Who we are, and what this covers

Process Weave Inc. (“Process Weave”, “we”, “us”) is an Alberta corporation based in Edmonton. We provide operational assurance, AI enablement, and process modernization services to Canadian businesses.

This policy explains how we handle personal information collected through processweave.ca and through our business relationships — briefs, discovery calls, proposals, and ongoing client contact.

It does not cover personal information held inside a client’s own systems that we touch while delivering services. That information stays under the client’s control and is governed by our services agreement with them. See section 11.

We handle personal information under Alberta’s Personal Information Protection Act (PIPA) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

This policy is the written statement of our privacy policies and practices. A copy is available on request from the contact in section 14.

What we collect

From the intake form on this site

• Your first and last name, and the organization you represent
• Contact email address
• Company size, who currently handles your IT, and which of our practices you’re interested in
• Optionally, a mailing address
• Whatever you choose to write in the free-text field

Directly from you, in the course of a conversation

• What you tell us in email, on discovery calls, and in meetings
• Notes we make about those conversations, including our assessment of fit and scope

Automatically, when you visit the site

• Standard web server and content delivery log data — IP address, browser and device type, pages requested, timestamps — collected by our hosting and network providers for security, abuse prevention, and availability

We do not buy contact lists, and we do not use advertising or cross-site tracking technology.

Cookies and analytics

We do not run analytics on this site. No analytics tool, no advertising cookies, no cross-site tracking, no behavioural profiling of visitors.

Our hosting and content delivery providers may set strictly necessary cookies to route traffic, maintain sessions, and block automated abuse. You can block these in your browser, though parts of the site may not work correctly.

Why we collect it

• To respond to your brief and assess whether we’re a good fit for your situation
• To prepare plans and proposals
• To administer a client relationship if one begins — delivery, support, and billing
• To send you Field Notes, if you have asked to receive them
• To meet our legal, accounting, tax, and insurance obligations
• To protect this site and our systems from abuse

We will not use your personal information for a purpose outside this list without asking you first.

Consent

Submitting the intake form is your consent to our use of that information for the purposes in section 4.

Field Notes is separate. You can send us a brief without agreeing to receive email from us. Agreeing to receive it is never a condition of contacting us or of receiving our services, and it requires its own deliberate opt-in.

You can withdraw that consent at any time using the unsubscribe link in any message, or by writing to the contact in section 14. We action withdrawals within 10 business days. Withdrawing it does not affect our ability to reply to an active brief or administer an existing engagement.

You can also withdraw consent to our use of your personal information more generally, on reasonable notice and subject to legal and contractual limits. If withdrawal means we can no longer provide a service, we will tell you before it takes effect.

AI tools, and what we do not do

• We do not sell, rent, or trade personal information.
• We do not put the content of your brief, or client data, into any tool that could train a model on it. Where we use AI tools, we use them under commercial terms that exclude our inputs from provider model training.
• What carries between engagements is method and aggregate insight — how a class of problem tends to behave, what worked, what didn’t. Client data does not carry.

Service providers

We use third-party providers to run our business. They receive access only to what they need, only to provide services to us, and under contractual confidentiality and security obligations. We remain responsible for their handling of personal information we entrust to them.

The tools we use to deliver services inside a client environment are a separate matter. Those are named in the client’s services agreement and its subprocessor schedule, not here — see section 11.

Service providers outside Canada

Alberta law requires us to tell you specifically about service providers located outside Canada, and to keep written information about how we use them.

We use service providers outside Canada to host and deliver this site, and to manage our business records. Personal information you give us may be collected, stored, or processed outside Canada.

Countries where collection, use, storage, or disclosure may occur: Canada and the United States.

What those providers are authorized to do on our behalf: host and deliver this site; receive and store form submissions; filter malicious traffic; store and process business records including contact details and correspondence; transmit email; process payments; store encrypted backups of business records. They are not authorized to use personal information for their own purposes.

On Canadian residency, plainly. Guaranteeing that every layer of a modern stack stays inside Canada is harder than most vendors admit. Canada and the United States is what we can honestly guarantee for our own business records, and we would rather say that than imply more. Full Canadian data localization is achievable for a client environment, and we scope and price it as a deliberate addition to an engagement rather than claiming it by default.

While personal information is in the United States it is subject to United States law, including lawful access by American courts, law enforcement, and government agencies.

Questions about our use of service providers outside Canada, or a request for this information in writing, go to the Chief Security Officer at the contact details in section 14.

How long we keep it

How we protect it

Access to personal information is limited to the people who need it to do their work. We require multi-factor authentication on business systems, encrypt data in transit and at rest, hold credentials in a managed password vault, and back up business records to encrypted storage.

If an incident occurs involving loss of, or unauthorized access to or disclosure of, personal information under our control, and a reasonable person would consider that there is a real risk of significant harm to an individual as a result, we will notify the Information and Privacy Commissioner of Alberta without unreasonable delay, and notify affected individuals as required.

Personal information inside client systems

Delivering our services means we sometimes have access to personal information held in a client’s own environment — their staff records, their customer data, their email, their backups, their cloud accounts.

We treat that information as belonging to the client. We access it only as needed to deliver the agreed services, under the terms of our written agreement with them, and never for our own purposes.

Access is granular and scoped to the work. We do not hold standing account-wide administrative credentials in client environments — no Global Administrator in a Microsoft tenant, no root or unrestricted administrator in a cloud account. Where elevated access is genuinely required for a task, it is scoped, time-bounded, and logged.

The providers and tools we use to deliver services in a client environment are named in that client’s services agreement and its subprocessor schedule.

If you are an employee or customer of one of our clients and have a question about your own personal information, contact that organization directly. They control the information; we will support their response.

Access and correction

You can ask us for access to the personal information we hold about you, an account of how we have used it, and the names of organizations we have disclosed it to. You can also ask us to correct information you believe is inaccurate or incomplete.

Send your request in writing to the contact in section 14. We respond within 45 days, or tell you if we need an extension and why. If a request would require substantial effort, we will give you a written cost estimate before we begin any work you would be charged for.

We may withhold information where the law requires or permits it — for example, information that would reveal personal information about another individual, or material subject to solicitor-client privilege.

Complaints

If you are not satisfied with our response, you can contact:

Contact us

This is the individual designated as responsible for our compliance with PIPA, and the contact named in our collection notice.

Changes to this policy

We post changes on this page and update the date at the top. If a change materially affects how we use information you have already given us, we tell you directly rather than relying on you to check.