Black Anvil Privacy Policy

Effective date: October 9, 2026

1. Introduction

Black Anvil Inc. ("Black Anvil", "we", "our", or "us") provides marketing attribution and consulting services that help businesses measure and improve customer acquisition and retention. Protecting personal information is central to how we work. This policy explains what information we handle, the two different roles we play when we handle it, how we protect it, and the choices available to the people it concerns.

2. Two roles, and why the difference matters

We handle personal information in two distinct capacities, and different parts of this policy apply to each.

• As the organization responsible for our own business. When you visit our website, contact us, or engage us as a client, we decide how your information is handled. For that information we are the responsible organization, and Sections 3 and 5 through 16 apply.
• As a service provider to our clients. When we deliver services to a client, we may handle information that belongs to that client and their customers, either through access the client grants us to their own systems or through measurement code we provide for the client's website. We handle that information only to provide the service, under the client's instructions and our written agreement with them. The client remains the organization accountable for that information. Section 4 describes how we treat it.

3. Information we collect about you

We collect information about you in two ways.

1. Information you provide directly
   • Name, business email address, phone number, and other contact details.
   • Billing details such as company address and payment card, processed through our payment provider. Black Anvil does not store full card numbers.
   • Content you send us in the course of an engagement, such as marketing assets, campaign records, and correspondence.
2. Information collected automatically
   • Our website is hosted on a third-party platform. Like most websites, the host and any tools embedded on our pages may log standard technical information, such as your IP address, and may set cookies when you visit. See Section 12.

We do not operate client-facing accounts, logins, or dashboards. There is nothing for you to log into, and we hold no credentials belonging to you.

4. Information we handle on behalf of our clients

When a client engages us, we handle information about that client's customers in two ways.

Access to the client's own systems. A client may grant us access to systems they already operate, such as advertising accounts, analytics, websites, CRMs, or accounting software. Where they do:

• We access only what is necessary to deliver the agreed service.
• We use it only to provide the service to that client, never for our own marketing or any unrelated purpose.
• We work against the customer IDs, record numbers, or other identifiers those systems provide, rather than names or contact details, wherever the work allows it.
• We do not retain raw personal information about a client's customers in our own records.
• Access is granted and revoked by the client, and is scoped to what the engagement requires.

Measurement code on the client's website. In some engagements we provide measurement code for a client's website, installed by us or by the client, to record how visitors arrive and what they do on the site. Where we do:

• What it records: the page address, the time, any link or button pressed toward a destination the client chooses to track (such as a booking, signup, or checkout page), the advertising codes that brought the visitor to the site (UTM tags and advertising click identifiers such as gclid, fbclid, and msclkid), the domain of the referring website (not its full address), a randomly generated session identifier, and the client's identifier.
• What it does not record: IP addresses, browser or device details, names, contact details, or anything a visitor enters into a form. It does not use fingerprinting, and it does not identify individual visitors or recognize them on a later visit.
• Cookies and browser storage: it sets one first-party cookie containing the random session identifier, which expires after 30 minutes of inactivity. It may also temporarily keep the visit's advertising codes, and any events that failed to send, in the visitor's browser. These are used only to connect the pages of a single visit to the advertisement or link that started it, and are not shared with any other website.
• Hosting logs: like any web server, our hosting provider's servers see standard connection information, such as IP addresses, when the code sends data, and may hold it briefly in operational logs under the provider's own retention period. We do not store this information in our records or use it.
• Separation and access: each client's measurement data is kept separately under that client's identifier, is accessible only to Black Anvil, and is never pooled with or disclosed to other clients.
• Authorization: the client authorizes the installation in our written agreement with them.

The client remains the organization accountable for information we handle on their behalf. On request, or at the end of an engagement, we return or delete the information we hold for them.

If you are a customer of one of our clients and have a question about your information, please contact that business directly, as they are responsible for it. We will support them in responding.

