Privacy Policy

Who we are

Exotecho, Inc. ("Exotecho", "we", "us") is a company incorporated in Ontario, Canada (registration #1001404294), with its registered office at 145 ½ Church Street, Unit 5, Toronto, Ontario, M5B 1Y4. We build web applications, provide IT consultancy, and operate hosting services.

We are the controller of the personal information described in this policy. For anything relating to it, write to contact@exotecho.com.

What we collect

Information you give us. When you request a quote, send a contact message, subscribe to the newsletter or create an account, we collect the details you enter — typically your name, email address, company name, telephone number and whatever you write in the message itself.

Account and billing information. If you hold a hosting account we store your billing address and a record of your invoices. Card numbers are handled by our payment processor and are never stored on our systems.

Technical information. Our servers log the IP address, browser user agent, requested URL and timestamp of each request. This is standard web server logging and is used for security, abuse investigation and capacity planning.

Cookies and similar storage. We use two categories, and you choose the second.

Strictly necessary — a session cookie so you stay signed in, a CSRF token protecting our forms, a preference record of your light/dark theme and language, and the storage holding your cookie choice itself. These are always active; the site cannot be served without them.

Analytics — Google Analytics, used only to see which pages are worth writing more of. IP addresses are anonymised. It is off until you allow it. If you decline, the Google script is never requested at all — it is not loaded and then ignored. You can change your mind at any time through "Cookie preferences" in the footer; withdrawing consent disables the tag and clears the cookies it set.

We use no advertising cookies and sell nothing to anyone.

Cloudflare Turnstile. Our public forms are protected by Cloudflare Turnstile, which confirms you are not a bot. It runs on every form regardless of your analytics choice, because without it the forms would be filled by scripts within a day — it is a security measure, not a tracking one. Cloudflare receives a challenge token, your IP address and basic browser characteristics, and may set a cookie for the duration of the check. It does not receive the contents of the form.

Why we use it

• To answer your enquiry and prepare a quote.
• To provide, bill for and support the services you have asked for.
• To keep our infrastructure secure and investigate abuse.
• To send you the newsletter, if and only if you asked for it.
• To meet our legal, accounting and tax obligations.

We do not sell personal information, and we do not share it for anyone else's marketing.

Legal basis

Where Canadian federal law applies, we rely on your consent (PIPEDA), which you may withdraw at any time. Where Quebec's Law 25 applies, we identify the purposes above at the point of collection. Where the GDPR applies because of where you are located, we rely on the performance of a contract, our legitimate interest in operating and securing the service, and your consent for marketing.

Where your data lives

Application data for exotecho.com is hosted in Canada. Customer hosting workloads run in Hetzner facilities in Germany and Finland unless your plan specifies otherwise. Transfers outside Canada are protected by contractual safeguards with our providers.

Who we share it with

We share personal information only with the service providers we need to operate:

• Hosting and infrastructure — Hetzner Online GmbH (Germany, Finland).
• Email delivery — our transactional mail provider.
• Payment processing — our payment processor, which handles card data directly.
• Bot protection — Cloudflare Turnstile, which receives a challenge token, not your form contents.
• Authentication — Google, only if you choose to sign in with a Google account.

We may also disclose information where we are legally required to do so, or to establish or defend a legal claim.

How long we keep it

Quote requests and contact messages are kept for three years from the last contact. Account and billing records are kept for seven years to satisfy Canadian tax requirements. Server logs are kept for 90 days. Newsletter subscriptions are kept until you unsubscribe.

Your rights

You may ask us to give you a copy of the personal information we hold about you, correct anything that is wrong, delete it where we have no continuing obligation to keep it, or stop using it for a given purpose. Write to contact@exotecho.com and we will respond within 30 days.

If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, or to the Commission d'accès à l'information du Québec if you are in Quebec.

Security

Access to production systems requires two-factor authentication. Data in transit is encrypted with TLS. Backups are encrypted at rest. Administrative access is limited to the staff who need it and is logged.

Children

Our services are not directed at children under 14, and we do not knowingly collect their personal information.

Changes

We will post any change to this policy on this page and update the date above. Material changes will also be sent to account holders by email.