Privacy Policy

1. Introduction

Clayton Generation Technologies Inc. and its operating subsidiary ClayGen Consulting Inc., doing business as ClayGen (“ClayGen”, “we”, “us”, or “our”) are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at claygen.ca or use our services.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Where our clients operate in jurisdictions subject to GDPR or CCPA, we extend equivalent protections.

By using our website or services, you consent to the collection, use, and disclosure of your information as described in this policy. You may withdraw consent at any time by contacting us (see Section 11).

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly when you:

• Create an account: Name, email address, phone number, password, and organization name
• Complete your profile: Job title, mailing address, province, and communication preferences
• Submit a contact form: First name, last name, work email, company name, employee count, area of interest, and message
• Subscribe to our newsletter: Email address
• Purchase services: Billing address and payment information (processed by Stripe; we do not store credit card numbers)
• Use our managed services: Technical information about your IT environment, including Microsoft 365 configuration, device inventories, and security posture data
• Use ClayGen Connect: Business operations data including contacts, accounts, pipelines, documents, and other information you enter into the platform
• Submit support tickets: Description of issues, screenshots, and attachments you provide

2.2 Information Collected Automatically

When you visit our website, we may automatically collect:

• Device information: IP address, browser type and version, operating system, and device type
• Usage data: Pages visited, time spent on pages, referring URL, and click patterns
• Analytics data: Collected via Google Analytics 4 (see Section 6 for cookie details)
• Authentication data: Login timestamps, session duration, and IP addresses associated with your account

2.3 Information from Third Parties

We may receive information from:

• Microsoft: Security posture data, license information, and user directory data when you connect your Microsoft 365 tenant
• Clerk (authentication provider): Account verification and session data
• Stripe: Payment confirmation and subscription status (not full card numbers)

3. How We Use Your Information

We use the information we collect to:

• Provide our services: Deliver managed IT, security monitoring, Microsoft 365 management, ClayGen Connect, and support
• Process payments: Handle invoicing, payments, and billing
• Communicate with you: Send service updates, security alerts, support responses, and newsletters (with your consent)
• Improve our platform: Analyze usage patterns to improve features and user experience
• Ensure security: Detect fraud, prevent unauthorized access, and protect our systems
• Comply with legal obligations: Respond to lawful requests and enforce our terms

We do not use your personal information for automated decision-making or profiling that produces legal effects.

4. Information Sharing and Disclosure

We do not sell your personal information. We may share your information with:

4.1 Service Providers

We use the following third-party services to operate our platform:

4.2 Microsoft Cloud Solution Provider (CSP)

As a Microsoft CSP partner, we share necessary information with Microsoft to provision and manage Microsoft 365 licenses on your behalf. This is governed by the Microsoft Partner Agreement and your Microsoft customer agreement.

4.3 Legal Requirements

We may disclose your information when required by law, court order, or government request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Storage and Security

5.1 Canadian Data Residency

Your data is primarily stored in Canada using AWS ca-central-1 (Montreal). Our databases, file storage, backups, and monitoring infrastructure are all located in Canadian data centres.

5.2 Cross-Border Data Transfers

Some of our service providers (listed in Section 4.1) are based in the United States. When your data is processed by these providers, it may be transferred outside Canada. We ensure these transfers are protected by contractual safeguards and the providers maintain appropriate security standards.

5.3 Security Measures

We implement the following security measures:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and multi-factor authentication
• Regular security assessments and automated vulnerability scanning
• Audit logging of administrative and sensitive operations
• Automated database backups with hourly recovery point
• Incident response procedures and breach notification protocols

6. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. Details about specific cookies, their purposes, and how to manage them are available in our cookie consent banner when you first visit the site.

Essential cookies (authentication, CSRF protection, session management) cannot be disabled. Analytics cookies (Google Analytics) are only set with your consent.

7. Data Retention

We retain your information for the following periods:

When your data is no longer needed, it is securely deleted or anonymized.

8. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Withdrawal of consent: Withdraw consent for non-essential uses of your information (e.g., marketing emails)
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact our Privacy Officer (see Section 11). We will respond within 30 days of receiving your request.

9. Children's Privacy

Our services are intended for business use and are not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website and updating the “Last updated” date at the top of this page. For significant changes, we may also notify you via email if you have an account.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our privacy practices, please contact our Privacy Officer:

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376.