DataBridge Solutions Privacy Policy

Effective date: October 22, 2026 Last updated: October 22, 2026

This Policy explains how DataBridge Solutions handles personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA). DataBridge is based in Ontario. Ontario does not have a general private-sector privacy law, so PIPEDA applies to the personal information we collect, use and disclose in the course of our business.

1. Who we are

DataBridge Solutions ("DataBridge", "we") is an Ontario sole proprietorship owned by Matteo Leone (BN 788255644), 63 Antonia Court, Woodbridge, ON L4H 1C9. Website: https://databridgesolutions.ca/

We build pay-once custom operations platforms for businesses. A point of sale (POS) system, with POS hardware we supply and install, is an optional add-on priced separately. Optional maintenance and changes are billed separately. Domain renewals are included for 2 years after launch, then paid by the client. Payment-processor fees and any terminal rental are paid by the client directly to its processor. We do not sell software subscriptions.

2. Who is responsible for your information

Matteo Leone, owner of DataBridge Solutions, is accountable for our compliance with this Policy and with PIPEDA, and is our privacy contact.

• Email: Questions@databridgesolutions.ca (monitored by Matteo Leone)
• Phone: 437-788-2820
• Mail: DataBridge Solutions, 63 Antonia Court, Woodbridge, ON L4H 1C9

3. Our two roles

• This website, inquiries, our own contracts and billing, and hardware delivery contacts: we decide how the information is used, and we are accountable for it as the organization in control.
• Information inside a platform or POS we build for a client (staff accounts, customer receipt emails, transactions, invoices): we process it for the client under contract. The client is in control and its privacy policy applies.

If you are a customer or employee of one of our clients, please contact that business about its data. We help our clients answer requests.

4. What information we collect

• Contact details: name, title, company, email and phone. Source: forms, email, calls and contracts; also business email addresses that a business or person has published (for example on its website), for business-to-business outreach (see section 6).
• Inquiry content: the project needs you share. Source: our contact form (sent to us by email), calls and discovery.
• Contract and billing: billing contacts, invoice and payment references. Source: contracts and Stripe (card details stay with Stripe).
• Hardware delivery: delivery contact name, phone, site address and delivery notes. Source: the client, at ordering.
• Technical and usage: IP address, browser, language, time zone, pages viewed, referring page and page-speed measurements. Source: our website host's logs and its built-in analytics, our Cloudflare security service, and Google Fonts.

The website uses only its host's built-in, first-party analytics (see section 12). We do not use Google Analytics, Meta Pixel, Hotjar, advertising cookies or cross-site tracking.

We do not serve the health sector and do not intend to collect health information.

5. How we use it

We use personal information to:

1. Respond to inquiries and book consultations.
2. Deliver our Understand, Plan, Build, Launch work and any maintenance.
3. Order, deliver, install and support hardware you buy from us.
4. Administer contracts, invoices and taxes.
5. Send commercial emails only where Canada's Anti-Spam Legislation (CASL) allows.
6. Meet legal obligations.

We also use website analytics to see how the site is used and that it works (see section 12).

We do not sell personal information. We do not use client-platform data (including POS data) for our own marketing. We do not use client documents to train AI models, and we choose providers whose terms say they do not.

Reading invoice photos

Our platforms let a client's users photograph or upload an invoice. Our server-side app sends the photo to our hosting provider's AI service, which passes it to Google Gemini models via Google Cloud Vertex AI to read the text automatically. That service's entry point is in the European Union and the models run in the United States, so this processing happens outside Canada. The user's browser does not contact Google for this step. DataBridge and the client's platform do not save the photo; only the text read from it is kept in the client's platform.

Our hosting provider's published terms say it does not use app end-user data to train its models, and it says the AI providers behind its AI service are contractually restricted from using this data for training. Our hosting provider keeps the full content of a request for 90 days only while a project setting for debugging AI features is on; we keep that setting off, so the content of a request is not kept in our project's AI logs. Our hosting provider does not publish how long the AI provider keeps a request, and does not say that nothing is kept.

Only the client's logged-in users can see the results. The extracted text is automated, is not certified as accurate, and must be checked by the client's staff before it is relied on.