5. How we use information

We process information only for legitimate business purposes, including to:

• Provide, operate, and maintain our services.
• Connect to the third-party platforms our clients authorize, to unify marketing and sales reporting.
• Generate analytics and reports for our clients.
• Process payments and manage billing.
• Detect, prevent, and respond to security incidents, technical issues, and misuse.
• Improve our services.
• Comply with legal obligations and enforce our terms.

6. Our data-minimization approach

We are built to hold as little personal information as possible.

• Wherever the work allows it, we use the customer IDs, record numbers, or other identifiers supplied by a client's own systems, rather than names or contact details.
• We do not store raw personal information about our clients' customers in our attribution records.
• Our website measurement code does not store IP addresses, does not use fingerprinting, and does not identify individual visitors.
• Before information is sent to an AI provider for processing, personal identifiers are removed. We do not send raw personal information to those providers.
• We do not collect, store, or process personal health information.

7. Data storage and security

• Our application data, including measurement code data, is stored in a Supabase Postgres database hosted in the AWS Canada (Central) region.
• Data is encrypted in transit using TLS 1.2 or higher, and at rest using AES-256.
• Access to production systems is protected by role-based access control, multi-factor authentication, and audited activity logs.
• Backups are encrypted and retained for a maximum of 30 days before secure deletion.

8. Sharing and service providers

We do not sell or rent personal information.

Providers we use to run Black Anvil

Client platforms we connect to

These are systems our clients own and operate. We access them only with the client's authorization, and the client controls that access.

We keep this list current and will confirm the providers in use on request.

9. Processing outside Canada

Our own database is hosted in Canada. Some of the providers listed in Section 8 operate outside Canada, including in the United States. Where information is processed outside Canada, we use contractual and other means to ensure it receives a comparable level of protection, consistent with Canadian privacy law. Because we minimize and de-identify the information we hold, the personal information exposed to cross-border processing is limited.

10. Data retention

We keep personal information only as long as necessary to provide our services, resolve disputes, and meet legal obligations.

• Measurement code data is retained for the duration of the engagement and deleted within 30 days of its conclusion, or sooner at the client's request.
• Other campaign and attribution data is retained for the duration of the engagement and deleted or anonymized within 90 days of its conclusion, unless a longer period is required by law.
• Information we handle on behalf of a client is returned or deleted in line with our agreement with that client.

11. Your rights and choices

Depending on your location, you may have the right to:

• Access, correct, or delete your personal information.
• Object to or restrict certain processing.
• Withdraw consent at any time, which does not affect processing carried out before withdrawal.
• Receive your information in a portable form.

To exercise these rights, contact privacy@blackanvil.ca. We may need to verify your identity before acting on a request. If your information is held by us on behalf of one of our clients, we will direct your request to that client, who is responsible for it.

12. Cookies and tracking technologies

Our website at blackanvil.ca is hosted on HubSpot, which uses cookies and similar technologies to operate the site and measure its performance. You can control cookies through your browser settings, though disabling them may affect how the site functions.

Measurement code we provide for a client's website is described in Section 4. It sets a single first-party session cookie that expires after 30 minutes of inactivity and is used only for the purpose described there.

13. Breach notification

If a breach of our security safeguards creates a real risk of significant harm to an individual, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as required by law. We maintain a record of security breaches. Where a breach affects information we handle on behalf of a client, we will notify that client without undue delay so they can meet their own obligations.

14. Children's privacy

Our services are not directed to children under 16, and we do not knowingly collect personal information from children. If we learn that a child has provided us with personal information, we will delete it promptly.

15. Accountability

Matthew Winchester is responsible for privacy compliance at Black Anvil. Questions, requests, and complaints can be directed to privacy@blackanvil.ca. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

16. Changes to this policy

We may update this policy to reflect changes in technology, law, or our practices. If changes are material, we will notify affected clients by email at least 30 days before they take effect. The revised policy supersedes prior versions.

17. Contact us

• Email: privacy@blackanvil.ca
• Address: Purdy's Wharf, 1969 Upper Water Street #1300, McInnes Cooper Tower, Halifax, NS B3J 3R7

Copyright Black Anvil Incorporated