No analytics. No cookies. No tracking.

This policy covers cascadiasouth.com and the demo sites at demos.cascadiasouth.com. It explains what personal information we collect from visitors to this website, why we collect it, and what you can do about it.

Cascadia South is a business operating in British Columbia. We serve nonprofits across Canada, remotely. In this policy, “we” and “us” mean Cascadia South, and “you” means anyone visiting this website or contacting us through it.

Information we handle while doing paid work for a client organization is a separate matter, governed by the written agreement for that project. See Information from client projects below.

British Columbia’s Personal Information Protection Act (PIPA) sets the rules for how private-sector organizations in BC collect, use, and disclose personal information. PIPA applies to us. Where we handle personal information across provincial or national borders, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies as well.

Under PIPA, “personal information” means information that can reasonably identify a particular person, either on its own or combined with other information. It does not include business contact information used to reach you at your workplace for a work-related reason, which is most of what we receive through this site.

Our privacy officer is Lance Boer, who is accountable for our privacy practices and for our compliance with PIPA. You can reach the privacy officer at hello@cascadiasouth.com.

We collect the minimum we need to answer you. There are exactly two ways this website collects information about you.

1. The contact form. When you submit the form at /contact, we receive what you typed into it:

• Your name (required)
• Your organization (required)
• Your email address (required)
• Your website address (optional)
• Your annual budget range, if you pick one (optional)
• Which services you’re interested in (optional)
• How you heard about us (optional)
• Your message (optional)

Nothing on that form is required beyond a name, an organization, and an email address, because that is all we need to reply. The budget range is a range, not a figure, and it exists so we can tell you early whether we are a sensible fit.

2. Server logs. Like every web server, the one serving this site records requests: your IP address, the page requested, the time, and your browser’s user-agent string. These logs are generated and held by our hosting provider. We use them only to keep the site running and to investigate abuse or outages.

If you email us directly instead of using the form, we hold that email and whatever you chose to put in it.

We use what you send us for these purposes and no others:

• To reply to your question or booking request
• To prepare a quote, proposal, or scope of work you have asked for
• To carry out a project you have engaged us for, and to invoice you for it
• To keep this website secure and available, using server logs
• To meet a legal or regulatory obligation, such as retaining business records

We do not sell, rent, trade, or share your personal information for anyone else’s marketing. We have no interest in doing so, and we would not build a business on it.

When you fill in the contact form and submit it, you are giving us your consent to use that information to respond to you. That is what PIPA calls implied consent: you volunteered the information for an obvious purpose, and a reasonable person would expect us to use it for that purpose. We ask for nothing beyond what that purpose needs.

Under Canada’s Anti-Spam Legislation (CASL), an inquiry gives us implied consent to send you related commercial messages for six months. We do not run a newsletter or a mailing list, so in practice this means we reply to you and nothing more. We will not add you to any list because you contacted us.

You can withdraw your consent at any time by emailing hello@cascadiasouth.com. We will stop using your information and delete it, subject to the retention rules below. The only consequence of withdrawing is the obvious one: if we cannot hold your contact details, we cannot answer you or continue work that depends on them.

This is worth stating plainly, because it is unusual and because you can verify all of it yourself with your browser’s developer tools.

• No analytics. No Google Analytics, no Plausible, no Fathom, nothing. We do not know how many people visit this site or which pages they read.
• No cookies. This site sets no cookies of its own. There is no cookie banner because there is nothing to consent to.
• No advertising or tracking pixels. No Meta pixel, no LinkedIn Insight tag, no remarketing of any kind.
• No third-party fonts or scripts loaded at page view. Our fonts are downloaded at build time and served from our own domain, so viewing a page does not tell Google or anyone else that you were here.
• No accounts, no logins, no profiles. There is nothing to sign up for.
• No automated decision-making. Nothing on this site profiles you or decides anything about you. A person reads every message.

Two companies other than us touch information from this website, and you should know exactly who and where.

Netlify. This website is hosted by Netlify, Inc., and the contact form is processed by Netlify Forms. Netlify is a United States company headquartered in San Francisco, California. Form submissions and server logs are processed and stored on Netlify’s infrastructure, which means your information is handled outside Canada and is subject to United States law, including lawful access requests made under US legislation such as the CLOUD Act.

Google. Our email, including hello@cascadiasouth.com, runs on Google Workspace. Google is also a United States company. Every contact form submission is forwarded to that inbox, and any email you send us lands there directly, so a copy of what you send us is stored on Google’s infrastructure and is subject to the same United States law.

We are telling you this directly because we write about this exact issue for a living. Our own guide on AI and data residency for Canadian nonprofits makes the point that the question is not where the server sits but who controls the provider. That reasoning applies to us as much as to anyone, so we are not going to bury it in a subclause. If you would rather neither company held your details, send a one-line email asking for a phone number, with nothing else in it, and tell us what you need on the call.

