Privacy Policy

1. Introduction

CYA (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit cya.to or use our Services. It complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s Anti-Spam Legislation (CASL), California Consumer Privacy Act and Privacy Rights Act (CCPA/CPRA), and applicable telecommunications laws including the Telephone Consumer Protection Act (TCPA) and CTIA/A2P 10DLC guidelines.

2. Information We Collect

Depending on your interaction with us, we may collect the following categories of personal data:

• Contact details (name, email, phone, mailing address);
• Payment & billing information (card or ACH data, invoices);
• Account credentials (username, password, social-login ID);
• Device and technical data (IP address, browser type, OS, cookies);
• Location data (city/region from IP or GPS if you permit);
• Usage analytics (pages viewed, clicks, time on site);
• Demographic & profile information (age range, interests);
• User-generated content (messages, uploads, comments);
• Marketing preferences (opt-in status, ad interactions);
• Sensitive information you voluntarily supply (e.g., financial or health data relevant to a project).

3. How We Collect Data

• Online forms (registration, checkout, contact, surveys);
• Newsletter sign-ups and live chat/chatbot interactions;
• Cookies, pixels, and similar tracking technologies;
• Mobile-app permissions (camera, microphone, etc.);
• Social-login integrations (e.g., “Continue with Facebook”);
• Offline import (e.g., CSV upload of client data you provide).

4. Why We Use Your Information

We process personal data to:

• Provide, operate, and improve our Services and platform;
• Set up internal systems and analytics for your brand or project;
• Process payments, invoices, and financing arrangements;
• Deliver customer support and respond to inquiries;
• Send marketing or promotional communications (with consent);
• Run ads, retargeting, or personalization campaigns;
• Detect, prevent, or mitigate fraud and abuse;
• Comply with legal obligations and enforce agreements.

5. Legal Bases for Processing

We rely on one or more of the following bases: your consent, performance of a contract, our legitimate interests (e.g., improving Services), or compliance with legal obligations.

6. SMS & Email Marketing

If you expressly opt in, you agree to receive automated marketing messages and emails from CYA. Message frequency varies. Msg & Data rates may apply. Reply STOP to cancel, HELP for help. Consent is not a condition of purchase. We do not sell or share your contact information and adhere to CASL, TCPA, CTIA, and A2P 10DLC standards.

7. Cookies & Tracking Technologies

We use essential, performance, advertising, and preference cookies. A banner notifies new visitors and provides a dismiss option. You can control cookies through browser settings.

8. Disclosure of Information

We do not sell or share personal data for monetary consideration. We disclose data only to:

• Service providers (e.g., Stripe, Google Analytics, Meta Pixel) under contracts that limit their use to our instructions;
• Professional advisers, regulators, or law enforcement when required by law;
• Successors in the event of a business transfer, subject to similar protections.

9. Data Retention

We keep records for statutory periods (e.g., seven years for tax) and as long as needed to fulfil the purpose or until you request deletion, usually 30 days after a project ends.

10. Security Measures

• HTTPS/SSL encryption in transit and encryption at rest;
• Role-based staff access and multi-factor authentication;
• Daily off-site backups, firewall, and intrusion monitoring;
• Regular vulnerability scans and employee NDA training.

11. Your Privacy Rights

PIPEDA & CASL (Canada) — You may access, correct, or delete your personal information and withdraw consent at any time.
CCPA/CPRA (California) — California residents may request: (i) categories and specific pieces of personal information we hold; (ii) deletion; (iii) correction; (iv) limitation of sensitive data use. We will not discriminate for exercising these rights.

12. Children’s Privacy

Our Services are not directed to children under 13, and we do not knowingly collect their data.

13. Third-Party Links

The Site may link to external sites. We are not responsible for their content or privacy practices.

14. Changes to This Policy

We may update this Policy periodically. Material changes will be posted on the Site with a new “Last updated” date.

15. Contact Us

Keith Lemay, Privacy Officer
Phone: (604) 763-4144
Email: [email protected]
Address: 12392 100 Avenue, Surrey BC V3V 2X3, Canada