Privacy Policy

1. About this policy

This Privacy Policy explains how Ontario Lead Networks ("OLN", "we", "us") collects, uses, shares, retains, and protects personal information. It is written to satisfy the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal Canadian privacy law that governs commercial activity.

We have written this policy in plain English. If anything is unclear, please email the Privacy Officer (see Section 2) and we will explain.

2. Who we are

Ontario Lead Networks Inc. (OCN 1001650999). Mailing address: PO Box 262, Cumberland Beach ON L0K 1G0. We run a lead-referral service that connects homeowners with local home-service contractors in Muskoka, Simcoe County, and surrounding Ontario markets.

Privacy Officer contact: [email protected]

The Privacy Officer is the named accountable individual under PIPEDA Principle 1 and is responsible for OLN's compliance with this policy and with Canadian privacy law.

3. How we make money (our business model)

Ontario Lead Networks is a paid lead-referral service. We do not charge homeowners. We make money by charging contractors a referral fee when they accept a lead and receive a homeowner's contact information through our platform.

In practical terms:

1. You (the homeowner) submit a project request through our website or one of our partner sites (e.g. muskokadockservices.ca).
2. We identify one local contractor whose trade, service area, and capacity match your request.
3. We email or text that contractor a preview of your project — but not your contact details yet.
4. If the contractor accepts the lead, we release your name, email, phone, and project information to them and charge them a referral fee (typically $25–$300 depending on project value).
5. The contractor contacts you to discuss the project and provide a quote.

This means your inquiry has commercial value to us. Submitting a contact form gives us your express consent to (a) share your contact information with one matched contractor, (b) have that contractor contact you about your project, and (c) collect a referral fee from that contractor for the introduction.

You are not charged anything for this service. Whether you ultimately hire the contractor is entirely your decision.

4. What personal information we collect

When you submit a project request, we collect:

• Your name
• Your email address
• Your phone number (optional)
• Your city or town
• The service you are looking for
• The project details you choose to share in the message field
• Your IP address and browser/device information (captured automatically when you submit the form, for security and dispute-resolution purposes)
• The exact timestamp of submission and the URL of the form you submitted
• A record of the consent you provided at submission, including the version of this policy in effect at that time

4b. What we collect from contractors

When a contractor signs up to receive leads (via our partner application or any sister site), we additionally collect:

• Primary contact name and title
• Company / business name and (if applicable) operating-as ("DBA") name
• Business email address and phone number
• Business mailing address and service-area cities
• Trade(s) offered, services accepted, services declined
• Job-size minimum/maximum, monthly lead capacity, priority tier preference
• Insurance and licensing information (where applicable to your trade)
• Payment information — handled by our PCI-compliant payment processor (Stripe), not stored on OLN servers
• Communication preferences (email, SMS opt-in with timestamp for CASL compliance)
• The exact terms version you accepted at signup and the timestamp of that acceptance

We use this information to (a) match you to homeowner leads in your trade and service area, (b) bill you for accepted leads, (c) communicate operationally (lead previews, invoices, disputes, account notices), and (d) maintain a defensible audit log of every state change to your account and every lead routed to you. Contractor account records are retained for 36 months after account closure for dispute, tax, and warranty purposes; financial records follow the CRA 6-year rule described in §8.

5. Why we collect it and how we use it

We collect this information for the following specific purposes (PIPEDA Principle 2):

1. To match you with one local contractor who can quote on your project.
2. To verify that the request is legitimate (anti-bot, anti-fraud, duplicate detection).
3. To maintain a record of consent in case there is ever a dispute about what you authorized.
4. To bill the contractor the referral fee and to administer invoices, disputes, and refunds.
5. To operate and improve the service — performance reporting, fraud detection, debugging.
6. To meet our legal and tax obligations — for example, the Canada Revenue Agency requires us to keep financial records for six years.

We do not use your information for any other purpose without your separate consent.

6. Who we share it with

We share your personal information with one matched local contractor, and only that contractor. Specifically:

• That contractor receives your name, email, phone, city, the service requested, and the project details you provided.
• The contractor is contractually required to use your information only to contact you about your project, to keep it confidential, to not re-sell or re-share it, to comply with Canada's Anti-Spam Legislation (CASL) when contacting you, and to delete it within 90 days if no work proceeds. See our Contractor Terms § 9 and § 12 for the contractor's full obligations.

We do not share your information with any other parties for marketing. We do not sell your information to third-party data brokers, advertising networks, or other businesses.

We may also disclose information where required by law, in response to a valid court order, lawful warrant, or other binding legal process, or where necessary to investigate suspected fraud or to protect the safety of any person.

7. Where your data is processed

Your information is stored and processed using the following infrastructure providers, some of which operate servers in Canada, the United States, and other countries:

• Cloudflare (web hosting and form intake) — primarily Canadian and US data centres
• GitHub Actions (workflow automation that routes leads to contractors) — US-hosted
• Google Workspace / Gmail / Google Sheets (email delivery and our internal record-keeping) — US and Canadian data centres
• OpenAI (AI-assisted lead vetting — pattern detection only; OpenAI is contractually prohibited from training on our data and we do not send full contact details, only sanitized project metadata)
• Resend or similar transactional email provider (planned, replacing Gmail SMTP) — North American data centres

When personal information is transferred outside Canada, it remains subject to the laws of the jurisdiction in which it is stored. We use commercially reasonable safeguards (encryption in transit, contractual data-processing terms with each provider) to protect your information regardless of where it is held.

