Privacy policy

Who we are

XenoForm is the trade name of 2747636 Alberta Ltd., an Alberta corporation based in Edmonton, Alberta, Canada ("XenoForm", "we", "us"). We design, build and manage digital teams that take on routine work for businesses, through our XenoForm Scan, Forge, Orbit and Lab services.

We are responsible for the personal information we collect and hold. We follow Alberta's Personal Information Protection Act (PIPA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, and Canada's Anti-Spam Legislation (CASL).

Our Privacy Officer is accountable for this policy and answers questions about it. You can reach the Privacy Officer at [email protected].

What this policy covers

This policy covers personal information we collect through our website, our Digital Workforce Plan sessions, our emails and our everyday business with prospects, clients, suppliers and partners.

It does not cover information that a client's digital team handles for that client. That information belongs to the client, and we handle it as the client's service provider. See Information we handle for our clients.

What we collect

Information you give us

• Digital Workforce Plan requests: your name, work email, company, company size, industry and anything you choose to tell us about your staff's workload.
• Conversations: what you share by email, phone or video call, including notes we take during your session or a XenoForm Scan.
• Clients: contact and billing details for the people we work with, signed agreements, and the access details your digital team needs to connect to your tools. Card payments are handled by our payment processor; we do not store full card numbers.
• Email preferences: whether you have agreed to hear from us, and any request to stop.

Information collected when you visit

• Your IP address, browser and device type, the pages you view, the page that sent you to us, and the date and time of your visit. Our website host and the tools named under Cookies collect this for us.

Information from other sources

• Public business contact information: to introduce our services to businesses, we may collect a business's name, a person's name and job title, and their business email, phone number and address from public sources, such as company websites, business directories and professional profiles. We use it only to contact people about their work.
• Referrals: details a partner or client passes to us with your agreement.

Please do not send us health, financial or other sensitive information through our website forms. If a project needs it, we will agree a secure way to handle it with you first.

How we use it

We use personal information to:

• answer your questions, book your session and prepare your Digital Workforce Plan;
• propose, deliver, support and bill for our services;
• contact businesses about services that are relevant to their work;
• send newsletters and offers, but only with your consent (see Our emails);
• keep our website, systems and clients' digital teams secure, and fix problems;
• understand how our website is used so we can improve it; and
• meet our legal, tax and accounting obligations, and protect our legal rights.

We collect only what we need for these purposes. If we want to use your information for a new purpose, we will tell you and, where the law requires, ask for your consent first.

Consent

We collect, use and share personal information with your consent, or where the law allows or requires it without consent. Your consent may be express, such as ticking a box, or implied, such as giving us your email address so we can book your session.

You can withdraw your consent at any time, subject to legal or contract limits, by writing to [email protected]. We will tell you what withdrawing means. For example, we cannot run a client's digital team without the access it needs.

Our emails

We send commercial emails only when CASL allows it: when you have given us express consent, or when we have implied consent, for example because you asked us for a plan or a quote, you are a client, or you published your business email address and our message is relevant to your role.

Every email we send names 2747636 Alberta Ltd., operating as XenoForm, gives our mailing address and contact details, and includes a way to unsubscribe. We act on unsubscribe requests within 10 business days. We keep a record of the request so we do not contact you again by mistake.

Service emails, such as booking confirmations, invoices and messages about your account, are not marketing and continue while you are a client.

Cookies and similar tools

Cookies are small files a website stores in your browser. Our website uses them to:

• Make the site work: our website host (Wix.com) sets cookies needed for security, page loading and forms.
• Measure visits: our website host collects page views and similar statistics so we can see which pages help visitors.

Our pages load fonts from Google Fonts, which receives your IP address and browser details when a page loads.

We do not currently use advertising or cross-site tracking cookies. If that changes, we will update this policy first and ask for consent where the law requires.

You can block or delete cookies in your browser settings. The site will still work, though some features, such as forms, may not.

When we share information

We do not sell or rent personal information. We share it only:

• With service providers who help us run our business, such as website hosting, email delivery, form handling, customer records, scheduling, video calls, payments, accounting and cloud storage. They may use the information only to provide their service to us, and must protect it.
• With the tools your digital team connects to, when you are a client and ask us to connect them.
• With partners, only when you ask us to or agree to it, such as an introduction to another business.
• With professional advisers, such as our lawyers and accountants, who are bound by confidentiality.
• When the law requires or allows it, for example in response to a court order, or to protect someone's safety.
• In a business transaction, such as a sale or merger of all or part of our business. The other party must agree to protect the information as this policy describes.

Information we handle for our clients

When we build or run a digital team for a client, that team may handle personal information about the client's own customers, patients, tenants or staff. In that work:

• the client is the organization responsible for that information, and its own privacy policy applies;
• we use the information only to provide our services to that client, following our written agreement and the client's instructions;
• each digital team gets only the access its job needs, keeps a readable log of its actions, and can be switched off by the client at any time;
• we do not use one client's information for another client or for our own marketing; and
• when our work ends, we return or securely delete the information as our agreement says.

If your information is handled by one of our clients and you want to see, correct or delete it, please contact that business. We will help them respond.

XenoBridge

XenoBridge is our platform for property managers and landlords. It brings together property managers, the landlords who own the homes and the tenants who live in them, for rent, repairs, messages and paperwork. It runs at xenobridge.app and xenoform.ca/bridge.

