Request a discovery call

Privacy

What this site collects,and what it does not.

HUREAL INC., Ontario corporation 1001739473, is responsible for the personal information it handles. This page covers hureal.ca and the ways HUREAL is contacted through it, for people in Canada and the United States. Work HUREAL does inside a client's own systems is governed by the agreement with that client rather than by this page.

Effective 23 September 2026. Last updated 23 September 2026. The second date moves every time the page changes materially. This page has not been reviewed by a lawyer yet; that review is deferred, and this sentence comes off the day it is done.

This website, specifically

What happenswhen you load a page.

Most privacy policies describe a company. This part describes a page, because it is the part you can verify yourself while you are reading it.

  • Nothing optional runs until you choose

    On a first visit hureal.ca sets no cookie for you, and no measurement tool loads until you allow it. A short banner asks first. The only thing the site itself writes to your browser is the answer you give, so the question is not asked on every page. If you close the note that suggests the other HUREAL address, a date is also kept so the note is not shown again. It is not sent anywhere and it identifies nobody.

  • Analytics, only if you allow it

    If you allow measurement, two tools count visits: PostHog and Google Analytics. They record which pages are read, which buttons are pressed and where a visit came from. They never receive your name, your email, your company or anything you type into a form. If you decline, neither one loads at all, and nothing is sent to either company.

  • The typefaces come from this domain

    Inter Tight and IBM Plex Mono are served from hureal.ca itself, so loading a page no longer sends your IP address to a font host. The demonstration on the homepage still runs entirely inside the page and sends nothing anywhere.

  • No advertising or social code

    There is no advertising pixel, no remarketing tag, no heat map, no session recorder and no social embed on any page of this site.

  • Four forms, and each one stores what you send

    The discovery call, performance audit and Sprint pages each carry a request form, and the insights pages carry an email sign up. What you send is saved in HUREAL's own database, in Canada, before the page tells you it arrived; if it was not saved, the page says nothing was sent. Forms are protected against spam by a timing check, a hidden field that people never fill in, and a limit on how many requests one connection can send, all run by hureal.ca itself. A separate bot-check service is not switched on yet. Nothing about a form is sent to another company to check it.

  • Server logs

    This site is served by Vercel, from its Montreal region (yul1), and Vercel keeps standard request logs as part of serving it: an IP address, a browser string, the address requested and the time. proposed: 30 days

How to check the claims above

  1. Open your browser's storage panel before you answer the banner. It holds nothing for this site.
  2. Open the network panel, press Decline, and reload. Every request goes to hureal.ca. Nothing goes to PostHog or to Google.
  3. Press Allow all on the cookie preferences page and reload. Requests to Google and to hureal.ca/ingest, which passes events on to PostHog, appear from that point and not before.
  4. Open the form pages and read the fields. They are in the markup and every one of them is named in the table below.

The font request is gone. Earlier versions of this page disclosed that the two typefaces came from Google's font hosts and said that moving them onto this domain was the right answer. They have been moved, so that request, and that third party, are no longer part of loading a page.

The inventory

Every piece of information, and how long it stays.

A policy that lists categories and never lists the actual things is the version most sites ship. This is the list, in four parts: what every visit involves, what happens only if you allow measurement, what a request form stores, and what the email sign up stores.

Under Canada's federal private sector privacy legislation the working basis for handling personal information is your knowledge and consent, with a short list of statutory exceptions. The basis column below says which one applies to each row. Nothing on this site relies on an exception you would be surprised by, and nothing is sold, rented or traded in any row, ever.

