Privacy Policy
Last updated October 27, 2026
1. Who we are
Lead Forge Media (“we”, “us”, “our”) is a web design agency operating in British Columbia, Canada. We operate the website at leadforgemedia.com (the “Site”).
This policy explains how we collect, use, disclose, store and dispose of personal information through the Site. We are accountable for personal information in our control, including information handled by service providers on our behalf.
This policy is governed by British Columbia’s Personal Information Protection Act (PIPA). Where the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies (for example, when personal information crosses provincial or national borders in the course of commercial activity), we also comply with PIPEDA.
“Personal information” means information about an identifiable individual. Under PIPA it does not include business contact information (such as your name, job title, business address, business email or business phone number) when it is used to contact you in your business capacity.
2. What information we collect
We collect personal information in two ways: information you give us, and information collected automatically when you use the Site.
Information you provide. Depending on which form you use, we collect:
- Your name
- Your email address
- Your business name, when you book a consultation or request a prototype
- Your website address, when you request an audit
- The content of your message, and any project details you choose to share
- The consultation time slot you select
Information collected automatically. We record your IP address when you submit a form, and keep it briefly to rate-limit submissions and protect the Site from abuse. Our hosting provider may also log technical request data such as your browser and device type.
Bot protection. Our forms are protected by Cloudflare Turnstile, which checks that a submission came from a real browser rather than an automated script. To do that it reads your IP address, your browser's user agent and connection fingerprint, and which site the form is on. Cloudflare states that it cannot identify individuals from these signals. The check runs only on our forms, and in most cases you will not see anything at all.
- Your browser type and version, operating system and device type
- The pages you visit, the time spent on them and the links you click
- The website or search engine that referred you to the Site
- Approximate location (city or region) derived from your IP address
- Cookie identifiers and similar tracking data described in section 5
We do not knowingly collect personal information from anyone under 19 (the age of majority in British Columbia). We do not collect payment card details through the Site.
3. Why we collect it
We collect personal information only for the purposes stated here, and we state those purposes at or before the time of collection as PIPA requires.
| Information | Purposes |
|---|---|
| Contact form and email submissions | Respond to your inquiry; prepare and send quotes and proposals; provide the services you request; manage our relationship with you if you become a client |
| Consultation and prototype bookings | Hold the time slot you chose, prepare for the call, and contact you about it |
| Audit requests | Review the website you submitted and send you the result |
| IP addresses from form submissions | Rate-limit submissions, block automated abuse and keep the forms usable |
| Analytics and server log data | Understand how visitors use the Site; measure which pages and content perform well; diagnose errors and protect the Site from abuse |
We may also use your information where the law requires or permits it, for example to comply with a legal obligation or to establish or defend a legal claim.
We will not use your personal information for a new purpose without first telling you and, where required, obtaining your consent.
4. Consent
By submitting a form or emailing us, you consent to us collecting and using the information you provide for the purposes in section 3.
By continuing to use the Site, you consent to the collection of the automatically collected data described in section 2 for the purposes of operating, securing and improving the Site.
Withdrawing consent. You may withdraw your consent at any time by emailing our Privacy Officer at support@leadforgemedia.com (see section 10), or by adjusting your browser settings as described in section 5.
We will tell you what effect withdrawing consent will have. For example, if you withdraw consent to us holding your inquiry details, we will no longer be able to respond to your inquiry or prepare a quote. Withdrawing consent does not affect uses that occurred before you withdrew it, and we may retain information where the law requires us to.
6. Disclosure and third parties
We do not sell, rent or trade your personal information. We share it only with the service providers below, who process it on our behalf and under our instructions, and only to the extent needed for the purposes in section 3.
| Service provider | Role | Data shared | Servers |
|---|---|---|---|
| Supabase | Stores form submissions and bookings, and runs the functions that process them | Everything you submit, plus your IP address | United States |
| Resend | Sends the confirmation email you receive | Your name and email address | United States |
| Anthropic | Summarises your submission so we can triage it quickly | The content of your message or request, with your name and email | United States |
| Telegram | Delivers the alert alerting us to your submission | Your name, email address and the summary of your message | Outside Canada |
| Cloudflare | Checks that form submissions come from a real browser, not a script | Your IP address, browser user agent and connection fingerprint, and which page the form is on. No form content is sent | United States and globally |
| PostHog | Site usage analytics | Automatically collected data (see section 5). Requests are routed through this site's own domain, so PostHog does not receive your IP address directly from your browser | United States |
These providers store and process personal information outside British Columbia and outside Canada. While it is there, it is subject to the laws of that jurisdiction and may be accessible to foreign courts, law enforcement and regulators. We choose reputable providers and require them by contract to protect personal information to a standard consistent with this policy and PIPA.