Point of sale systems

For POS systems we build, the client decides what is collected at the counter. Typical data: staff logins and activity logs, transaction details (items, totals, time, device, and from the payment processor only a payment token, the card brand, last four digits, authorization code and payment status), and customer emails for e-receipts.

We never receive or store full card numbers or security codes. Card payments are handled by the payment processor the client chooses, under the client's own merchant account. We are not the merchant of record.

6. Consent

We rely on consent or another basis PIPEDA allows.

We rely on implied consent where the use is obvious and expected, such as using the details you send us to answer your inquiry, or using billing contacts to invoice you.

For the analytics and cookies described in section 12, we rely on implied consent: they are explained in our website footer and in this Policy, and you can opt out as explained in section 12.

You may withdraw consent at any time on reasonable notice, subject to legal or contract limits, by emailing Questions@databridgesolutions.ca. We will tell you what withdrawing means for the service.

Emails about our services

If you send us an inquiry, we may email you follow-up offers about our services for up to 6 months after your inquiry, under the implied consent Canada's Anti-Spam Legislation (CASL) allows (CASL s. 10(9)(a) and s. 10(10)(e)) (for inquiries made after this policy and the updated notice on our contact form were both published); after that, only if you have given us your express consent.

We may also email a business that has never contacted us, but only with its express consent, or where its email address is conspicuously published, the publication does not say that unsolicited commercial emails are unwanted, and our message relates to the recipient's business role (CASL s. 10(9)(b)).

Every such email identifies DataBridge Solutions, gives our mailing address (63 Antonia Court, Woodbridge, ON L4H 1C9) and contact details, and has a working unsubscribe option. We honour unsubscribes within 10 business days. We keep a record of the consent or other basis for each address.

7. Who we share it with, and storage outside Canada

We share personal information with the following service providers and others, for these reasons:

• Google Workspace (Gmail, Drive): email (including messages from our contact form), documents and sending clients' e-receipts. Stored in the United States.
• Our website and platform hosting provider (United States), for contact-form email: sends the messages you submit through our contact form to our Google Workspace email. The website does not save your message in its own database. The email is sent through our hosting provider and its email subprocessors in the United States, which may keep a delivery log; the provider does not publish how long that log is kept or whether it includes the message.
• Our website host and Cloudflare: hosting, security and built-in analytics for this website (servers in several countries, including outside Canada).
• Our website and platform hosting provider (United States), for databases and hosting: stores our website's database and its backups in the United States (US East, N. Virginia), and hosts our clients' platforms and their databases and backups in the United States (one project per client). The contact form does not save your message there.
• Google Fonts: delivers the website's fonts; your browser sends your IP address to Google.
• Stripe: payments to DataBridge.
• Our hosting provider's AI service, with Google Gemini models via Google Cloud Vertex AI: reading text from invoice photos (entry point in the European Union; models in the United States).
• Hardware sellers (usually Amazon.ca) and manufacturers: ordering hardware (delivered to DataBridge), warranty claims and returns.
• Professional advisors: under confidentiality.
• A designated backup person bound by confidentiality: only if Matteo Leone is unavailable, to keep our commitments (for example refunds and breach notices).
• Authorities: when the law requires.

Some providers process data outside Canada, including in the United States. Data processed in the United States or another country is subject to that country's laws and may be accessed by its courts, law enforcement and national security authorities. We remain accountable for information we transfer to our service providers.

We give clients at least 14 days' notice before adding a material new subprocessor for their data.

