives your email address and chosen time
  • Google Calendar (Google LLC, United States) - creates the calendar event and invitation for your session
  • Some booking links send you to Google's scheduling pages, where Google's own privacy policy applies
  • Subject to their respective privacy policies

6.3 Email Service Providers:

  • Brevo (Sendinblue SAS, France) - delivers transactional emails such as confirmations and booking links
  • Brevo logs delivery status and does not retain message content
  • We keep a copy of the transactional emails we send you in our own mailbox, so we can provide support and maintain a record of what was sent
  • Subject to their respective privacy policies

6.4 Market Data Providers:

  • Provide live cryptocurrency price data
  • No personal information shared

6.5 Analytics Providers (only with your consent):

  • Google Analytics 4 - Google LLC, United States and Ireland
  • Microsoft Clarity - Microsoft Corporation, United States
  • Both are loaded only after you opt in, and each is subject to its own privacy policy

6.6 Translation Service:

  • MyMemory (Translated S.r.l., Italy) is used to translate published testimonial text into the language you are viewing the site in
  • Only already-published testimonial text is sent. None of your personal information is included
  • Because the request is made by your browser, the service receives your IP address
  • Subject to their own privacy policy

7. Cookies, Analytics and Tracking

7.1 Strictly necessary storage. We store a small amount of data on your device to make the site work. This does not require your consent and cannot be turned off:

  • Legal acceptance record (browser local storage): remembers that you accepted these terms, so you are not asked on every visit. Stores a flag, not personal data.
  • Analytics preference (browser local storage): remembers whether you allowed analytics.
  • Security verification: Google reCAPTCHA and Firebase App Check, used to prevent automated abuse of our forms and payment flows.

7.2 Optional analytics. With your consent, and only with your consent, we load two analytics services:

  • Google Analytics 4 (Google LLC): measures page views, traffic sources and aggregate usage patterns. Sets cookies on your device and receives your IP address.
  • Microsoft Clarity (Microsoft Corporation): records how pages are used, including a replay of interactions such as scrolling, clicks and mouse movement, plus aggregate heatmaps. Sets cookies on your device and receives your IP address.

Neither service is loaded until you opt in. If you do not opt in, no request is made to either provider and no analytics cookies are set. We do not use these services for advertising.

7.3 Changing your mind. You can grant or withdraw analytics consent at any time using the Analytics Preferences link in the footer of our home page (and of each language version of it). Withdrawal takes effect immediately and is as easy as granting.

7.4 What we do not do. We do not run advertising networks, we do not build advertising profiles, and we do not sell your personal information.

8. Your Privacy Rights

Under applicable privacy laws, you have the following rights:

8.1 Right to Access: Request a copy of your personal data we hold.

8.2 Right to Correction: Request correction of inaccurate or incomplete data.

8.3 Right to Deletion: Request deletion of your data (subject to legal retention requirements).

8.4 Right to Data Portability: Request your data in a structured, machine-readable format.

8.5 Right to Withdraw Consent: Withdraw consent for data processing (may prevent service delivery).

To exercise these rights, contact: notifications@cetraro.solutions

9. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you are under 18, do not use our services or provide any personal information.

10. International Users

Our services are operated from Nova Scotia, Canada, and our primary records are stored in Canada. As described in section 4.3, specific service providers process limited data in the United States and the European Union.

By using our services, you consent to this international data transfer and processing.

11. Data Breach Notification

In the event of a data breach that may affect your personal information, we will notify you via email within 72 hours of discovering the breach, as required by law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to all active users. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Information

Privacy Questions or Requests:

Email: notifications@cetraro.solutions

Subject Line: "Privacy Inquiry" or "Data Request"

Response Time: We will respond to privacy requests within 30 days.

If you are not satisfied with our response: You may raise a complaint with the Office of the Privacy Commissioner of Canada, which oversees compliance with PIPEDA. You can reach them at priv.gc.ca or by telephone at 1-800-282-1376. You are not required to contact us first, though we would prefer the chance to put things right.

14. Governing Law

This Privacy Policy is governed by the privacy laws of Nova Scotia, Canada, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

Return Home