Privacy policy

01Scope and applicable law

This policy describes personal information handled through kaizenconsulting.ai and related consultation communications. Kaizen Consulting operates in Victoria, British Columbia. Personal information means information about an identifiable individual; business information may also be personal information when it identifies an owner, employee or other person.

British Columbia’s Personal Information Protection Act (PIPA) generally governs private-sector personal information activities within BC. Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) may apply in circumstances including interprovincial or international commercial information flows. Canada’s Anti-Spam Legislation (CASL) applies to covered commercial electronic messages. Applicable obligations depend on the activity and circumstances.

02Information you provide

Our consultation intake collects your name and email. You may optionally provide your role, phone number, preferred contact method and availability; business name, industry, location, size, revenue range and business model; website and social-media links; marketing channels and spending; operational challenges, tools and data quality; AI interests; loan or grant history and financing interests; goals, budget, timeline, referral source and notes.

Optional answers can be left blank. Please do not include passwords, payment-card details, government identification numbers, bank account numbers, health records, or confidential personal information about customers or staff. Share only information you are authorized to provide. If more sensitive details are needed for an engagement, ask us to agree on an appropriate channel first.

If you email, call, apply to join our consulting network, or contact us through WhatsApp, we receive the information you choose to share, such as correspondence, contact details, a CV or LinkedIn profile. The consultation invitation opens WhatsApp with your entered name and email in a prefilled message; WhatsApp receives information when you follow that link, and the message reaches us if you send it.

03Why we use information and how consent works

We use information to respond to enquiries, arrange consultations, assess business needs, prepare for a business health review, deliver requested services and manage related communications. Submitting a consultation request asks us to use the supplied information for those purposes, including storage and staff notifications described below. It is not a subscription to marketing.

Consent must be appropriate to the sensitivity of the information and the circumstances. We will seek additional consent where a new purpose requires it, unless the law permits or requires otherwise. You can decline optional information or ask to withdraw consent by contacting us; withdrawal is subject to legal and contractual restrictions and may limit services that require the information. We will explain those consequences.

Website preference consent is separate from permission to handle a consultation request. Accepting optional website preferences does not authorize marketing messages. Covered promotional emails or texts require express consent or another lawful basis under CASL, sender identification and a working unsubscribe method. You may ask us to stop promotional communications without affecting necessary service messages.

04Website storage and technical information

Essential local storage remembers your privacy choice (kaizen_privacy_choice, with a version, choice and timestamp). Security or sign-in features may also use essential storage where needed. Your choice remains in that browser until you change it, clear browser storage, or a policy-version change requires another choice. If browser storage is unavailable, the choice applies only to the current page session.

Optional preference storage (kaizen_lead_popup_dismissed_at) remembers when you dismiss the consultation invitation and uses that timestamp for a six-hour cooldown. It is not written unless you opt in. Choosing essential only or withdrawing that opt-in removes this timestamp. No analytics or advertising tracking scripts are currently configured in the website’s application code; any future optional tracking must be disclosed and consented to as required before activation.

Hosting, fonts and media delivery services receive ordinary request information, which may include an IP address, browser details, requested resource and time. The site loads fonts from Google Fonts and some images or media through external delivery services. Essential network requests are not disabled by the optional-preferences switch. External websites have their own privacy practices.

05Service providers and disclosures

Consultation requests are stored in Lovable Cloud. Full intake details are also sent to our business inbox through Lovable’s managed email service; your email is used as the reply-to address. Our business email uses Google Workspace. The notification system is configured to attempt staff alerts through Twilio by SMS and WhatsApp, including your name, email and any company name or phone number provided, where the messaging service is available. WhatsApp is a Meta service.

These providers handle information to support hosting, storage, email and communications. We may also disclose information where authorized or required by law, to address a privacy or security incident, or as needed for an agreed engagement. Information should only be made available to people who need it for the stated purposes. Provider privacy policies and terms also apply to their own services.

Providers may process or store information outside British Columbia or Canada, where foreign laws and lawful government access may apply. A Canadian-only storage location is not promised. Contact us before submitting information if you need to discuss location, provider or confidentiality requirements.

06Retention and safeguards

Information should be retained only as long as reasonably needed for the purpose of collection and applicable legal or contractual requirements, then securely destroyed or de-identified when no longer needed. Under BC PIPA, personal information used to make a decision directly affecting an individual must generally be retained for at least one year after use so the individual has a reasonable opportunity to obtain access. This is not a one-year deletion promise for every record.

The intake database restricts public reading, updating and deleting of submissions. Intake copies in email, messaging systems, logs and backups have separate handling and retention considerations. No fixed automatic deletion schedule for those systems is represented here. Contact us for a retention or deletion request; legal requirements, legitimate continuing needs and backup limitations may affect what can be removed and when.

Safeguards must be proportionate to the information and risks. Internet communications are not risk-free, and no website or service can guarantee absolute security. Privacy or security incidents require assessment and appropriate action, including notification and reporting where applicable law requires it.

07Access, correction and privacy concerns

You may request access to your personal information and information about its use and disclosure, request correction, or raise a privacy concern through the contact below. We may need reasonable identity verification before providing records; please do not send identification documents unless we arrange a suitable method. Requests are subject to lawful exceptions, including protections for other people’s information.

BC PIPA generally requires a response to an access request within 30 days, subject to permitted extensions. Where PIPEDA applies, its response requirements apply. We will explain any applicable exception, extension or permitted fee. If you are not satisfied, you may contact the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), or the Office of the Privacy Commissioner of Canada (priv.gc.ca) where PIPEDA applies.

08Changes to this policy

This policy is effective October 18, 2026. Changes will be posted here with an updated effective date. Material changes requiring new consent must be brought to your attention and consent obtained as required. Continued browsing alone does not opt you into new optional tracking or marketing.