What is collected, why, on what basis, and for how long
What Why it exists On what basis How long it is kept Who else sees it
Every visitCheckable in your browser right now
Server request logs: an IP address, a browser string, the address requested and the time Serving the page you asked for, and keeping the site available and secure. Created by the act of requesting a page. Necessary to deliver the thing you asked for. proposed: 30 days Thirty days is long enough to investigate an incident and short enough that nothing accumulates. Vercel also applies its own retention to the logs it keeps. Vercel, which hosts the site in its Montreal region.
Your cookie choice: three true or false values and the date you saved them Remembering the choice you made in the banner or on the preference page so it is not asked again. Your own action. It is written to your browser and sent nowhere. Until you clear it. It lives in your browser, not on a server, and the preference page has a button that removes it. Nobody. It never leaves your browser.
Whatever you type into the demonstration Producing an answer from a fixed set of examples held inside the page. Not collected at all. The demonstration reaches no network, so there is nothing to have a basis for. Not stored anywhere, including in your browser. It is gone when you reload. Nobody.
Only if you allow measurementNothing in these rows exists until you say yes
PostHog: the pages you view, the buttons you press, where you arrived from, any campaign tags in the address you arrived on (source, medium, campaign, content and term, with any value containing an @ or a space dropped, and advertising click identifiers never sent), the fact that a form or email sign up was sent and from which page, and a random identifier for this browser. If you send a form with measurement allowed, the random number of your record in HUREAL's database is attached, never your email or name. Knowing whether a page does its job, and which pages led to a request. Your consent, given with the measurement switch or Allow all. Withdrawing it stops collection and clears PostHog's entries from your browser. analytics retention to set PostHog, Inc. Events pass through hureal.ca/ingest on the way. PostHog region to choose
Google Analytics 4: the pages you view, the same button events, an identifier for this browser, and a lead event when you send a form The same purpose, in the tool most search reporting is built on. Your consent, as the row above. IP addresses are anonymised by Google Analytics 4. Google signals and Google's ad personalisation are used only if you also allow marketing. analytics retention to set Google LLC, under Google's own terms.
When you send a request formThe discovery call, performance audit and Sprint pages
Name, role, company and email Replying to you, and preparing the call, writing the audit or scoping the Sprint you asked about. Your consent, given by sending the form. Name, company and email are required, because a reply is not possible without them. Role is optional and marked optional on the form. 24 months from the last contact, where no engagement follows, then deleted. Long enough that a conversation picked up next year is not started from nothing. The person who replies. Supabase hosts HUREAL's database in its Canadian region.
Phone, company website, timing, the address to audit, companies to compare against, and the tools involved The same purpose. These are what make a first reply useful rather than generic. Your consent. The address to audit is required on the audit form; every other field in this row is optional and marked optional on the form. As the row above. As the row above.
What you wrote in the free text box Understanding the request before answering it. Your consent. You decide what goes in it, and the form asks for a few sentences rather than a brief. As the row above. As the row above. It is kept out of the notification email and never sent to analytics.
The page you sent it from, how you found the site, and any campaign tags in the address you arrived on Knowing which pages and which channels bring requests. Your consent, given by sending the form. It is recorded with your request, not gathered on its own. As the row above. As the row above.
A scrambled form of your IP address, your browser string, and the result of the spam checks Stopping automated and repeated submissions from reaching the inbox. Necessary to protect the form. The IP address is never stored as it is, only as a one way code that cannot be turned back into it. As the row above. The short counters used to limit repeat submissions are deleted after two days. As the row above.
The email consent tick, the exact wording you were shown, the page it was on, and the time it was recorded Proving you agreed to be emailed about your request, under Canada's anti spam legislation. Express consent. The box is not ticked when the page loads, which you can verify in the markup. Leaving it unticked still sends the request; it is stored and marked as having no email consent. 3 years after the consent is withdrawn or stops being relied on. Under that Act the sender has to prove consent, and a proceeding can begin up to three years after the regulator learns of the matter, so the proof is kept for as long as it could be asked for. As the row above.
A notice to HUREAL that your request arrived: your name, company, email, the page, how you found the site, and whether you ticked the consent box Telling a person at HUREAL there is something to answer. Whether each notice was delivered is recorded, so a request is never lost between the form and the inbox. Part of handling the request you sent. The delivery record is kept as the request is. The email provider keeps its copy under its own terms. The email provider that carries the notice. email provider to choose
Anything you send by email, or say on a call Answering you, and doing the work if an engagement follows. Your consent, given by writing or speaking to us. As a request above, and then as a client record if an engagement follows: 7 years from the end of the engagement. As the first row of this part.
When you sign up for insights by emailThe form at the foot of the insights pages
Your email address, the page you signed up on, and whether the address is confirmed Sending you new insights when they are published, and nothing else. Express consent, given twice: once by ticking the box, and again by opening the confirmation link we email you. Nothing is sent to the list until that link is opened. Until you unsubscribe. An address never confirmed stops working after 7 days. After you unsubscribe the address is kept marked as withdrawn, only so the choice is respected and can be proven, for the period in the next row. Supabase, as the database host. The email provider that sends the confirmation email. email provider to choose
Three consent records: the wording you ticked, the confirmation click, and the unsubscribe if you use it, each with its time Proving consent for every message, and proving that a withdrawal was honoured. Required to show compliance with Canada's anti spam legislation. 3 years after you unsubscribe or the consent stops being relied on, as for the request form. As the row above.

