Legal
Privacy policy
AlfaProtek is a small Canadian practice. Readings only work if you write down something real about your life, so privacy is not boilerplate here — it is the condition of the product. This policy states what is collected, why, where it sits, how long it stays, and what you can make us do about it.
AlfaProtek is operated by a Canadian sole proprietorship with its address at Suite 200, street address to confirm, Toronto, ON M5V 2T6, Canada (address to confirm). Personal information is handled under the Personal Information Protection and Electronic Documents Act (PIPEDA).
1. What is collected
Only what a reading needs.
Account and billing
- Name, e-mail address, province, city and postal code.
- A billing reference from the payment processor: card brand, last four digits, expiry, and a customer and subscription identifier.
- Subscription events — start, renewal, cancellation, refund.
Reading content
- The brief you write: what is happening, what you have tried, names or dates you choose to include.
- The reading produced from it, the card photographs and any follow-up question and answer.
- Delivery records: timestamp, and whether the e-mail was opened (if you allow image loading).
Technical
- Server logs: IP address, browser and operating system, pages requested, timestamps.
- Cookie identifiers, subject to your choices — see the cookie policy.
- Analytics events and, if you accept marketing cookies, Meta Pixel event data.
2. Why it is collected
- To produce the reading — the brief and card photographs are the working material.
- To run the subscription — taking payment, renewing, handling cancellations and refunds.
- To deliver and support — sending readings, answering messages, keeping the archive you can log into.
- To improve — aggregate page counts, and attribution of advertising that brought you here.
- To meet obligations — tax records and, if needed, responding to lawful requests.
3. Consent
Consent is obtained by the act of subscribing and is implied for the information the reading requires. Analytics and the Meta Pixel are opt-in through the cookie banner and start switched off. You can withdraw cookie consent at any time through . Withdrawing marketing consent does not affect the readings you have paid for.
4. What is never collected
- Full card numbers — the processor holds them, never this site.
- Government identifiers, except a GST/HST number if you ask for a business invoice.
- Health records, unless you paste them into a brief yourself.
- Precise location, contact lists or address books.
5. Who processes it
A short list, each bound by contract to use the data only for AlfaProtek:
- Payment processor — card authorisation, recurring billing, refunds. Holds card data.
- E-mail delivery provider — transactional delivery of confirmations, readings and reminders.
- Hosting provider — serves the site and stores the account database.
- Analytics — aggregate page measurement, if consented.
- Meta Platforms — Pixel events, if consented.
Some processors store data outside Canada, chiefly in the United States and the European Union. Where that happens, data is protected by contract and, for EU transfers, standard contractual clauses. Foreign authorities may lawfully request access to data held abroad.
Nothing is sold. There is no data broker in the chain.
6. How long it is kept
- Account and briefs — while the account is open, plus 24 months after cancellation, so an archive can be restored if you come back.
- Readings and card photographs — same period. Deleted earlier on request.
- Invoices and payment records — 7 years, as Canadian tax law requires.
- Server logs — 90 days.
- Analytics — 14 months.
- Contact-form messages — 12 months after the thread closes.
7. Your rights
Under PIPEDA you may:
- Ask what personal information is held about you and receive a copy.
- Ask for corrections where something is wrong.
- Withdraw consent to non-essential uses.
- Ask for deletion, subject to the tax retention above.
- Ask for a portable export of your readings.
- Complain to the Office of the Privacy Commissioner of Canada.
Write to hello@alfaprotek.com with "Privacy" in the subject line. Access requests are answered within 30 days at no charge. Identity is verified by writing from the address on the account; if the address has changed, one identifying detail from a past reading is enough.
8. Safeguards
TLS on every page, encrypted storage at rest, two-factor authentication on the admin account, and access limited to Mira and, where needed, the payment processor's support staff. Card data is tokenised. Bulk exports are deleted after use.
No system is perfect. If a breach creates a real risk of significant harm, affected subscribers are notified and the Office of the Privacy Commissioner is informed, as PIPEDA requires.
9. Children
The service is intended for people 16 and over. No information is knowingly collected from younger children, and there is no age-verification step beyond the terms.
10. Automated decisions
Readings are written by a person. Automation is used for delivery, billing and archive indexing, none of which makes a judgement about you. Analytics may produce segments; those are aggregate.
11. Changes
Material changes are announced by e-mail to active subscribers at least 14 days before taking effect, and the version date above changes. The version in force when you subscribed governs the data from that period.
12. Contact and complaints
Privacy questions: hello@alfaprotek.com. If the answer isn't satisfactory, you may contact:
Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC K1A 1H3
Toll-free 1-800-282-1376 · priv.gc.ca
For entertainment purposes; not a substitute for medical, legal or financial advice.