Privacy Policy

1. Identity of the controller

Entity: Purpose Forward Technical Solutions Inc. (PF TECH)
Privacy Officer: Greg Zatulovsky, CEO (CPA)
Contact: privacy@purposeforwardtech.com

2. Data sovereignty & regional residency

This publication is operated under a strict standard of infrastructure sovereignty. Reader data resides where we commit it to reside, not in an opaque global mesh.

• Primary residency (default): Canada. Grounded in PIPEDA/PHIPA for maximum domestic privacy protection. Our Supabase database and self-hosted workflow infrastructure are in AWS ca-central-1 and Azure Canada Central respectively.
• EU-equivalent protections. We operate consistent with GDPR expectations for European readers — including consent-gated analytics, explicit opt-in for marketing (currently not used), and the rights described in Section 5.

3. What we collect and why

This publication collects three kinds of reader data, each for a specific purpose:

• Aggregated usage signals (page views, reading progress, reactions). Used solely to understand which pieces resonate and where readers drop off. Stored in our Supabase database in Canada. Not shared with third parties except through consent-gated Google Analytics as described below.
• Newsletter subscriptions. When you subscribe, we store your email, the verbatim consent text shown to you, your IP at the time of consent, and timestamps. This is our compliance record under CASL (Canada's Anti-Spam Legislation) and PIPEDA. You can unsubscribe from any email we send.
• Reactions (Insightful, Challenging, Actionable). Counted in aggregate only. We store a single identifier in your browser's local storage so you can change your reaction without double-counting. No server-side record is tied to you.

3.1 Sub-processors

• Supabase (AWS Canada East): Database and file storage for publication content, subscriptions, and aggregated analytics. Data resides in AWS ca-central-1.
• Vercel: Frontend hosting and edge delivery. Vercel operates the global CDN that serves these pages.
• Cloudflare: DNS, CDN, security headers, and DDoS protection for this subdomain.
• Google Analytics 4 (GA4): Aggregated, anonymized usage analytics via the Google tag (gtag.js). IP anonymization is enabled. The GA4 script is only loaded if you consent via the cookie banner. No tracking pixels fire before consent.
• SMTP2Go: Transactional email delivery for newsletter confirmations and subscription notifications.
• n8n (self-hosted, Azure Canada Central): Workflow automation for form routing and transactional notifications. Hosted on PF TECH-controlled infrastructure in Canada.

4. No AI training on reader data

We use enterprise API endpoints for all AI interactions on PF TECH's broader platform. No reader data collected via this publication is ever used to train public AI models. The subscription details you provide, your reactions, and your reading behaviour remain within our Canadian infrastructure and are not shared with AI providers.

5. Your rights

As a Canadian organization subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), and operating consistent with GDPR expectations for EU readers, we uphold the following rights:

• Access: Request access to the personal information we hold about you and an explanation of how it has been used or disclosed.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion (erasure): Request that we delete your subscription record and any personally-associated data.
• Withdrawal of consent: Withdraw consent to our collection, use, or disclosure at any time — via the gear icon on any page, via any newsletter unsubscribe link, or by email.
• Complaint: Challenge PF TECH's compliance by contacting our Privacy Officer. If not resolved, Canadian readers may file a complaint with the Office of the Privacy Commissioner of Canada; EU readers may contact their national data protection authority.

To exercise any of these rights, contact our Privacy Officer at privacy@purposeforwardtech.com.

6. Changes to this policy

We will update the "Last updated" date at the top of this page whenever this policy changes materially. For substantive changes affecting how we handle reader data, we'll also surface a note on the publication homepage for at least thirty days.