Scroll the table sideways to read it.

Where the seven years comes from. Canada Revenue Agency requires business records to be kept, generally, for six years from the end of the last tax year they relate to, which is counted from a year end rather than from the day the work finished. Seven years from the end of an engagement always covers that, which is why it is the number. What is kept for that long is the business record of the engagement, not every message sent along the way.

The policy

Sixteen sections, and what each one commits to.

The first ten follow the fair information principles that sit under Canada's federal private sector privacy legislation. The six after them are the ones a Canadian business actually needs beside those principles. Where a section names a statute, it names it so you can check it yourself.

  • 1. AccountabilityWho is responsible

    What this saysHUREAL INC. is responsible for the personal information in its custody, including information handled by anyone working on its behalf. One named person is accountable for privacy across the company and is the person a request or a complaint reaches. Quebec's private sector privacy legislation, as amended by Law 25, works on the basis that the person with the highest authority in the enterprise holds that role unless it is delegated in writing, and that the holder's title and contact details are published. HUREAL will name the person rather than rely on the default.

    Needs a decisionWho that person is, and how they are reached. privacy officer to name address to set

  • 2. Identifying purposesWhy anything is collected

    What this saysThe purpose is stated at or before the moment information is collected, on the surface where it is collected, in plain words. Four surfaces collect anything: the discovery call form, the performance audit form, the Sprint form, and the email sign up on the insights pages. Each request form opens with a short statement of what it does and what your answers are used for. The sign up says what will be sent, that you confirm the address first, and that every message can be unsubscribed from.

    Confirmed by the buildAll four link to this page, next to the fields, before anything is sent.

  • What this says, and what is already liveConsent is asked for in plain language, separately for separate purposes, and it is never bundled into a single box that also agrees to something else. Nothing is pre ticked. Consent can be withdrawn at any time, and withdrawing it is as easy as giving it. Commercial email is sent only with consent recorded against the record, with an unsubscribe that works in one action, under Canada's anti spam legislation. A request form's consent box never signs you up for the insights emails; those have their own box and their own confirmation. The discovery call form reads: "You may email me about this request and about the call. I understand this is not a newsletter subscription, that every message carries a working unsubscribe, and that I can withdraw this at any time." The audit form says the same about the audit, and the Sprint form says it about the request.

    The consent recordEach record holds the exact wording shown, the surface it was shown on, whether the box was ticked, and the date and time. It is kept in HUREAL's database in a table that can be added to and never changed: the database refuses an edit or a deletion, including one attempted from HUREAL's own admin. A withdrawal is a new record, so the history stays whole.

  • 4. Limiting collectionOnly what the purpose needs

    What this saysOnly the information necessary for the stated purpose is collected, by fair and lawful means. A field that exists because it might be useful later is not a field this site has. Every field on every form is either required for a reply or marked optional on the form itself.

    Confirmed by the buildThe discovery call form asks for name, company, email and a description of what you want built as required, a role, a website, a phone number and a timing as optional, and an email consent tick. The audit form asks for name, company, email, the address to audit and what the website should do for your business as required, and a role and companies to compare against as optional. The Sprint form asks for name, work email, company or website and the process causing difficulty as required, and the tools involved as optional. The email sign up asks for an email address and a consent tick. Alongside what you type, a request records the page, how you arrived, and a scrambled IP address, each listed in the inventory. That is the whole list and it is in the markup.