8. How long we keep it

• Inquiries and leads (including contact-form messages): up to 24 months after last contact. Messages past that point are deleted at our next review, held every 3 months (so at most about 27 months), in our Google Workspace email.
• Outreach contacts (published business email addresses): up to 24 months after last contact, deleted at our next review, held every 3 months (so at most about 27 months). If you unsubscribe, we keep your address only on our do-not-email list.
• Contracts, invoices and tax records: at least 6 years (tax law).
• Hardware delivery contacts: until delivery and any warranty or return period ends, then with the invoice record.
• CASL consent records: while we email you, plus 3 years.
• Client-platform data: as the client instructs. At the end of the contract, the client has 30 days to export its own data where its platform allows. If fully paid, the client may instead ask for its project to be moved to its own account with our hosting provider, or for all its data to be transferred to it, for a quoted maintenance fee; this is free only if we close our business or Matteo Leone passes away. Within 30 days after that, we delete the client's whole platform project from our hosting provider, where client platforms run. Our hosting provider keeps a deleted project for 60 days so that it can be restored, and then deletes it permanently; it does not publish how long a deleted project's data stays in its backups (see database backups below).
• Breach records: at least 24 months.
• Website analytics: our host's analytics reports cover up to the last 90 days. Our host does not publish how long it keeps the underlying data from the analytics or from its error-reporting script, including IP addresses.
• Website server logs: as kept by our host; our host does not publish a fixed period.
• Database backups: our hosting provider backs up our website's database and our clients' platform databases once a day and keeps up to about 14 days of these backups.
• Support emails: maintenance term plus 2 years.
• Copies of e-receipts in our sending mailbox: deleted within 30 days of sending.

9. How we protect it

We use access controls, multi-factor authentication, least-privilege access and encryption in transit. Client platforms use organization-scoped access so one client cannot see another's data. No system is perfectly secure.

10. If there is a security breach

If a breach involving information we control creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify affected people, as PIPEDA requires. We keep a record of every breach for at least 24 months after we determine it occurred and give the Privacy Commissioner access to it on request (PIPEDA s. 10.3). We also notify other organizations that can reduce the harm (PIPEDA s. 10.2). If the data belongs to a client, we notify the client.

11. Seeing and correcting your information

You can ask to see the personal information we hold about you, or ask us to correct or delete it. Email Questions@databridgesolutions.ca or write to us at 63 Antonia Court, Woodbridge, ON L4H 1C9.

We respond within 30 days, as PIPEDA requires. We may extend this by up to 30 more days where PIPEDA allows; if we do, we will tell you within the first 30 days, give the reasons and tell you of your right to complain to the Office of the Privacy Commissioner of Canada.

For data in a client's platform, contact that client first.

When we delete information you asked us to delete, copies in our providers' backups (for example our hosting provider's daily database backups, which it keeps for up to about 14 days) are removed only when those backups expire; until then they are not used.

12. Cookies and analytics

The website uses the built-in analytics of our website host, which run on our own domain (databridgesolutions.ca) as first-party analytics; no third-party analytics script or domain is used. They set a short-lived cookie called "session-id" (expires after 30 minutes) and record pages viewed, the referring page, browser type (user agent), language, time zone, an approximate country, your IP address and page-speed measurements, so we can see how the site is used.

Our host also loads a second built-in script that sends it the page you visit, the referring site and page, page-speed measurements and technical error reports from your browser, with your IP address, using a session identifier kept only while the page is open (it sets no cookie). We use it to see that the site works.

We do not use the analytics or this script for advertising and do not combine their data with other sites' data.

Our security provider, Cloudflare, may set a cookie ("__cf_bm", about 30 minutes) to filter automated traffic.

Fonts are loaded from Google Fonts, so your browser connects to Google (United States).

Your choices

Blocking or deleting cookies in your browser stops the 30-minute analytics cookie, so your page views are not linked to each other, but it does not stop the analytics: basic page-view information (the page, the referring page, your browser (user agent), language and an approximate country from your time zone) is still sent to our host with your IP address.

To stop the analytics and the error-reporting script entirely, use a browser setting or extension that blocks tracking scripts, or turn off JavaScript for our site. The site should still work, although blocking all cookies may cause Cloudflare to show a security check.

You can also ask us, through our privacy contact (section 2), to stop or delete analytics linked to you, and we will do what our host's tools allow; we can switch the analytics off entirely.

To ask for access to, correction or deletion of personal information, or to complain, use our privacy contact (section 2).

13. Children

Our services are for businesses. We do not knowingly collect children's information.

14. Changes to this Policy

We will post updates here with a new date.

15. Questions and complaints

Contact us first at Questions@databridgesolutions.ca, 437-788-2820, or 63 Antonia Court, Woodbridge, ON L4H 1C9. You can also complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/).

16. Quebec

We do not currently serve Quebec clients. If we do, we will update this Policy for Quebec law.