How we handle your data.

Sapere Digital is the design, web, and AI arm of Sapere, a CPA-led advisory firm operating since 2013. We build websites, brand systems, data platforms, and AI workflows for businesses across North America.

Sapere Digital is the data controller for information collected through sapere.digital. Our HQ is at 6790 Century Avenue, Suite 301, Mississauga, ON L5N 2V8, Canada. Our US foothold is at 4131 N Central Expressway, Suite 900, Dallas, TX 75204.

Questions about this policy or your data: info@sapere.digital or +1 (647) 545-3839.

Three narrow buckets. Nothing else.

Contact and project brief forms

When you fill in the contact form or project brief at /contact, we collect: your name, email, phone (optional), company (optional), and the message you type. If you use the project brief, we also collect project type, budget band, and timeline.

Digital Readiness Assessment

When you complete the quiz at /assess, we collect: your email, optional first name, and the six answers you selected. We don’t collect your domain or scan anything on your end — the quiz is self-report only.

Newsletter subscription

If you subscribe to our field-notes newsletter, we collect your email address. That’s all we need to send it.

Automatic technical data

Our hosting provider (Vercel) records standard web-server logs — IP address, browser user agent, request URL, timestamp — retained by Vercel per their infrastructure policy. We don’t use these logs for analytics, tracking, or profiling. We use them only for debugging and abuse prevention.

Under Canadian PIPEDA and equivalent regimes, we need a legitimate reason to collect personal information. Ours are:

• Contract or pre-contract action. When you send a project brief or contact us, we need your contact details to respond to your enquiry and, if it becomes an engagement, to deliver work.
• Consent. When you subscribe to the newsletter or complete the assessment, you actively opt in. You can withdraw consent by unsubscribing or emailing us for deletion.
• Legitimate interest. Basic web-server logs are kept to keep the site functioning and to detect abuse. We do not use them for profiling.

We use a small set of processors. They see what they need to, and no more.

• Vercel (USA). Hosts the website and its serverless functions. Sees the standard web-request payload for any request you make to the site.
• Resend (USA). Sends transactional email on our behalf — confirmations, contact form notifications, assessment results. Sees the recipient email address and message body.
• Google reCAPTCHA (USA). Used on the contact form to prevent automated abuse. Google’s privacy policy applies to their processing.
• Microsoft 365 (USA / EU). Hosts our info@sapere.digital inbox. Sees the email correspondence you send us.

We do not use analytics platforms, advertising pixels, session recorders, or third-party marketing tools on this site as of the effective date above. If that changes, this policy will be updated before the change goes live.

We do not sell, rent, or trade your personal information to anyone under any circumstances.

This site does not set marketing or analytics cookies. Fonts are self-hosted (no Google Fonts CDN calls). Images and scripts are served from our own domain and Vercel’s CDN.

The only cookies you may encounter come from Google reCAPTCHA on the contact form, which uses cookies to distinguish real visitors from bots. These are essential to the form’s anti-abuse function.

• Contact / project brief submissions: 24 months from last correspondence, then deleted unless an active client relationship keeps them warm.
• Assessment responses: 12 months from submission, unless you become a client.
• Newsletter subscriptions: until you unsubscribe. There’s an unsubscribe link at the bottom of every send.
• Web-server logs: 30 days on Vercel’s default retention, then rotated out.
• Active client engagement data: for the duration of the engagement plus 7 years, per Canadian record-keeping requirements for professional services.

Depending on where you live, you may have some or all of these rights. We honour them regardless of jurisdiction — ask and we deliver.

• Access. Get a copy of what we hold about you.
• Correction. Fix inaccurate data.
• Deletion. Have your data removed. We complete deletion requests within 30 days.
• Portability. Get your data in a machine-readable format.
• Objection. Ask us to stop processing your data for a specific purpose (like newsletter sends).
• Withdrawal of consent. Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, email info@sapere.digital. We’ll verify your identity (usually by asking you to respond from the email address on file) and act within 30 days.

Canadian residents unhappy with our response can escalate to the Office of the Privacy Commissioner of Canada. Quebec residents can escalate to the Commission d’accès à l’information du Québec (Law 25). US residents in California, Colorado, Connecticut, Virginia, and other states with consumer-privacy statutes have equivalent regulator escalation paths.

Data in transit is encrypted (TLS 1.3 across all subdomains with HSTS enforced). Data at rest lives in our processors (Vercel, Resend, Microsoft 365) which each maintain SOC 2 or equivalent controls.

We limit access to personal information to team members who need it to do their work. All administrative accounts use multi-factor authentication.

If a data breach affects your information and creates a real risk of significant harm, we’ll notify you and the relevant regulator within the timeframes required by PIPEDA, Quebec Law 25, and applicable US state laws.

Our processors are based in the US and (in Microsoft’s case) may process data in multiple regions. If you are outside Canada or the US and submit data through this site, you acknowledge that your data may be processed in jurisdictions with different privacy protections than your own.

We select processors with strong data-protection commitments (Standard Contractual Clauses where applicable).

This site is intended for a business audience. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us and we will delete it.

When we change what we do with data, we’ll update this page and change the “Last updated” date. Material changes will be flagged at the top of this page for at least 30 days.

You can always find the current version at sapere.digital/privacy.