  • 5. Limiting use, disclosure and retentionAnd how long things are kept

    What this saysInformation is used only for the purpose it was collected for, unless you consent to something else or the law requires otherwise. It is not sold, rented or traded, ever, and that is a commitment rather than a current practice. Retention is set per record type rather than left at a default, and information is destroyed or anonymised at the end of it.

    The periodsEvery retention period, per record type, is in the inventory table above, in the row it applies to, with the reason beside it. Two are still open: the server log period, which depends on the host, and the analytics period, which is set in each tool. Deletion at the end of a period is not automated yet, and that is on the list of things that are not finished.

  • 6. AccuracyKeeping it right

    What this saysInformation is kept as accurate, complete and up to date as the purpose requires. If you tell us something we hold about you is wrong, it is corrected, and anyone it was disclosed to is told where that matters. A correction is made at no charge and you are told when it is done rather than left to assume it.

    Where it is correctedIn HUREAL's own database, which holds every request, contact and consent record. Every change made there from the admin is written to an audit log with who made it and when.

  • 7. SafeguardsHow it is protected

    What this saysProtection is proportionate to sensitivity: encryption in transit and at rest, access limited to the people whose work requires it, access reviewed rather than granted once and forgotten, and multi factor authentication on the accounts that matter. Security is one of the fourteen checks every HUREAL build passes before it goes live, and this site is held to the same list.

    Confirmed by the buildThere is no public sign up. The only sign in is HUREAL's own admin, it needs an emailed link and a second factor, and every table has database rules that let a visitor's browser read nothing except published insights and public site settings. IP addresses are stored only as a one way code, and what you write in a form stays in the database, out of analytics and out of logs. The site is served only over HTTPS, by Vercel in its Montreal region, and the database runs in Supabase's ca-central-1 region, in Canada.

  • 8. OpennessThis page existing at all

    What this saysThese practices are published, in plain language, at a stable address, and are available without asking anybody. That is what this page is. Where something here is not settled yet, such as a name or an address, it is shown as not settled rather than written as though it were.

    Confirmed by the buildThis page is at a permanent URL, is linked from the footer of every page on the site and from every form, and is indexable.

  • 9. Individual accessYour rights

    What this saysOn request you can be told whether HUREAL holds information about you, what it is, how it has been used, and who it has been disclosed to, and you can have it corrected. Depending on where you live you may also be able to ask for it in a portable format, ask for it to be deleted, ask for a search result about you to stop being listed, and withdraw a consent you gave earlier. Identity is confirmed before a request is answered, and confirming it never asks for more information than the request needs.

    How fast you get an answerHUREAL answers a request within 10 business days. The federal legislation sets the outer limit at 30 days from the request, and lets an organization extend it by up to 30 more days only for set reasons and only by telling you in writing, within the first 30 days, why and that you can complain to the Privacy Commissioner. The 10 day commitment is deliberately shorter, because a published commitment that only repeats the law is not a commitment. If a request ever needs longer, you are told before the 10 days are up, with the reason. The address is the single one in the last band.

  • 10. Challenging complianceIf you are not satisfied

    What this saysA complaint goes to the person accountable for privacy, is acknowledged, is investigated, and gets a written answer. If you are not satisfied with that answer you can take it to the Office of the Privacy Commissioner of Canada, and if you are in Quebec, to that province's access to information commission. Those are your routes, they have their own processes and their own time limits, and they do not depend on HUREAL agreeing with you.

    How fast it is acknowledgedWithin 2 business days, by a person. A complaint goes to the same single address as everything else on this site, which is the last band on this page.

  • 11. Service providersWho else touches it

    What this saysWhere a third party processes information on HUREAL's behalf, it is named, it is bound by contract to a standard at least as protective as this page, and it may use the information only to perform the service. The list is published here rather than described as "trusted partners", because a category cannot be checked and a name can.

