Privacy
Privacy Policy
Last updated: September 21, 2026
Accountability
CetaBridge, based in Mississauga, Ontario, is accountable for the personal information under its control. This policy follows the fair information principles reflected in Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
Information we collect
Through the single intake form we collect: your name, business email, company, role, LinkedIn URL, headquarters region, primary trade sector, estimated annual U.S. import value, U.S. supplier dependency, the product affected by surtax, the surtax band, your description of the cost impact, and the service you select. We also record your consent to be contacted, the timestamp of that consent, and the IP address seen by our server at submission. If you join the weekly operator brief, we store that email address, the separate consent, its timestamp and the IP address. You may also upload a spec sheet, invoice, photos and a prior commercial accounting declaration (PDF, JPEG, PNG or WebP, up to 20MB each). Do not submit personal health information, passwords or payment-card details through the intake form.
How we use information
We use this information to assess whether an advisory research scope is feasible, to carry out advisory research you engage us for, to reply to your inquiry, to prepare invoices and business records, and to meet legal obligations. We limit collection, use, disclosure and retention to what is reasonably necessary for those purposes.
Service providers and cross-border processing
Intake records and uploaded documents are stored in our Supabase-hosted database and in a private storage bucket that is not publicly readable. Document links sent to us expire after seven days. Intake notifications are emailed to the CetaBridge owner inbox through Resend; no marketing email is sent to you without your separate consent. Payments are handled on Stripe-hosted checkout pages; CetaBridge does not receive or store your card details. These providers may process information outside your province or outside Canada, and that information may be subject to the laws of those jurisdictions. We do not promise Canadian-only data residency. CetaBridge does not sell personal information in the United States or elsewhere.
PIPEDA
This policy is designed to support PIPEDA considerations. It is not a certification, an audit result or legal advice. Legal conclusions about your own data obligations remain with your organization and its counsel.
Safeguards and retention
We use administrative and technical safeguards appropriate to the sensitivity of the information, including a private document bucket and short-lived signed document links. We retain information only as long as reasonably required for the identified purpose, legal obligations or legitimate business records, then securely delete or anonymize it where practicable.
Access, correction, and withdrawal
You may request access to or correction of your personal information, ask how it has been used or disclosed, or withdraw consent — including unsubscribing from the weekly operator brief — subject to legal and contractual limits.
Contact
Privacy questions, access requests and unsubscribe requests may be sent to lucascetabridge@gmail.com. CetaBridge, Mississauga, Ontario, Canada. You may also contact the Office of the Privacy Commissioner of Canada.
Governing law
This policy is governed by the laws of Ontario and the applicable federal laws of Canada, subject to any mandatory privacy law that applies.