Privacy policy

DeMark ("we", "us") is a small business based in New Brunswick, Canada. We run this website and the DeMark platform that small businesses use for their website, bookings, chat, quotes, invoices and online payments. This policy explains what personal information is collected, why, who else handles it, how long it is kept and what your rights are. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Two situations

• You contact DeMark itself (our contact form, chat, booking or sign-up): DeMark decides what happens with your information.
• You deal with a business that uses DeMark (you book, chat, order or receive a quote or invoice from that business): that business is responsible for your information and DeMark stores and processes it on its behalf, only to provide the service. Questions and requests go first to that business; we help it answer.

What we collect

• Contact, booking and order forms: your name, email address, phone, business name or delivery address if you provide them, your message, and the date and time you choose.
• Chat widget: what you type in the conversation and the details you give so the business can follow up.
• Email: when you reply to a message or write to a support address, the sender, subject and content are used to attach your message to the right request.
• Quotes, invoices and payments: what was quoted or billed, amounts and payment status. Card details are entered on Stripe's pages and never reach our servers.
• Business accounts: the name, email address, password (stored only as a one-way hash) and two-factor settings of the people who log in to the platform.
• Technical logs: our application keeps error and security logs to troubleshoot and to stop abuse. We keep them short: they do not record message contents, full email addresses, phone numbers or access tokens, and they are rotated automatically.

We count visits to our pages on our own server, without cookies: we do not store your IP address or your browser details, only the page, the referring site or campaign, the device type and an anonymous session identifier that changes every day. The detailed visit records are deleted after 90 days; after that we only keep daily totals that identify no one.

When you agree to receive news by email or reminders by text message, we keep a record of when you agreed, where (for example the booking form), your IP address and the exact wording you accepted. We keep the same record when you unsubscribe. Canada's anti-spam law asks us to be able to prove consent.

Cookies

We do not use analytics trackers, advertising cookies or third-party scripts. The cookies we set are: your language preference; a session cookie when you log in; the shopping cart (30 days) and wish list (180 days) of an online shop; your cookie choice (demark_cookies, 12 months); and, only if you arrive through one of our ads, a first-party cookie (demark_origen).

demark_origen keeps for 90 days the source, medium, campaign and content of the ad that brought you, for example "google / cpc / spring". This tells us which campaign works and identifies no one. If you choose Accept in the cookie notice, it also keeps the ad click identifier (Google's gclid, wbraid or gbraid) for the same 90 days, and we use it to report bookings, contacts and sign-ups to Google Ads. Until you accept, or if you decline, no click identifier is stored in any cookie or in our database. We never keep Facebook's fbclid, and we never share your name or contact details with Google.

You can change your choice at any time with the "Cookie settings" link at the bottom of every page of our site. If you decline after accepting, the click identifier is removed from the cookie. Clearing the cookies in your browser also removes it.

Why we use it

To reply to you, confirm and remind you of bookings, prepare quotes, send invoices and take payments, deliver the service you asked for, keep a record of the exchange, and keep the platform secure. We do not sell or rent your information, and we do not share it with anyone for their own marketing.

Who else handles it

• Stripe processes card and bank payments. Each business connects its own Stripe account; Stripe receives the amount, your email and the payment details you enter.
• Anthropic (Claude), our artificial intelligence provider, receives the text of chat and request messages only to sort them (triage): what you need, how urgent it is, and a suggested draft. The AI never publishes anything to you on its own: a person reviews and approves any reply before it is sent.
• Email and text messages: messages are sent through our email provider (Google Workspace) or the business's own email provider, and appointment reminders by text message through Twilio when the business turns them on.
• Hosting: OVHcloud stores the database and backups on our server in Quebec, Canada.
• Cloudflare protects our site from attacks and passes web traffic to our server. It sees technical request data such as your IP address and the pages you open.

Where your information is stored

DeMark is based in New Brunswick and our server, with the database and backups, is hosted by OVHcloud in Quebec, Canada. Our business email runs on Google Workspace, our traffic passes through Cloudflare, and Stripe, Anthropic and Twilio may process information outside Canada. While information is outside Canada, it is subject to the laws of the country where it is — including lawful access requests by its authorities, which we would not necessarily be told about.

We tell you this because Canadian privacy law requires it, and because you should be able to decide with the facts. If you would rather your information did not leave Canada, write to us before sending anything sensitive and we will arrange another way to work together.

How long we keep it

• Chat conversations: deleted automatically 180 days after the last message.
• Incoming emails already processed: the record of the message (sender and subject) is deleted automatically after 365 days.
• Invoices and payment records: kept for 7 years, as required for tax and accounting purposes. If you ask for your information to be deleted, invoices stay but your name, email address, phone and notes are removed from them.
• Client records, bookings, orders and quotes: kept while the business works with you, until you or the business ask for them to be deleted.

Your rights

You can ask at any time what information is held about you (access), ask for it to be corrected, or ask for it to be deleted. From its dashboard, a business can download everything it holds about a client in one file and delete that client's personal information; deleting removes chat conversations and anonymises bookings, orders, quotes and invoices. You can also unsubscribe from marketing messages with the link in any of them. You can withdraw your consent at any time, subject to legal obligations such as keeping invoices.

Contact

For a business that uses DeMark, write to that business first. For DeMark, or if a business does not answer, write to the email address on our contact page. We respond within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

Security

This site is served over HTTPS. Passwords are stored as one-way hashes, secrets are encrypted, logins can require a second factor, and each business can only see its own data. Our systems are protected by access controls and regular backups. No method is perfectly secure, and if a breach ever affected your information we would notify you as the law requires.

Changes

If this policy changes, the date at the top is updated. Significant changes are communicated to current clients directly.