We also use ordinary business tools, such as accounting software. We use providers whose data-processing terms commit them to protecting personal information, and we limit them to handling it only for the service we use them for.

We will disclose personal information without your consent only where PIPA permits or the law requires it, such as in response to a court order, subpoena, warrant, or other legally binding demand. If that happens and we are permitted to tell you, we will.

• If you get in touch and we don’t end up working together, we keep your form submission, your emails, and our replies while the conversation is going, so you can pick it back up months later without starting over. We delete them three years after our last exchange.
• If you become a client, we keep your correspondence and project records for as long as we work together, including gaps between projects, and for seven years after our last engagement ends. Canadian tax law requires that for financial records, and questions about past work can come up years later.
• Server logs are retained by our host on their own schedule and are not something we archive separately.
• Records with names removed, such as how many inquiries we get from each sector, we may keep indefinitely, because they no longer identify anyone.

PIPA requires that if we use your personal information to make a decision that directly affects you, we keep that information for at least one year afterward so that you have a fair chance to ask for access to it. We follow that rule.

When a retention period ends, we securely delete the information or anonymize it so it can no longer identify you.

We protect personal information with safeguards appropriate to how sensitive it is. Concretely, that means:

• This site is served over HTTPS, so what you type into the form is encrypted in transit.
• Accounts that can reach form submissions or our email are protected with strong, unique passwords and two-factor authentication.
• Access is limited to the people who need it to do the work, which is a very short list.
• We keep the amount of personal information we hold small, and we delete what we no longer need. Information you do not hold cannot leak.

No safeguard is perfect and we will not pretend otherwise. What we commit to is proportionate care, clear limits on what we keep, and telling you the truth if something goes wrong.

We make reasonable efforts to keep personal information accurate and complete where it is likely to be used to make a decision affecting you or to be disclosed to another organization.

If you believe something we hold about you is wrong or incomplete, ask us to correct it. If the request is reasonable, we will correct the information and, where relevant, notify any organization we disclosed it to in the previous year. If we do not think a correction is warranted, we will annotate the record to note that you requested it and that we did not make it, and we will tell you why.

Under PIPA you have the right to ask us for:

• The personal information we hold about you
• An account of how we have used it
• The names of any people or organizations we have disclosed it to

Send the request in writing to hello@cascadiasouth.com. We may need to confirm your identity first, so that we are not handing your information to someone else. We will respond within 30 business days, or tell you if PIPA allows us an extension and why.

PIPA permits a minimal fee for access requests. Given how little we hold, we do not expect to charge one. If a request were unusually large and a fee applied, we would give you a written estimate first and let you decide before doing the work.

There are narrow circumstances in which PIPA allows or requires us to refuse access, such as where releasing the information would reveal personal information about someone else. If we refuse, we will tell you in writing, give our reasons, and explain how to seek a review.

If you are unhappy with how we have handled your personal information, tell us first. Email hello@cascadiasouth.com, marked for the attention of the privacy officer. We will acknowledge your complaint, look into it, and give you a written answer. We may need to verify your identity before discussing information that belongs to you.

If our answer does not satisfy you, you can take the matter to the Office of the Information and Privacy Commissioner for British Columbia. You do not need our permission and you do not need to come to us first, though it is usually faster if you do.

Where PIPEDA applies instead, the equivalent body is the Office of the Privacy Commissioner of Canada at priv.gc.ca.

If personal information in our control is lost or accessed by someone who should not have it, we will investigate, contain it, and fix the cause.

Where a breach could reasonably be expected to cause you significant harm, we will notify you and the relevant privacy commissioner without unreasonable delay, and we will tell you what happened, what information was involved, and what you can do about it. We would want that from anyone holding our information, so we will do it for yours.

This policy is about the website. When you hire us, we often end up handling information that belongs to your organization and to the people it serves: donor records, program data, mailboxes, website content, and so on.

That work is governed by the written agreement for the project, not by this page. Those agreements set out what we can access, what we can do with it, how long we keep it, and what happens to it when the work ends. Where the engagement calls for it, we sign confidentiality terms and act as a service provider under your organization’s own privacy obligations, not as an independent controller of that information.

If you want to know how we would handle your organization’s data on a specific engagement, ask before you sign. It is a fair question and we would rather answer it early.

This website is aimed at people running nonprofit organizations. It is not directed at children, and we do not knowingly collect personal information from them. If you believe a child has sent us personal information through this site, email us and we will delete it.

We will update this policy when our practices change, and we will change the date at the top when we do. If a change is significant, for example if we started using analytics or moved to a different form processor, we will say what changed rather than quietly reissuing the page.

This version takes effect on October 11, 2026 and replaces any earlier version.