Privacy

What this site collects,and what it does not.

HUREAL INC., Ontario corporation 1001739473, is responsible for the personal information it handles. This page covers hureal.ca and the ways HUREAL is contacted through it. Work HUREAL does inside a client's own systems is governed by the agreement with that client rather than by this page.

Effective 23 September 2026. Last updated 23 September 2026. The second date moves every time the page changes materially.

This website, specifically

What happenswhen you load a page.

Most privacy policies describe a company. This part describes a page, because it is the part you can verify yourself while you are reading it.

  • No cookie is set by this site

    hureal.ca sets no cookie of its own. There is one exception and it is named rather than buried: the cookie preference page stores the choice you make there in your own browser so the page can remember it. It is not sent anywhere and it identifies nobody.

  • The scripts make no network request

    The shared files this site loads contain no request of any kind, and they write nothing to your browser's storage. The demonstration on the homepage runs entirely inside the page, reaches no network, and sends nothing anywhere, which is stated on the page itself as well as here.

  • One third party request, and it is the typefaces

    Inter Tight and IBM Plex Mono are served from Google's font hosts. Your browser requests them directly, which means your IP address reaches a domain HUREAL does not control, subject to that company's own terms. It is the only third party request this site makes at load.

  • No tracking, advertising or social code

    There is no analytics script, no advertising pixel, no remarketing tag, no heat map, no session recorder and no social embed on any page of this site today.

  • Two forms exist, and nothing is behind them yet

    The discovery call page and the performance audit page each carry a real form with real fields. Both post to the thank you page, which is a static page, so there is no endpoint that receives, stores or forwards a submission today. Nothing is collected from either form until one is connected to something, and this page is updated in the same change rather than afterwards.

  • Server logs

    Whatever host serves this site will keep standard request logs. What they contain, how long they are kept and who can reach them depends on the host, and the host is not chosen. host to set proposed: 30 days

How to check the four claims above

  1. Open your browser's storage panel on this page. It is empty until you set a cookie preference.
  2. Open the network panel and reload. The requests are this document, one stylesheet, three scripts, the typefaces, and the images on the page.
  3. Read the four files in assets/. They are not minified and they carry their reasoning in comments. Search them for fetch, for cookie and for storage, and the result is nothing.
  4. Open the two form pages and read the fields. They are in the markup and every one of them is named in the table below.

Why the font request is disclosed rather than solved. Moving the two font files onto this domain removes the request entirely and it is the right answer. It is on the published list of things that are not finished rather than described here as though it were already done.

The inventory

Every piece of information,and how long it stays.

A policy that lists categories and never lists the actual things is the version most sites ship. This is the list, in two halves: what is true on the site as it is built today, and what becomes true the day the two intake forms are connected to something that receives them.

Under Canada's federal private sector privacy legislation the working basis for handling personal information is your knowledge and consent, with a short list of statutory exceptions. The basis column below says which one applies to each row. Nothing on this site relies on an exception you would be surprised by, and nothing is sold, rented or traded in any row, ever.

