Privacy notice

Who runs the site

The site is run by Innovation Systems Corp, 478 King St W, Office 1206, Toronto, ON M5V 0A8, Canada. The person in charge of the protection of personal information, the title used in Quebec's Law 25, is the company's chief executive. That person can be reached through the contact address at the foot of every page. This is also the only contact address for the site.

What is collected, why, and on what basis

The site has no accounts, no posting and no payments yet. Four things involve personal information. Each is listed here with its purpose and its legal basis under the EU and UK GDPR.

What	From whom	Why	Legal basis
Request records kept by the host	Every visitor's browser, when it asks for a page	Serving the pages, keeping the site secure and working	Legitimate interests in running and securing the site
Cookie-free visit counts	Every visitor's browser, through a Cloudflare script	Seeing which pages are read and how fast they load	Legitimate interests in counting visits to the site
Email sent to the contact address	Anyone who writes to the site	Reading the message and replying to it	Legitimate interests, here answering a message the sender chose to send
Photo requests	Every visitor's browser, when a page shows a photo	Showing the photos on the site	Legitimate interests in showing photos

The site relies on consent for nothing today. Where it ever does, a person can withdraw that consent at any time.

Request records kept by the host

The site is hosted on Cloudflare Pages. In its privacy policy, Cloudflare says it processes the interactions of visitors with a customer's website, and that this may include IP addresses, traffic routing data, system configuration information and other information about traffic to and from the site. The same policy says Cloudflare is a data processor for the logs it makes available to the customer. The operator does not use these records to profile anyone.

Cookie-free visit counts

Cloudflare adds its Web Analytics script to the pages at its edge, and the operator keeps it on. The script loads from a Cloudflare address and reports how each page loaded. On its Web Analytics page, Cloudflare says the service does not use client-side state such as cookies or localStorage, and that it does not fingerprint people through their IP address, user agent string or other data. Its documentation says Web Analytics collects the minimum information needed, which is timing metrics, and that Cloudflare does not track individual end users across its customers' sites. The operator sees these counts in the Cloudflare dashboard.

Email sent to the contact address

The address uses Cloudflare Email Routing, which forwards each message to the operator's Google Workspace mailbox. Cloudflare's Email Routing page says the service stores and accesses no email content and shows counts of emails sent, forwarded or dropped. The message itself, with the sender's address and anything the sender wrote, then sits in the Google Workspace mailbox. Only the operator has access to that mailbox.

Photo requests

The photos on the site are loaded by the visitor's browser straight from Unsplash, at images.unsplash.com. Like any web request, this sends the visitor's IP address, the type of browser and the site that asked for the photo to Unsplash. Unsplash's privacy policy lists IP address and referring page among the information it collects and says its server logs hold information about the Unsplash pages a person visits. That policy does not describe image requests from other sites in particular. The site's own scripts send nothing to Unsplash.

The forms send nothing

The forms on the join, sell, profile, get-sponsored, post-a-job and sponsorship pages are samples. They send nothing, and the photo pickers upload nothing. The site's own scripts set no cookies, use no local or session storage and send no data anywhere. Before accounts, posting or any form that sends information opens, this notice will be updated to cover it, with a new date.

Who receives the information

Three outside services receive information because of how the site is built:

Cloudflare, Inc. hosts the pages, adds the visit-count script and forwards the contact email. Cloudflare's privacy policy says it is a data controller for most of the personal information it collects, and a data processor for customer logs.
Google runs the operator's Workspace mailbox. Google's data processing addendum covers customer data held in Workspace.
Unsplash Inc. serves the photos and sees each photo request.

The site does not sell or rent personal information. It does not use personal information for advertising, and it shows no tracking adverts. The sponsor adverts are plain links.

Where it is processed and the safeguards

The operator is in Canada, and the three services process information in other countries, including the United States. Here is what each provider's own pages say about transfers.

Provider	What its pages say about transfers
Cloudflare	For transfers from the EEA, Switzerland or the United Kingdom to the United States, Cloudflare says it relies on the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework and the UK Extension. It says it relies on standard contractual clauses if those arrangements lapse or are invalidated, and uses them for other international transfers from those regions.
Google	Google's data processing addendum covers transfers of customer personal data that European data protection law restricts. It says that where Google has adopted an alternative transfer solution, Google informs the customer of it and ensures those transfers follow it. Where Google has not, the addendum applies standard contractual clauses. Google's privacy policy says it complies with certain legal frameworks relating to the transfer of data.
Unsplash	Unsplash's policy says personal information may be stored and processed in any country where it or its service providers have facilities. For EU and EEA transfers it says it will comply with the GDPR requirements of providing adequate protection. It names no framework or clauses.

How long it is kept

For the outside services the periods are the ones the providers state. Where a provider states none, the table says so.

What	How long
Host request records	Not published as a fixed period. Cloudflare's privacy policy says retention varies with the purpose, the nature of the data and legal requirements, and that it deletes or destroys data when the period ends.
Visit counts	Cloudflare's documentation says it stores the unsampled data for 7 days and then aggregates it down to around 10 percent. It says the dashboard shows data for the previous six months. It states no deletion date for the aggregated data.
Email in the mailbox	Up to 24 months after the last message in the conversation, then deleted. The exception is a request to correct or remove a page entry: that is kept for as long as the page is online. When customer data is deleted, Google's addendum says it carries out the deletion within a maximum period of 180 days.
Photo requests at Unsplash	Not published as a fixed period. Unsplash's policy says information is kept only as long as necessary for the purposes it was collected for.

Rights and how to use them

Under the EU and UK GDPR, and under the laws of Canada, Quebec, Australia and New Zealand where they apply, a person can ask the operator for:

access to the personal information held about them;
correction of anything wrong;
deletion;
an end to, or a restriction on, how it is used, and objection to uses based on legitimate interests;
a copy in a portable form;
withdrawal of consent, where consent is the basis.

To use a right, a person writes to the contact address at the foot of this page and says what they want. The site answers within 30 days. The operator holds personal information only in the mailbox, so a request about the host's request records or the photo requests is for Cloudflare or Unsplash, and each provider's policy says how to reach it.

The right to complain

A person who is not satisfied can complain to a regulator. These are the pages where each regulator takes complaints or lists its offices:

United Kingdom: Information Commissioner's Office, make a complaint
Ireland: Data Protection Commission, raising a concern
European Union: European Data Protection Board, list of national authorities
Canada: Office of the Privacy Commissioner of Canada, report a concern
Quebec: Commission d'accès à l'information du Québec, home page
Australia: Office of the Australian Information Commissioner, privacy complaints
New Zealand: Office of the Privacy Commissioner, making a complaint

Cookies, Do Not Track and profiling

The site sets no cookies and uses no similar tools such as local storage, session storage or fingerprinting. The Cloudflare visit-count script does not use cookies either, by Cloudflare's own description. The site does not track visitors across other sites, so a Do Not Track signal from a browser changes nothing. This is the disclosure California's online privacy law asks for. The site makes no automated decisions about people and builds no profiles.

Children

The site is for working adults. It is not aimed at children under 16, and it does not knowingly collect their information.

Security

Every page is served over HTTPS by Cloudflare. The mailbox that receives the contact email is open only to the operator.

Changes to this notice

When this notice changes, the date at the top changes with it. The rules for posts, listings and adverts are on the community rules page.