Last updated: May 3, 2026
Farlain Advisory ("we," "us," "our," or "Farlain") is committed to protecting your privacy and handling your personal information with transparency and care. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights under Canadian privacy law, specifically the Personal Information Protection and Electronic Documents Act (PIPEDA).
Farlain Advisory is a business advisory firm based in Ontario, Canada. We help growth-focused companies identify constraints, build scalable operations, and improve financial performance. When we say "Farlain," "we," or "us" in this policy, we are referring to Farlain Advisory and any of its representatives, contractors, or delegated operators who process personal information on our behalf.
We collect different types of information depending on how you interact with us. Here is the full list of data we collect:
If you complete our free business diagnostic assessment, we collect the following:
| Data Point | Description |
|---|---|
| Personal Information | Your full name, email address, phone number, and LinkedIn profile URL |
| Business Information | Business name, location, industry, and business type |
| Role and Ownership | Your role in the business and ownership stake |
| Financial Data | Annual revenue, gross margin percentage, cash runway (months), and historical revenue growth rate |
| Operational Data | Current team size, team composition, age of business, and growth trajectory |
| Qualitative Responses | Open-ended answers to questions about business challenges, priorities, and goals |
| Assessment Scores | Computed diagnostic scores across multiple business dimensions |
| Session Metadata | Date and time of submission, session identifier, device type, browser type, and IP address |
If you consent to analytics tracking via our cookie consent banner, Google Analytics 4 (GA4) collects:
We store your cookie consent choice (accepted or rejected) in your browser using localStorage. This allows us to respect your preference on future visits without re-prompting you.
If you contact us via email or other means, we collect:
We collect your information through the following methods:
We collect and use your information for the following business purposes:
How we obtain your consent varies by the type of data and use:
When you submit the business assessment form, you are providing explicit, informed consent for us to:
This consent is obtained at the point of form submission. You can withdraw this consent at any time by contacting andrew@farlain.ca.
Analytics tracking is off by default. Google Analytics will only collect data about your site usage if you explicitly accept analytics cookies via our cookie consent banner. Your choice is stored in localStorage using the key "farlain_cookie_consent" and will be respected across future visits.
In accordance with Canada's Anti-Spam Legislation (CASL):
To operate our website and deliver our services, we use third-party service providers that may access or process your information. Each processor has been selected based on their security practices and data handling standards.
We have moved from using Google Fonts CDN to self-hosting our fonts (Cormorant Garamond and Inter), so Google Fonts no longer receives requests from our website.
We do not share your assessment data with any other third parties, including advertisers, data brokers, or marketing platforms, without your explicit consent. We do not sell your personal information.
Some of your information is transferred to and processed by service providers in the United States:
Assessment form data is stored on Netlify's servers in Virginia, USA. This transfer is necessary for us to operate our diagnostic tool and deliver your results.
The website URL you provide on the diagnostic page is sent to Anthropic's Claude AI on US-based servers for the limited purpose of reading public content from that URL. Your questionnaire answers, email address, and business name are not sent to Anthropic. See the Anthropic section above under Third-Party Processors for full detail.
Website usage data is processed by Google on servers in the United States. This transfer is necessary for us to measure site performance and user engagement.
Important: When data is processed in the United States, it may be accessible to US law enforcement authorities under US legal process (e.g., subpoena, court order) as authorized under US federal law, including the Foreign Intelligence Surveillance Act (FISA). We have no control over such legal process and cannot notify you of it without violating US law.
We are establishing Data Protection Agreements (DPAs) with Netlify and Google that include standard contractual clauses and commitments to comply with PIPEDA principles regarding the security and confidentiality of your data. We will update this policy when DPAs are finalized.
We use the following types of cookies and similar tracking technologies:
| Cookie / Identifier | Category | Purpose | Duration |
|---|---|---|---|
| farlain_cookie_consent | Necessary | Stores your cookie consent choice (localStorage) | Until you clear browser storage |
| GA4 Session ID | Analytics | Tracks your session on our website (only if you consent to analytics) | 30 minutes of inactivity |
| GA4 User ID | Analytics | Identifies you across sessions for analytics (only if you consent) | Up to 2 years |
When you first visit our site, a cookie consent banner appears. You can:
Your choice is stored in localStorage and will be respected across all future visits. You can change your preference at any time by clearing your browser cookies or returning to the banner.
For detailed information about cookies, including how to manage them, please see our Cookie Policy.
We retain your information for different periods depending on the type of data and the reason we collected it:
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights:
You have the right to request access to all personal information we hold about you. We will provide this information in a form that is simple to understand, without excessive cost or delay.
You have the right to request correction of any personal information that is inaccurate, incomplete, or misleading. We will correct the information and notify any third parties (if applicable) that have received the incorrect information.
You have the right to request deletion of your personal information. We will delete your data unless we have a legal or contractual obligation to retain it (e.g., for billing records or compliance with law).
You have the right to withdraw your consent to the collection, use, or disclosure of your personal information at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
You have the right to opt out of receiving marketing communications from us at any time. Every marketing email will include a clear unsubscribe link.
To exercise any of these rights, please contact us using the information in the Contact and Complaints section below. We will respond to your request within 30 days. If we need more time, we will provide an explanation and timeline for our response.
In the event of a data breach or security incident that creates a real risk of significant harm to an individual, we are committed to:
We maintain industry-standard security practices to prevent unauthorized access to your data, including encryption, access controls, and regular security assessments.
Our website and services are not directed to anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected information from a child under 18 without parental consent, we will take steps to delete such information and terminate the child's participation in our services.
We comply with Canada's Anti-Spam Legislation (CASL), which regulates commercial electronic messages (emails, text messages, etc.).
When you submit the business assessment form, you provide implied consent to receive your assessment results. We may send you your completed results, diagnostic summary, and related insights without additional consent.
Any follow-up marketing emails from us (e.g., consulting service offerings, educational content, promotional materials) require your express, affirmative consent. We will obtain this consent before adding you to any marketing list.
Every email from us will include:
If you unsubscribe from our marketing list, we will remove your email address within 10 business days and will not send you further marketing messages. You may still receive transactional messages (e.g., order confirmations, password resets) that are not considered commercial messages under CASL.
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
Your continued use of our website after changes become effective constitutes your acceptance of the updated policy. We encourage you to review this policy periodically to stay informed about how we protect your privacy.
If you have questions about this privacy policy, wish to exercise your rights, or have a complaint about our privacy practices, please contact us:
We will acknowledge receipt of your request within 5 business days and will provide a substantive response within 30 days. If we need additional time, we will explain why and provide a timeline.
If you are not satisfied with our response to your privacy concern, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC). The OPC is Canada's federal privacy regulator and can investigate your complaint independently.
Legislation: This privacy policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal private sector privacy legislation in Canada. We also comply with Canada's Anti-Spam Legislation (CASL) and acknowledge that PIPEDA will be succeeded by the Consumer Privacy Protection Act (CPPA) upon its coming into force; we will update our practices accordingly.
Jurisdiction: This policy and our privacy practices are subject to the laws of Ontario, Canada. Any dispute regarding this policy or our privacy practices shall be governed by and construed in accordance with the laws of Ontario.
Summary: Farlain Advisory is committed to transparent, lawful, and ethical handling of your personal information. We collect only what we need, use it only for stated purposes, protect it with industry-standard security, respect your rights under PIPEDA, and provide you with clear mechanisms to control your data. If you have any concerns, we are here to listen and help.