What is collected, why, on what basis, and for how long
What Why it exists On what basis How long it is kept Who else sees it
Today, on the site as it is builtCheckable in your browser right now
Server request logs: an IP address, a browser string, the address requested and the time Serving the page you asked for, and keeping the site available and secure. Created by the act of requesting a page. Necessary to deliver the thing you asked for. proposed: 30 days Thirty days is long enough to investigate an incident and short enough that nothing accumulates. The real answer depends on the host. Whoever hosts the site, once a host is chosen.
Your IP address, reaching Google's font hosts Fetching the two typefaces the site is set in. Your browser makes the request directly. HUREAL receives nothing from it and cannot see it. Google's own retention, under Google's own terms. Not HUREAL's to state. Google LLC. This is the only third party in the table today.
Your cookie preference: three true or false values and the date you saved them Remembering the choice you made on the preference page so it is not asked again. Your own action on that page. It is written to your browser and sent nowhere. Until you clear it. It lives in your browser, not on a server, and the page has a button that removes it. Nobody. It never leaves your browser.
Whatever you type into the demonstration Producing an answer from a fixed set of examples held inside the page. Not collected at all. The page reaches no network, so there is nothing to have a basis for. Not stored anywhere, including in your browser. It is gone when you reload. Nobody.
When the two intake forms are connected, and not one day beforeToday these rows describe nothing, because no endpoint exists
Name, role, company and email Replying to you, and preparing the call or writing the audit you asked for. Your consent, given by sending the form. Every one of these fields is required because a reply is not possible without it. 24 months from the last contact, where no engagement follows, then deleted. Long enough that a conversation picked up next year is not started from nothing. The person who replies, and the record system once one is chosen.
Phone, company website, timing, the address to audit, and two companies to compare against The same purpose. These are what make a first reply useful rather than generic. Your consent. Every field in this row is optional on the form and marked optional on the form. As the row above. As the row above.
What you wrote in the free text box Understanding the request before answering it. Your consent. You decide what goes in it, and the form asks for a few sentences rather than a brief. As the row above. As the row above.
The email consent tick, the wording you were shown, and the time it was recorded Proving you agreed to be emailed about your request, under Canada's anti spam legislation. Express consent. The box is not ticked when the page loads, which you can verify in the markup. 3 years after the consent is withdrawn or stops being relied on. Under that Act the sender has to prove consent, and a proceeding can begin up to three years after the regulator learns of the matter, so the proof is kept for as long as it could be asked for. As the row above.
Anything you send by email, or say on a call Answering you, and doing the work if an engagement follows. Your consent, given by writing or speaking to us. As an inquiry above, and then as a client record if an engagement follows: 7 years from the end of the engagement. As the row above.

Scroll the table sideways to read it.

Where the seven years comes from. Canada Revenue Agency requires business records to be kept, generally, for six years from the end of the last tax year they relate to, which is counted from a year end rather than from the day the work finished. Seven years from the end of an engagement always covers that, which is why it is the number. What is kept for that long is the business record of the engagement, not every message sent along the way.

The policy

Sixteen sections,and what each one commits to.

The first ten follow the fair information principles that sit under Canada's federal private sector privacy legislation. The six after them are the ones a Canadian business actually needs beside those principles. Where a section names a statute, it names it so you can check it yourself.

  • 1. AccountabilityWho is responsible

    What this saysHUREAL INC. is responsible for the personal information in its custody, including information handled by anyone working on its behalf. One named person is accountable for privacy across the company and is the person a request or a complaint reaches. Quebec's private sector privacy legislation, as amended by Law 25, works on the basis that the person with the highest authority in the enterprise holds that role unless it is delegated in writing, and that the holder's title and contact details are published. HUREAL will name the person rather than rely on the default.

    Needs a decisionWho that person is, and how they are reached. privacy officer to name address to set

  • 2. Identifying purposesWhy anything is collected

    What this saysThe purpose is stated at or before the moment information is collected, on the surface where it is collected, in plain words. Two surfaces collect anything: the discovery call form and the performance audit form. Each one will carry this sentence above its fields, and each will link to this page: "What you send here is used to reply to you and to prepare the call or write the audit. It is not added to a marketing list, it is not sold or shared, and you can ask for it back or ask for it to be deleted at any time." Direct contact details carry the same purpose in the same words.

    Build itemNeither form links to this page today. That is a gap rather than a decision, it is recorded as a build item, and it closes before either form is connected to anything.

  • 3. ConsentIncluding Quebec's Law 25 where it applies

    What this says, and what is already liveConsent is asked for in plain language, separately for separate purposes, and it is never bundled into a single box that also agrees to something else. Nothing is pre ticked. Consent can be withdrawn at any time, and withdrawing it is as easy as giving it. Commercial email is sent only with consent recorded against the record, with an unsubscribe that works in one action, under Canada's anti spam legislation. The wording is already on both forms. The discovery call form reads: "You may email me about this request and about the call. I understand this is not a newsletter subscription, that every message carries a working unsubscribe, and that I can withdraw this at any time." The audit form says the same about the audit.

    The consent recordWhat the consent record holds, once there is somewhere to hold it: the exact wording shown, the surface it was shown on, whether the box was ticked, and the date and time. The system that holds it is not chosen, and it is the same decision section 6 and section 7 are waiting on.

