Privacy Policy

Introduction

This Privacy Policy explains how thinkCircle ("thinkCircle," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit our website at thinkcircle.ai (the "Website") or interact with us through our online forms and communications. We are committed to protecting your privacy and handling your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy legislation, and where applicable, US state privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). By using our Website, you consent to the collection and use of information as described in this Policy. If you do not agree with this Policy, please do not use our Website or submit personal information to us.

Who We Are

thinkCircle is a strategic AI consultancy based in Toronto, Ontario, Canada, specializing in AI audits, assessments, implementation, and advisory.

Contact Information for Privacy Inquiries:

thinkCircle, Toronto, Ontario, Canada. Email: privacy@thinkcircle.ai. Website: thinkcircle.ai

Information We Collect

3.1 Information You Provide Directly

We collect personal information that you voluntarily provide to us, including: name, email address, phone number (if provided), organization name, and message content through contact forms; name, email address, and areas of interest through newsletter signups; and name, email address, organization and role through event registrations.

3.2 Information Collected Automatically

When you visit our Website, certain information is collected automatically through cookies and similar technologies, including device and browser information (IP address, browser type, operating system, device type), usage information (pages visited, time spent, referring website, click patterns), and session recordings and heatmaps (mouse movements, form interaction patterns, scroll behavior). See our Cookie Policy for complete details.

3.3 Information from Third Parties

We may receive limited information about you from third-party platforms (LinkedIn, Meta) when you interact with our content, typically limited to the fact that you interacted with our content and basic demographic categories.

3.4 Sensitive Personal Information

We do not intentionally collect or process Sensitive Personal Information as defined under the California Privacy Rights Act. If such information is inadvertently submitted, it will be handled in accordance with this Policy and deleted where not required for legal or contractual purposes.

Cookies and Tracking Technologies

We use cookies and similar technologies for essential website functionality, analytics (to understand how visitors interact with our Website), and marketing (to deliver relevant advertising and measure campaign effectiveness). Where required by law, analytics and marketing cookies will only be set after you provide consent through our cookie banner. You can manage your cookie preferences at any time through the "Cookie Settings" link in our website footer or through your browser settings. For complete details about the cookies we use, how they work, and your choices, please see our separate Cookie Policy.

How We Use Your Information

We use the personal information we collect to: respond to your inquiries and provide information about our services; deliver communications you request (newsletters, event invitations, educational content); improve our Website and services through analytics; deliver relevant advertising with your consent; and comply with legal obligations. We do not use personal information collected through this Website to make automated decisions that produce legal or similarly significant effects on individuals.

How We Share Your Information

We do not sell your personal information. We share your information only with: service providers who help us operate our Website (hosting, email marketing, analytics, advertising platforms); professional advisors where necessary; in connection with business transfers (merger, acquisition, sale of assets); as required by law or to protect our rights; and with your explicit consent.

Data Retention

We retain personal information only as long as necessary: contact form submissions are automatically deleted 3 years from submission unless retention is required for legal purposes; newsletter subscriber data is retained until you unsubscribe, plus 1 year for suppression list; analytics data is retained per provider defaults (14 months for GA4, 365 days for Hotjar). When you request deletion, we will remove your information from active systems within 30 days, except where retention is required for legal compliance.

Your Privacy Rights

8.1 Rights Under Canadian Law (PIPEDA)

Canadian residents have the right to: access personal information we hold; request correction of inaccurate information; withdraw consent to processing; and file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

8.2 Rights Under California Law (CCPA/CPRA)

California residents have additional rights to: know what personal information we collect and how it is used; delete personal information (subject to exceptions); correct inaccurate information; and opt out of sale or sharing of personal information. We do not sell personal information for monetary consideration. We may share limited information with advertising partners for cross-context behavioral advertising, subject to your consent and opt-out choices through our cookie settings. California residents may also use a "Do Not Sell or Share My Personal Information" link in the website footer, where available.

8.3 How to Exercise Your Rights

To exercise any of your privacy rights, contact us at privacy@thinkcircle.ai with subject line "Privacy Rights Request." Include your full name, email address, which right you wish to exercise, and any details to help locate your information. We will respond within 30 days and may need to verify your identity before fulfilling your request.

Security, Updates, and Contact

9.1 How We Protect Your Information

We implement reasonable administrative, technical, and physical safeguards including SSL encryption, password-protected access, limited access on a need-to-know basis, and regular review of our practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9.2 International Data Transfers

Our primary data storage and processing occurs in Canada. Some service providers may process data in the United States or other countries and are contractually obligated to protect your information in accordance with applicable privacy laws.

9.3 Children's Privacy

Our Website is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

9.4 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and post a notice on our Website.

Business Client Data and Consulting Engagements

This Privacy Policy governs personal information collected through our website (thinkcircle.ai) and public-facing marketing activities, including contact forms, newsletter subscriptions, and analytics tools. For organizations engaging thinkCircle for professional consulting services (TC-AIMM AI maturity audits, digital marketing audits, strategic consulting engagements), our handling of data collected during those engagements is governed by our Master Services Agreement and Data Processing Agreement, not this Privacy Policy. Our consulting engagement agreements include specific provisions for: data collection and use (discovery instruments, organizational information, contact information for client team members); data protection measures (encryption, access controls, privacy-first processing architecture, subprocessor disclosures); data retention and deletion (defined schedules, secure deletion procedures, data portability); and security and compliance (security controls, incident response with 24-hour client notification, PIPEDA compliance and GDPR where applicable, audit rights). Business clients should refer to their executed Master Services Agreement and Data Processing Agreement for specific data protection terms, retention schedules, and security commitments applicable to their engagement. For questions about business client data handling or to request copies of our standard agreements prior to engagement, contact privacy@thinkcircle.ai. Response time: within 2 business days.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: thinkCircle, Toronto, Ontario, Canada. Email: privacy@thinkcircle.ai. Website: thinkcircle.ai