Effective date: April 25, 2025
Last updated: October 4, 2026
Drawfty Inc. (“Drawfty”, “we”, “us” or “our”) is a federally incorporated Canadian company based in Vancouver, British Columbia. This policy explains how we collect, use, disclose and protect personal information through www.drawfty.com and in our business communications. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA), and we follow Canada’s Anti-Spam Legislation (CASL) for electronic messages.
1. Accountability and our Privacy Officer
We are responsible for the personal information under our control, including information we pass to service providers for processing. Our Privacy Officer is Piotr Rybacki, Founder and Creative Director. You can reach the Privacy Officer through our contact form; please mention “Privacy” in your message.
2. Information we collect
Information you give us. When you use our contact form, we collect your first and last name, email address and message, and, if you choose to provide them, your phone number, company name, job title, website and industry. If you become a client, we also collect the information needed to deliver the project and to invoice you, such as billing contact details.
Information collected automatically. When you visit the site, our hosting, security and content delivery services receive technical information such as your IP address, browser type and version, operating system, referring page, and the date and time of your visit. We use this for security and to keep the site running. We also use Google Analytics to understand how visitors use the site, for example which pages are viewed, how far people scroll, which outbound links and videos are used, and whether the contact form is started. Google Analytics uses cookies and a random identifier, not your name or email address. We have turned off Google Signals and ad personalization, so this data is not used to build advertising profiles.
We do not knowingly collect personal information from children under 13. Our services are intended for businesses and adults.
3. Why we use it
- To respond to your inquiry and discuss a possible project.
- To plan, deliver and invoice projects, and to keep the business records the law requires.
- To protect the site and our forms against spam, abuse and security threats.
- To understand overall site usage with Google Analytics, in aggregate, without identifying individual visitors.
We only use personal information for the purposes described here, or for a new purpose if you consent to it or the law allows it.
4. Consent
When you submit our contact form, you give express consent for us to collect and use the information you provide to respond to you, as confirmed by the consent checkbox on the form. Technical and analytics information is collected on the basis of implied consent when you use the site, and you can opt out of analytics at any time (see section 7). You can withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us. If you withdraw consent, we may not be able to respond to your inquiry or continue a project.
5. Service providers and third parties
We do not sell, rent or trade personal information. We share it only with service providers that help us run our business and our website, only to the extent they need it, and they are required to protect it. We may also disclose information when required by law.
- Zoho Desk receives contact form messages so we can reply to them. Zoho privacy policy.
- Zoho Books manages client invoicing, billing and financial records, including GST filings. Access is limited to authorized team members.
- Cloudflare provides encryption (TLS), content delivery, security (firewall, DDoS protection), aggregate analytics, the Turnstile anti-spam check on our contact form, and the relay that forwards form messages to Zoho Desk. Cloudflare privacy policy.
- OVHcloud hosts the website in its data centre in Quebec, Canada. Contact form messages are not stored on our web server.
- Wordfence is a security plugin on our server that logs visitor IP addresses to block attacks and may check them against its threat database. Wordfence privacy policy.
- Vimeo hosts the films embedded on this site. When a video loads or plays, Vimeo receives your IP address and basic device information and may set cookies. Vimeo privacy policy.
- Mapbox provides the map on our contact page. When the map loads, Mapbox receives your IP address and basic device information and records that a map was displayed; it does not set cookies on this site. Mapbox privacy policy.
- Google provides Google Analytics and the web fonts used on this site. These services receive your IP address and basic device information; Google Analytics also receives the usage data described in section 2. Google privacy policy and how Google uses data from sites that use its services.
6. Storage and processing outside Canada
Some of our service providers store or process personal information outside Canada, including in the United States and other countries. While it is there, the information is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. We choose providers that commit to protecting personal information, and we remain responsible for information we transfer to them.
7. Cookies and analytics
We use Google Analytics cookies (such as _ga) to measure site usage; they are not used for advertising. Cloudflare may set strictly necessary cookies for security and the Turnstile check, and Vimeo and Google may set cookies when their embedded content loads. You can block or delete cookies in your browser settings; some embedded content or the contact form may not work without them. To opt out of Google Analytics on all websites, you can install the Google Analytics opt-out browser add-on.
Your choices. Visitors from the European Economic Area, the United Kingdom and Switzerland see a banner and Google Analytics cookies are only set if they accept. For all other visitors, analytics is on by default. Anyone can accept or reject analytics cookies at any time with the Cookie settings link at the bottom of every page; your choice is saved in your browser. We use Google Consent Mode, so when analytics cookies are rejected Google receives only limited, cookieless signals that are not tied to you.
California residents. We do not sell or share personal information for cross-context behavioural advertising, as those terms are defined under California law. You can make the requests described in section 11 using our contact form.
8. How long we keep information
We keep personal information only as long as we need it for the purposes above or as the law requires. Inquiries that do not lead to a project are kept for up to 24 months after our last contact and then deleted. Client and financial records are kept for at least six years, as required by Canadian tax law. Security logs are kept for a limited time and then deleted automatically. Google Analytics data is kept for 14 months and then deleted by Google.
9. How we protect it
We protect personal information with safeguards suited to its sensitivity: encrypted connections (HTTPS), a web application firewall, access limited to authorized team members, and reputable providers with their own security programs. No method of transmission or storage is completely secure, but we work to protect your information and review our safeguards regularly.
10. Privacy breaches
If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and report it to the Office of the Privacy Commissioner of Canada as required by law, and we will keep a record of every breach.
11. Your rights
You have the right to:
- ask whether we hold personal information about you and get access to it;
- ask how it has been used and to whom it has been disclosed;
- ask us to correct information that is inaccurate or incomplete;
- withdraw your consent, and ask us to delete information we no longer need to keep;
- challenge our compliance with this policy.
To make a request, contact our Privacy Officer through the contact form. We may ask you to confirm your identity. We will respond within 30 days, or tell you within that time if we need an extension permitted by law and why. Requests are free of charge. If we cannot give you access to some information, we will explain why, unless the law prevents us from doing so.
12. Electronic messages
We reply to the messages you send us. We do not add you to a mailing list or send you marketing messages unless you have given us consent, and any marketing message we send will identify us and include a simple way to unsubscribe, in line with Canada’s Anti-Spam Legislation.
13. Complaints
If you have a concern about how we handle personal information, please contact our Privacy Officer first so we can try to resolve it. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.
14. Changes to this policy
We may update this policy when our practices, service providers or the law change. The updated version will be posted on this page with a new “Last updated” date. If a change significantly affects how we use personal information we already hold, we will ask for your consent where the law requires it.