  • 4. Limiting collectionOnly what the purpose needs

    What this saysOnly the information necessary for the stated purpose is collected, by fair and lawful means. A field that exists because it might be useful later is not a field this site has. Every field on both forms is either required for a reply or marked optional on the form itself.

    Confirmed by the buildThe discovery call form asks for name, role, company and email as required, a website, a phone number and a timing as optional, a description of what you want built, and an email consent tick. The audit form asks for name, role, company, email and the address to audit as required, what you want that address to do, and two companies to compare against as optional. That is the whole list and it is in the markup.

  • 5. Limiting use, disclosure and retentionAnd how long things are kept

    What this saysInformation is used only for the purpose it was collected for, unless you consent to something else or the law requires otherwise. It is not sold, rented or traded, ever, and that is a commitment rather than a current practice. Retention is set per record type rather than left at a default, and information is destroyed or anonymised at the end of it.

    The periodsEvery retention period, per record type, is in the inventory table above, in the row it applies to, with the reason beside it. The one still open is the server log period, which depends on the host.

  • 6. AccuracyKeeping it right

    What this saysInformation is kept as accurate, complete and up to date as the purpose requires. If you tell us something we hold about you is wrong, it is corrected, and anyone it was disclosed to is told where that matters. A correction is made at no charge and you are told when it is done rather than left to assume it.

    Needs a decisionThe correction path, which depends on where records are held. record system to choose

  • 7. SafeguardsHow it is protected

    What this saysProtection is proportionate to sensitivity: encryption in transit and at rest, access limited to the people whose work requires it, access reviewed rather than granted once and forgotten, and multi factor authentication on the accounts that matter. Security is one of the fourteen checks every HUREAL build passes before it goes live, and this site is held to the same list. As the site stands there is nothing to breach on it: no database, no login, no session, no personal information at rest anywhere in the build, and the only value written to a browser is a preference the visitor set themselves.

    Needs a decisionThe measures that arrive with the host and the record system, which are the two places personal information will first exist. host to set record system to choose

  • 8. OpennessThis page existing at all

    What this saysThese practices are published, in plain language, at a stable address, and are available without asking anybody. That is what this page is. Where something here is not settled yet, such as a name or an address, it is shown as not settled rather than written as though it were.

    Confirmed by the buildThis page is at a permanent URL, is linked from the footer of every page on the site, and is indexable. The one place it is missing is the two forms, which is section 2's build item.

  • 9. Individual accessYour rights

    What this saysOn request you can be told whether HUREAL holds information about you, what it is, how it has been used, and who it has been disclosed to, and you can have it corrected. Depending on where you live you may also be able to ask for it in a portable format, ask for it to be deleted, ask for a search result about you to stop being listed, and withdraw a consent you gave earlier. Identity is confirmed before a request is answered, and confirming it never asks for more information than the request needs.

    How fast you get an answerHUREAL answers a request within 10 business days. The federal legislation sets the outer limit at 30 days from the request, and lets an organization extend it by up to 30 more days only for set reasons and only by telling you in writing, within the first 30 days, why and that you can complain to the Privacy Commissioner. The 10 day commitment is deliberately shorter, because a published commitment that only repeats the law is not a commitment. If a request ever needs longer, you are told before the 10 days are up, with the reason. The address is the single one in the last band.

  • 10. Challenging complianceIf you are not satisfied

    What this saysA complaint goes to the person accountable for privacy, is acknowledged, is investigated, and gets a written answer. If you are not satisfied with that answer you can take it to the Office of the Privacy Commissioner of Canada, and if you are in Quebec, to that province's access to information commission. Those are your routes, they have their own processes and their own time limits, and they do not depend on HUREAL agreeing with you.

    How fast it is acknowledgedWithin 2 business days, by a person. A complaint goes to the same single address as everything else on this site, which is the last band on this page.

  • 11. Service providersWho else touches it

    What this saysWhere a third party processes information on HUREAL's behalf, it is named, it is bound by contract to a standard at least as protective as this page, and it may use the information only to perform the service. The list is published here rather than described as "trusted partners", because a category cannot be checked and a name can.