We may also disclose personal information without your consent where PIPA or other law permits or requires it, including:
- To comply with a subpoena, warrant, court order or other legal requirement
- To our lawyers, accountants or insurers where reasonably necessary
- To a prospective buyer or successor if our business or its assets are sold or merged, provided they agree to use the information only for the purposes it was collected
- Where disclosure is necessary to respond to an emergency that threatens someone’s life, health or security
7. Retention
We keep personal information only as long as needed for the purposes it was collected, or as long as the law requires.
| Information | How long we keep it |
|---|---|
| Inquiries, bookings and audit requests that do not become a project | Until the inquiry is resolved, and then no longer than 24 months after our last contact with you |
| Inquiries that become a client project | For the life of the project and for 7 years after it ends, to meet tax, accounting and limitation-period obligations |
| IP addresses used for rate limiting | Purged automatically, within hours of collection |
| Hosting provider request logs | 90 days, unless needed to investigate a security incident |
| Analytics events | Held in our PostHog project. We delete an individual's analytics profile on request |
When the retention period ends, we securely delete the information or anonymize it so it can no longer identify you. Where a record exists in routine backups, it is deleted when the backup is overwritten on its normal cycle.
If you ask us to delete your information before these periods end, we will do so unless we need to keep it to complete a service you requested, meet a legal obligation, or resolve a dispute.
8. Security
We protect personal information with safeguards that are reasonable for the sensitivity of the information we hold. These include:
- Encryption in transit. The Site is served over HTTPS, and form submissions are encrypted between your browser and our providers.
- Access controls. Only the people who need your information to respond to you can access it. Accounts are protected by strong passwords and multi-factor authentication.
- Database rules. Submissions are written by server-side functions, not by your browser, and the underlying tables are not publicly readable.
- Reputable providers. We use established hosting, database, email and alerting vendors that publish their own security practices and are bound by contract to protect your information.
- Device security. The computers and phones we use to read your inquiries are encrypted, kept up to date and locked when unattended.
- Minimization. We collect only what we need and delete it on the schedule in section 7.
No method of transmission or storage is completely secure. If we learn of a breach of security involving your personal information that creates a real risk of significant harm to you, we will notify you and, where required, the Office of the Information and Privacy Commissioner for British Columbia, as soon as reasonably possible.
9. Your rights
Under PIPA you have the right to:
- Access the personal information we hold about you, learn how we have used it, and learn who we have disclosed it to
- Correct personal information that is inaccurate or incomplete
- Withdraw consent as described in section 4
- Ask questions or complain about how we handle your personal information (see sections 10 and 11)
How to make a request. Email our Privacy Officer at support@leadforgemedia.com. Tell us your name, the email address you used to contact us, and what you are asking for. We may ask you to verify your identity before we release or change information.
Our response. We will respond within 30 days of receiving your request, as PIPA requires. If we need more time, we will tell you why and when to expect our answer. If we refuse all or part of a request, we will tell you the reason, the section of PIPA that applies, and how you can ask the Office of the Information and Privacy Commissioner for British Columbia to review our decision.
Access to your information is free in most cases. If a request is unusually large or complex, we may charge a minimal fee; we will give you a written estimate first and you can withdraw your request.
If we correct your information, we will send the correction to any third party we disclosed it to during the previous year, where it is reasonable to do so.
10. Privacy Officer and contact
PIPA requires us to designate a person responsible for our compliance with the Act. Our Privacy Officer can be reached at:
Lead Forge MediaBritish Columbia, Canadasupport@leadforgemedia.comContact the Privacy Officer with any question about this policy, to exercise your rights under section 9, or to make a complaint under section 11. We aim to acknowledge every message within 5 business days.
11. Complaints
If you believe we have not handled your personal information in line with this policy or PIPA, please contact our Privacy Officer first (section 10). Put your concern in writing with as much detail as you can. We will investigate, respond to you in writing within 30 days, and tell you what action we have taken.
If you are not satisfied with our response, or you do not receive one, you may ask the Office of the Information and Privacy Commissioner for British Columbia (OIPC) to review the matter:
Office of the Information and Privacy Commissioner for British ColumbiaPO Box 9038, Stn. Prov. Govt., Victoria, BC V8W 9A4Phone: 250-387-5629Email: info@oipc.bc.caoipc.bc.caThe OIPC asks that you give us 30 days to respond before you file a complaint, and that you file a request for review within 30 days of receiving our response.
Where PIPEDA applies instead of PIPA, you may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
12. Changes to this policy
We review this policy at least once a year and whenever we add a new tool, service provider or purpose that affects how we handle personal information.
When we make changes, we post the updated policy on this page and update the “Last updated” date at the top. If a change materially affects how we use information we have already collected from you, we will notify you by email before it takes effect and, where required, ask for your consent again.
Your continued use of the Site after an updated policy is posted means you accept the changes to the extent the law allows.