Who is responsible for what. When a property management company, or a landlord who manages their own homes, uses XenoBridge, they are the organization responsible for the information about the landlords, tenants and staff in their account, and their own privacy policy applies. We handle that information as their service provider, following our agreement with them and their instructions. We are responsible for the information that property managers and landlords give us directly when they register, request a demo or run their account with us.

What we collect when you sign up. When you sign up, we collect your name, email, phone number, company or business name, web address and office password, and, for property managers, your management fee. Your password is stored scrambled, so nobody can read it, and we never email it. When you request a demo, we collect your name, company, email, and optionally your phone number, how many homes you manage and what you want to see. To stop spam, we keep a scrambled version of the internet address each form was sent from. We cannot turn that back into the address.

What the platform holds for property managers. To do its job, XenoBridge holds what the property manager, landlords and tenants enter. This includes names and contact details, home addresses, lease dates, rent amounts, payment records and receipts, repair requests and photos, messages, documents, notices, move-in and move-out inspections and signatures, and a log of what office staff do in the platform.

Who sees what. Each person sees only what is theirs. A tenant sees only their own home. A landlord sees their own homes, plus what the property manager shares with them. Office staff see what their company manages. Our team looks at account information only to support, secure or fix the platform.

Payments. Rent and deposits are paid through Stripe, a payment company. Card and bank details go straight to Stripe, and we never see or store full card or bank account numbers. Rent is paid into the landlord's own Stripe account, and Stripe's privacy policy applies to what Stripe collects.

Emails and replies. The platform sends emails such as welcome links, reminders, receipts and message notices. When you reply to a message notice by email, your reply is filed into the right conversation in the platform. Only replies from the email address on file are accepted.

Help (Xip). When you type a question to Xip, our help assistant, the question is sent to our AI provider (Anthropic) to write an answer from our help text. Xip does not read your account, your homes or your messages. Please don't type personal information into Xip.

Sign-in cookies. XenoBridge uses cookies only to keep you signed in. If you tick "Keep me signed in", that lasts up to 30 days for tenants and landlords and up to 12 hours for office staff. We use no advertising or cross-site tracking cookies in XenoBridge.

Where it is stored. XenoBridge runs on Cloudflare. Some of the platform's information may be stored or processed outside Canada, including in the United States, by Cloudflare, Stripe and Anthropic. The "Storage outside Canada" section applies.

How long we keep it.

• We keep a record of every registration and demo request, including ones that were never confirmed or that we declined.
• Information a property manager keeps in the platform stays while it is our client, and we keep it after our agreement ends for as long as we need it for legal, tax and business purposes.

Your choices. If your information is in XenoBridge because of your property manager, landlord or tenant, contact the property manager or landlord whose account it is to see, correct or delete it, and we will help them respond. For anything else, or questions about this section, write to our Privacy Officer at [email protected].

Storage outside Canada

Some of our service providers, including our website host, store or process information outside Canada, mainly in the United States. While it is there, it is subject to the laws of that country, and authorities there may be able to access it.

We choose providers that protect information to a standard comparable to ours, and we bind them by contract to do so. To learn more about our policies and practices for service providers outside Canada, or to ask questions about how they collect, use, share or store personal information for us, write to our Privacy Officer at [email protected].

How we protect it

We use physical, administrative and technical safeguards suited to how sensitive the information is. These include access limited to the people and digital teams that need it, multi-factor sign-in, encryption in transit, and regular review of who has access.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and report it to the Office of the Information and Privacy Commissioner of Alberta, and to the Office of the Privacy Commissioner of Canada where PIPEDA applies.

How long we keep it

• Plan requests and prospect records: up to two years after our last contact, unless you become a client or ask us to delete them sooner.
• Client records: for the length of our relationship, then as long as tax and corporate law require, generally six years after the end of the tax year they relate to.
• Unsubscribe requests: for as long as we send email, so we can honour them.
• Website statistics: as long as our website host keeps them, typically in summary form.

When we no longer need personal information, we securely delete it or make it anonymous. If information was used to make a decision about you, we keep it for at least one year so you can ask to see it.

Your rights

You can ask us to:

• tell you what personal information we hold about you, how we have used it and who we have shared it with;
• give you a copy of it;
• correct information that is wrong or incomplete; and
• stop sending you emails, or withdraw your consent.

Send your request in writing to [email protected]. We may ask you to confirm your identity. We will answer within 30 days, or tell you if we need more time and why, as the law allows. Requests are usually free; if a request would cost a lot to fulfil, we will give you an estimate first. If we cannot give you some information, for example because it includes someone else's personal information, we will explain why.

Children

Our website and services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children.

Questions and complaints

Please contact our Privacy Officer first at [email protected]. We will look into every concern and tell you what we find.

If you are not satisfied with our answer, you can contact:

• the Office of the Information and Privacy Commissioner of Alberta; or
• the Office of the Privacy Commissioner of Canada.

Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with a new "Last updated" date. If a change materially affects how we use information we already hold, we will tell clients and subscribers by email before it takes effect.

Contact us

Privacy Officer
2747636 Alberta Ltd., operating as XenoForm
Edmonton, Alberta, Canada
[email protected]