    The list, as it stands todayOne entry: Google LLC, which serves the two typefaces and therefore receives the IP address of every visitor. It is not a processor acting on HUREAL's behalf and it is listed anyway, because it is the only third party in the chain. Nothing else is chosen: not the host, not the record system, and not this. analytics to choose

  • 12. Where the data is processedRegion, and what crossing a border means

    What this saysThe storage region is chosen rather than inherited from whatever a vendor defaults to, and it is stated. Where information is processed outside Canada it is subject to the law of that country, including lawful access by its authorities, and that fact is disclosed rather than left in a footnote. Quebec's legislation goes further for information about people in Quebec: before personal information is communicated outside Quebec, a privacy impact assessment has to be carried out that weighs how sensitive it is, why it is going, how it will be protected, and the law of the place it is going to. Where that rule applies to information HUREAL holds about a person in Quebec, the assessment is carried out and written down before the information moves, including to a processor in another province.

    Needs a decisionThe region, and each processor's region. A Canadian region is the recommendation, because it removes a disclosure the company would otherwise have to make on every page it collects on. proposed: Canadian region

  • 13. Automated decision makingWhat this website does not do

    What this saysThis website makes no decision about you. Nothing on it profiles a visitor, scores a visitor, or decides anything about a person using automated means. The demonstration takes what you type and answers from a fixed set of examples held inside the page; it decides nothing about you and it keeps nothing. If that ever changes, this section says so before it changes, says what the decision is, and says how to ask for a person to review it.

    Confirmed by the buildThere is no analytics, no profiling and no personalisation on this site. The scripts make no network request, so there is nowhere for a profile to go.

  • 14. ChildrenWho this site is for

    What this saysThis is a business website and it is not directed at children. HUREAL does not knowingly collect personal information from a child, and where it learns it has, the information is deleted. The federal legislation does not set a single age at which a person can consent for themselves; the regulator's published position treats information about children as sensitive and expects a parent or guardian to consent for a younger child. Quebec's legislation sets its own age. This page therefore uses the stricter numbers.

    The ageNothing on this site is meant for anyone under 18, and the forms are for people acting for a business. HUREAL does not knowingly collect personal information from anyone under 13, which is the age below which the federal Privacy Commissioner expects a parent or guardian to consent, or from anyone in Quebec under 14, which is the age Quebec's legislation sets for the same rule.

  • 15. A breachWhat happens, and when you hear

    What this saysA breach of security safeguards is contained first, then recorded in a register whether or not it turns out to be reportable, then assessed for a real risk of significant harm using the sensitivity of the information and the probability that it is misused. Where that threshold is met it is reported to the federal Privacy Commissioner and to the people affected as soon as feasible, in language that says what happened, what was involved, what is being done, and what the person can do. Any other organization that can reduce the harm is told. The federal regulations require each entry to be kept for 24 months after the day the breach is determined to have occurred, and Quebec's legislation carries its own register, kept for 5 years, and its own notification to its own regulator where there is a risk of serious injury. The assessment is made by the person accountable for privacy and is written down at the time rather than reconstructed afterwards. You hear it from HUREAL rather than from somebody else.

    How long the register is keptEvery entry is kept for 5 years from the day the breach is determined to have occurred, which meets both the federal 24 months and Quebec's 5 years with one rule. It is held by whoever section 1 names.

  • 16. Changes to this pageHow you find out

    What this saysThis page carries an effective date and a last updated date, both at the top. A material change is described at the top of the page rather than quietly folded in, and where a change affects a purpose you consented to, consent is asked for again rather than assumed. A previous version is available on request.

    Needs a decisionWhere a change history lives, which follows from the host decision in section 7.

HUREAL designs to a standard, tests against it, and documents what was built. It does not certify itself and it does not give a legal or privacy opinion, on this page or on a client's project. For a client's project, that determination belongs to the client's counsel or privacy officer, and a vendor offering to make it for them is offering something they do not have.

Where a request goes

One person,one address.

A privacy request, a correction, a withdrawal of consent or a complaint goes to the person accountable for privacy at HUREAL. One address, and the same address wherever it appears on this site.

Not decided yet: privacy officer to name address to set postal address to set Until those are settled this page does not print a mailbox, because an address that is not monitored is worse than no address on a page that promises a reply.

The general contact page carries the same open decisions. Cookie preferences is the surface that governs what this site is allowed to store in your browser.