Privacy Policy

Aimlet Inc. ("Aimlet", "we", "us", "our") respects your privacy. This policy explains in detail what personal information we collect through this website, our WhatsApp channel, and our IT, AI, and marketing services; why we collect it; the legal bases we rely on; who we share it with; how long we keep it; where it is processed; and the choices and rights you have. Our published Android apps are each governed by their own policy — see app privacy policies.

1. Who we are and how to reach us

Aimlet Inc. is a company incorporated in Canada with its head office at 2 Robert Speck Parkway, Suite 750, Mississauga, ON L4Z 1H8, Canada. We act as the controller (business) of the personal information described in this policy, except where we process data inside a client's systems, in which case we act as a processor (service provider) on that client's documented instructions.

• Privacy Officer: privacy@aimlet.com
• General enquiries: hello@aimlet.com
• WhatsApp (chat only, no voice calls): +1 (352) 559-9843
• Business hours: Monday to Friday, 9:00–18:00 ET

2. Scope of this policy

This policy covers this website and its subdomains, our enquiry and newsletter forms, our WhatsApp business messaging, email correspondence, and the administration of client engagements. It does not cover third-party websites we link to, or our Android apps, which have their own dedicated policies as required by Google Play.

3. Information we collect

3.1 Information you give us

• Enquiry forms: name, email address, phone number, company name, service interest, budget range, and the free-text contents of your message.
• Newsletter: email address, opt-in timestamp, and consent source, recorded to evidence express consent under Canada's Anti-Spam Legislation (CASL).
• WhatsApp messages: your WhatsApp phone number, display name, profile photo if set, and the content and timestamps of messages you send us. Messages are transmitted through WhatsApp (Meta Platforms) and are also subject to WhatsApp's own privacy policy. Please do not send sensitive personal information, credentials, or payment card data over WhatsApp.
• Careers: where you apply to us, the contents of your CV, cover letter, and any information you volunteer during interviews.
• Billing: for clients, billing contact details, purchase orders, and invoice records. Card payments are handled by our payment processor; we do not store full card numbers.

3.2 Information collected automatically

• IP address (truncated where analytics permits), browser and device type, operating system, screen size, referring URL, pages viewed, time on page, and request timestamps, collected through server logs and privacy-respecting analytics.
• Cookies and similar technologies, described in our Cookie Policy. Only strictly necessary cookies are set without your consent.

3.3 Information from third parties

We may receive your details from a referral partner, a publicly available business directory or company website, or a professional network where you have made them available for business contact purposes.

3.4 Sensitive information

We do not seek special category or sensitive personal information (health, biometrics, precise geolocation, government identifiers, racial or ethnic origin, political or religious beliefs, sexual orientation, or trade union membership). Please do not include it in your messages. If it reaches us unsolicited, we delete it.

4. Why we use your information, and our legal basis

We do not use your personal information to make decisions producing legal or similarly significant effects about you through automated means alone, and we do not profile you for that purpose.

4.1 Use of AI tools

We may use AI assistants to draft replies, summarise requirements, or analyse anonymised performance data. We do not permit these vendors to train their general models on your personal information or on client confidential data, and human review applies before any material output is acted on.

5. Sharing and disclosure

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We disclose information only in the following categories:

• Infrastructure and hosting — website hosting, our managed database and authentication backend, and error monitoring.
• Communications — transactional and newsletter email delivery, and WhatsApp/Meta for messages you choose to send through that channel.
• Analytics — aggregate site measurement.
• Professional advisers — accountants, auditors, insurers, and lawyers, under confidentiality obligations.
• Authorities — where required by law, court order, or to establish, exercise, or defend legal claims.
• Corporate transactions — a buyer or successor in a merger, acquisition, or asset sale, subject to this policy continuing to apply.

All processors act on our written instructions under agreements that require confidentiality, appropriate security, sub-processor control, and deletion or return of data at the end of the engagement.

6. International transfers

We are based in Canada. Some providers operate in the United States and the European Union, so your information may be stored or processed outside your country and may be accessible to courts, law enforcement, and national security authorities in those jurisdictions. Where personal information leaves the EEA or the UK, we rely on adequacy decisions (Canada holds a partial adequacy decision for commercial organisations) or on standard contractual clauses with supplementary technical measures such as encryption in transit and at rest.

7. Retention

• Enquiry and WhatsApp records: up to 24 months from last contact.
• Client engagement, contract, and billing records: seven years after the engagement ends, to satisfy Canadian tax and limitation-period requirements.
• Newsletter subscriptions: until you unsubscribe, plus a suppression record kept indefinitely so we do not email you again.
• Server and security logs: up to 12 months.
• Unsuccessful job applications: 12 months, unless you ask us to delete them sooner.

At the end of a retention period we delete the data or irreversibly anonymise it for statistical use.

8. Your rights and how to exercise them

Subject to applicable law, you may request access to your personal information, correction of inaccuracies, deletion, a portable machine-readable copy, restriction of or objection to certain processing, and withdrawal of consent at any time without affecting processing already carried out.

• Canada (PIPEDA, Quebec Law 25): access, correction, withdrawal of consent, de-indexing in certain cases, and information about automated decisions.
• EEA and UK (GDPR): the rights in Articles 15–22, and the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): know, delete, correct, opt out of sale or sharing (we do neither), limit use of sensitive information (we do not collect it), and freedom from discrimination for exercising your rights. You may use an authorised agent.
• Other US states with comprehensive privacy laws: equivalent access, deletion, correction, portability, and appeal rights.

Email privacy@aimlet.com or use our deletion request page. We verify requests by confirming control of the email address or account involved, and we respond within 30 days (extendable once where the law allows, with notice). There is no fee unless a request is manifestly unfounded or excessive. If we refuse, we explain why and how to appeal. You may also complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your local supervisory authority.

9. Marketing choices

Every marketing email carries a one-click unsubscribe link and our mailing address, as required by CASL and CAN-SPAM. Unsubscribing is honoured within 10 business days and normally within minutes. You may stop WhatsApp messages at any time by replying STOP or blocking the number. We continue to send necessary transactional and service messages to active clients.

10. Security

We apply role-based access control and least-privilege administration, TLS encryption in transit and encryption at rest for our managed database, row-level security on stored enquiry data, multi-factor authentication on administrative accounts, centralised logging and error monitoring, dependency and vulnerability scanning, vendor security review, and staff confidentiality obligations. No system is perfectly secure. If a breach creates a real risk of significant harm, we notify affected individuals and the relevant regulators without undue delay, and within 72 hours where the GDPR applies.

11. Children

This website is intended for business audiences and is not directed to children. We do not knowingly collect personal information from anyone under 13 (or under 16 where local law sets that threshold) through this site. For our child-directed apps, which follow Google Play's Families policy and COPPA, see our Kids and Families disclosure. If you believe a child has given us information, email privacy@aimlet.com and we will delete it.

12. Cookies and tracking

Details of the cookies we set, their purpose and lifespan, and how to control them are in our Cookie Policy. We honour Global Privacy Control and similar opt-out preference signals as a valid opt-out of sale or sharing where the law requires it.

13. Changes to this policy

We may update this policy as our services, vendors, or the law change. Material changes are announced on this page with a revised "last updated" date, and where the change is significant we notify subscribers by email and, where required, seek renewed consent. Prior versions are available on request.

14. Contact

Privacy Officer, Aimlet Inc., 2 Robert Speck Parkway, Suite 750, Mississauga, ON L4Z 1H8, Canada. Email privacy@aimlet.com, or message us on WhatsApp at +1 (352) 559-9843 (chat only). We aim to acknowledge privacy enquiries within two business days.