Privacy Policy

Athearia is a website and technology studio based in Alberta, Canada; “Athearia Inc.” is a corporation incorporated under the laws of Alberta, Canada, 225 Railway St E, Suite 216, Cochrane, AB T4C 2C3, Canada. We operate the website at athearia.com and the Client Hub our clients use to manage their account. For privacy questions, contact us at hello@athearia.com.

This policy covers athearia.com, the Client Hub, and the information we handle to provide our services. It doesn’t cover the websites we build for clients: each of those is operated by that business and has its own privacy practices.

We collect what we need to respond to you, deliver the services you ask for, bill for them, and keep the site secure.

Information you give us through forms:

• The contact form: your name, business name (optional), email, and message.
• The custom quote form: business name, your name, email, phone (optional), current website (optional), a project description, and optional capabilities, timeline, and budget selections.
• The preview request form: business name, where your website stands today, the kind of site you’re after, current website (optional), your name, email, and a short description of your business.
• The Client Hub sign-in form: the email address on your account.

Information you give us in other ways: anything you share by email, on calls, or through the Client Hub, including support requests, replies, and any files you attach to them.

If you become a client: your business and contact details, the package and care plan you’re on, billing status, the content and assets you provide for your website, the address of your preview and live site, support history, a screenshot of your website’s homepage (shown in the emails we send you about your project), and, if you upload one, a profile image for your account. The screenshot and profile image are stored at unlisted links that anyone who has the link can open, because email clients need to load them; nothing else about your account is public.

Collected automatically:

• Aggregate, anonymous analytics through Vercel Analytics: page views, referring site, country, and general device and browser type. It is cookieless, doesn’t build a profile of you, and doesn’t follow you across other sites. We don’t run advertising or retargeting trackers.
• Security and abuse-prevention records: when you submit a form or request a sign-in link, we use hashed identifiers derived from your IP address and email to limit repeated submissions. Vercel BotID also checks browser and request signals to distinguish automated traffic from people. Our hosting provider keeps standard security and server logs.

Payment information is collected and processed by Stripe. Athearia never sees or stores full card numbers. We do keep your name, email, billing status, and invoice history so we can manage your account. When you pay through checkout, we also keep a record that you accepted our Terms of Service: the name and email entered at checkout, the date and time, the payment reference, and the version of the terms.

• To respond to your inquiries and deliver the services you request.
• To create a website preview for your business, using what you tell us and publicly available information about your business.
• To set up and manage your account, bill for services, and send transactional email (confirmations, payment and invoice emails, sign-in links, project updates such as a preview being ready or a site going live, and support updates).
• To provide support and keep a record of your requests.
• To secure the site and prevent abuse.
• To improve the site and our service offering.
• To send outreach messages where lawful (see outreach and CASL below).
• To meet legal, tax, and accounting obligations.

• Strictly necessary cookies for signed-in sessions: when you open the Client Hub through a sign-in link, we set a secure session cookie so you stay signed in (for up to seven days, or until you sign out). If the site is placed behind an access password (for example before a launch), it also sets a cookie that remembers you’ve entered it.
• Local storage in your browser remembers your light or dark theme preference. It is never sent to us.
• No analytics cookies. Our analytics (Vercel Analytics) is cookieless, so measuring visits doesn’t store anything on your device.
• No advertising or retargeting cookies are set by Athearia.
• Third-party pages you visit from our site, such as Stripe checkout or the Stripe billing portal, set their own cookies under their own policies.

The Client Hub has no passwords. When you enter your email on the sign-in page, and it matches an active account, we email you a private link. The link works once (with a short grace period so email apps that pre-open links don’t use it up), expires after 24 hours, and is stored on our side only as a one-way hash. Anyone with access to your inbox could use a link before it expires, so keep your email account secure and don’t forward sign-in emails.

We use reputable third-party providers to run the site and deliver our services. They process information only to provide their service to us:

• Vercel: hosting, bot protection and cookieless analytics for athearia.com, and hosting for the previews and websites we build for clients.
• Supabase: the database and file storage behind our account records, support requests, attachments, and profile images.
• Stripe: payments, subscriptions, invoices, and the billing portal. Stripe holds your payment details and billing information.
• Resend: delivery of the transactional emails we send (form confirmations, payment and invoice emails, sign-in links, and support updates).
• Google Workspace (including Google Voice): our business email and phone line, where form submissions, your correspondence and calls with us, and voicemail are received and handled.
• GitHub: private source-code hosting for the websites we build for clients, which may contain the content and assets you provide.
• The Corner Coworking (through Anytime Mailbox): our business mailbox, where any physical mail sent to Athearia is received, logged, and scanned for us.
• Google Search Console and similar tools: used for websites under a care plan, to monitor how a site appears in search. They don’t run any tracking code on athearia.com.

We may add or replace providers as our tooling changes, under equivalent protections. Each is governed by its own privacy policy. We don’t sell personal information, and we don’t share it with third parties for their own marketing.

We sometimes contact businesses we haven’t worked with, for example to share a preview of a website we’ve created for them, using the email address that business publishes for enquiries. We do this in line with Canada’s Anti-Spam Legislation (CASL): we write only to an address published for business contact, about the recipient’s business; each message identifies Athearia, gives our mailing address and a real reply address, and offers an easy way to opt out. Replying “no thanks” or asking to be removed is enough; you don’t need to fill out a form. We record the opt-out on that business’s file within ten business days and our system then refuses to send it further outreach.

A business’s published contact details (its name, address, phone number, and business email) are business contact information; Canadian privacy law treats them differently from personal information when they’re used to reach the business about its own affairs. We still honour every opt-out and deletion request.

We keep information only as long as we need it:

• Prospects (form submissions and outreach): while we’re in contact and for up to about a year after our last exchange, unless you become a client.
• Clients: for the duration of the engagement and a reasonable period afterward. Billing and invoice records, including the record of your acceptance of our terms, are kept as long as tax and accounting law requires (typically seven years).
• Website source code and files for client sites: while we host or maintain the site, and for a reasonable period after an engagement ends so we can provide a handoff.
• Security and abuse-prevention records: for the window needed to enforce our limits (up to 31 days for upload allowances). Expired counters are removed during routine request processing. Hosting-provider security logs follow that provider’s retention settings.

You can ask us to delete your information sooner (see your rights below), subject to records we’re required to keep.

Under Canadian privacy law you can ask to access the personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw consent to uses that rely on your consent. Email hello@athearia.com and we’ll respond within the time the law allows (30 days under PIPEDA, up to 45 days under Alberta’s Personal Information Protection Act). We may need to verify your identity first. If you’re not satisfied with how we handle your request, you can contact the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

Our services are for businesses, and the site is not directed at children. We don’t knowingly collect personal information from anyone under 18. If you believe we have, contact us and we’ll delete it.

We use reasonable safeguards to protect the information we hold: encrypted connections (HTTPS), reputable providers, access limited to the people who need it, signed sessions for the Client Hub, and private storage for support attachments and source code. No system is perfectly secure, and we can’t guarantee absolute security. If a breach affecting your information ever occurs, we’ll notify you as the law requires.

Several of the providers we use (including Vercel, Supabase, Stripe, Resend, GitHub, and Google) operate servers outside Canada, including in the United States. Information we hold may be stored or processed there and may be subject to the laws of those countries. By using the site or submitting a form, you consent to these transfers for the purposes described in this policy.

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the current version. Material changes that affect how we use your information will be communicated directly to active clients.

Questions about this privacy policy? Email hello@athearia.com.