    The list, as it standsSupabase, which hosts HUREAL's database in its Canadian region. PostHog and Google, for analytics, and only for visitors who allow measurement. Vercel, which serves the site from its Montreal region. The email provider that will carry notices and confirmation emails is not chosen yet. email provider to choose

  • 12. Where the data is processedRegion, and what crossing a border means

    What this saysThe storage region is chosen rather than inherited from whatever a provider defaults to, and it is stated. Where information is processed outside Canada it is subject to the law of that country, including lawful access by its authorities, and that fact is disclosed rather than left in a footnote. Quebec's legislation goes further for information about people in Quebec: before personal information is communicated outside Quebec, a privacy impact assessment has to be carried out that weighs how sensitive it is, why it is going, how it will be protected, and the law of the place it is going to. Where that rule applies to information HUREAL holds about a person in Quebec, the assessment is carried out and written down before the information moves, including to a processor in another province.

    Chosen, and still openHUREAL's database, which holds every form submission and consent record, is in a Canadian region. Analytics is different: PostHog and Google may process what they receive outside Canada, and that is one reason both stay off until you allow them. The assessment for those two is not recorded here yet. PostHog region to choose privacy impact assessment to record

  • 13. Automated decision makingWhat this website does and does not do

    What this saysThis website does not profile you, score you, or change what it shows you based on who you are. The demonstration takes what you type and answers from a fixed set of examples held inside the page; it decides nothing about you and it keeps nothing. The one automated decision on the site is the spam check on the forms, which decides whether a submission looks like a person sent it. If that ever changes, this section says so before it changes, says what the decision is, and says how to ask for a person to review it.

    Confirmed by the buildAnalytics, when you allow it, counts; nothing on the site changes because of it. A submission that the spam check flags is still stored and kept in a separate list HUREAL can read, rather than thrown away. Too many submissions from one connection in a short time are refused, and the form says so and keeps what you typed.

  • 14. ChildrenWho this site is for

    What this saysThis is a business website and it is not directed at children. HUREAL does not knowingly collect personal information from a child, and where it learns it has, the information is deleted. The federal legislation does not set a single age at which a person can consent for themselves; the regulator's published position treats information about children as sensitive and expects a parent or guardian to consent for a younger child. Quebec's legislation sets its own age. This page therefore uses the stricter numbers.

    The ageNothing on this site is meant for anyone under 18, and the forms are for people acting for a business. HUREAL does not knowingly collect personal information from anyone under 13, which is the age below which the federal Privacy Commissioner expects a parent or guardian to consent, or from anyone in Quebec under 14, which is the age Quebec's legislation sets for the same rule.

  • 15. A breachWhat happens, and when you hear

    What this saysA breach of security safeguards is contained first, then recorded in a register whether or not it turns out to be reportable, then assessed for a real risk of significant harm using the sensitivity of the information and the probability that it is misused. Where that threshold is met it is reported to the federal Privacy Commissioner and to the people affected as soon as feasible, in language that says what happened, what was involved, what is being done, and what the person can do. Any other organization that can reduce the harm is told. The federal regulations require each entry to be kept for 24 months after the day the breach is determined to have occurred, and Quebec's legislation carries its own register, kept for 5 years, and its own notification to its own regulator where there is a risk of serious injury. The assessment is made by the person accountable for privacy and is written down at the time rather than reconstructed afterwards. You hear it from HUREAL rather than from somebody else.

    How long the register is keptEvery entry is kept for 5 years from the day the breach is determined to have occurred, which meets both the federal 24 months and Quebec's 5 years with one rule. It is held by whoever section 1 names.

  • 16. Changes to this pageHow you find out

    What this saysThis page carries an effective date and a last updated date, both at the top. A material change is described at the top of the page rather than quietly folded in, and where a change affects a purpose you consented to, consent is asked for again rather than assumed. A previous version is available on request.

    Needs a decisionWhere a change history lives.

HUREAL designs to a standard, tests against it, and documents what was built. It does not certify itself and it does not give a legal or privacy opinion, on this page or on a client's project. For a client's project, that determination belongs to the client's counsel or privacy officer.

Where a request goes

One person, one address.

A privacy request, a correction, a withdrawal of consent or a complaint goes to the person accountable for privacy at HUREAL. One address, and the same address wherever it appears on this site.

Not decided yet: privacy officer to name address to set postal address to set Until those are settled this page does not print a mailbox, because an address that is not monitored is worse than no address on a page that promises a reply.

The general contact page carries the same open decisions. Cookie preferences is the surface that governs what this site is allowed to store in your browser, and where a choice made in the banner can be changed.