8. How long we keep it

We follow PIPEDA Principle 5: we keep your information only as long as we need it to fulfill the purposes for which it was collected. PIPEDA does not specify exact retention periods — each organization sets its own reasonable schedule, balancing your privacy against legitimate operational needs (warranty follow-up, billing-dispute resolution, tax compliance). Our schedule appears below, followed by the longer retention that Canadian law requires of us regardless of our schedule.

OLN handles two kinds of lead arrangements with our contractors, and our retention windows reflect the natural lifecycle of each:

• Flat-fee leads (dock services, septic, exterior services / eavestrough): the contractor pays OLN a fixed referral fee when the lead is delivered. The business relationship is complete within a few weeks.
• Commission leads (solar, home battery storage, heat pumps, financing, windows, roofing, HVAC): the contractor pays OLN a commission only if the deal closes. These deals take three to twelve months to close, so we hold your information until the deal resolves.

Our redaction rules — the earliest applicable trigger fires:

• Active leads (we have your information but it has not yet been passed to a contractor): retained while in flight, normally less than 7 days.
• Delivered flat-fee leads: personally identifying fields (name, email, phone, free-text project notes) are redacted 90 days after we passed the lead to the contractor. This is enough time for any billing or warranty follow-up between you and the contractor.
• Delivered commission leads: personally identifying fields are redacted 90 days after the deal closes (whether it closes won or lost). Until then we need to track the lead through the contractor's sales cycle.
• Closed, passed, rejected, or expired leads: personally identifying fields are redacted 90 days after the closing event.
• Absolute cap (safety net): even if none of the above trigger, your information is redacted no later than 6 months from collection for flat-fee leads, 12 months for short-cycle commission leads (windows, roofing, HVAC), and 24 months for long-cycle commission leads (solar, battery, heat pumps, financing).
• Financial stub (lead ID, dates, fee / commission amount, contractor ID — no personally identifying fields): retained for the full six years from the end of the relevant tax year, as required by the Canada Revenue Agency under the Income Tax Act.
• Audit log entries (timestamped record of every state change to every lead, kept for legal and dispute defensibility): retained indefinitely. These entries do not contain free-form sensitive information after PII redaction has occurred.

How we enforce these windows. A scheduled automated job runs daily and redacts any lead whose window has passed. Every redaction is recorded in a hash-chained audit log that cannot be silently edited. You can verify this happened by exercising your right of access (Section 10): if your lead's window has passed, the returned record will show redacted_at set and the personally identifying fields replaced with placeholders.

Where do these specific time periods come from? The 90-day, 6-month, 12-month, and 24-month figures above are not mandated by Canadian privacy law — PIPEDA leaves the exact length up to each organization, requiring only that the choice be reasonable for the stated purpose. We chose those windows to leave a fair interval for warranty or billing follow-up while resolving the lead's commercial purpose. By contrast, the six-year retention for financial records is required of every Canadian business by the Canada Revenue Agency under the Income Tax Act — we cannot shorten it, even at your request.

"Redaction" means we permanently overwrite the identifying fields (name, email, phone, free-text project description) with placeholder values. The lead can no longer be associated with you as an individual, but the transactional record remains for our financial and audit obligations.

Contractor account records are retained for 36 months after the contractor account is closed, for dispute, tax, and warranty purposes.

9. How we protect it

We use commercially reasonable physical, technical, and administrative safeguards to protect your information (PIPEDA Principle 7):

• All form submissions and back-end communication are encrypted in transit using TLS 1.2 or higher (HTTPS).
• Access to homeowner contact details is restricted to (a) the matched contractor, and (b) the OLN Privacy Officer for operational and compliance purposes.
• Forms include a hidden anti-bot honeypot field. Submissions from bots are silently discarded.
• An immutable audit log records every state change to every lead, including who acted (system, owner, contractor), when, and from what IP address. This supports legal defensibility and dispute resolution.
• We do not store payment-card information ourselves — invoices are issued through Stripe, which is PCI-DSS Level 1 compliant.
• We periodically review access controls and revoke credentials no longer in use.

10. Your rights under PIPEDA

Under Canadian privacy law you have the following rights with respect to your personal information held by OLN:

• Right of access. You may request a copy of the personal information we hold about you.
• Right of correction. If you believe information we hold about you is inaccurate, you may request that we correct it.
• Right to withdraw consent. You may withdraw your consent to our continued processing of your information, subject to legal and contractual restrictions and on reasonable notice. Withdrawal of consent does not affect processing already carried out.
• Right to request deletion. You may request that we delete your personal information. We will comply where we are not required by law to retain it (for example, financial records subject to CRA retention).
• Right to complain. See Section 14.

To exercise any of these rights, email the Privacy Officer (Section 2). We will acknowledge your request within 5 business days and complete it within 30 days, as required by PIPEDA.

11. Cookies and analytics

Our website uses Google Analytics 4 (measurement ID G-KEF6K59P0E) to understand aggregate site usage — for example, how many people visit, what pages they view, and roughly where in Canada they are visiting from. Google Analytics uses cookies and similar technologies to collect this information.

The information collected by Google Analytics is aggregated and is not used to identify you personally. If you would like to opt out, you may install the Google Analytics opt-out browser add-on or set your browser to refuse cookies.

We do not currently use advertising cookies, cross-site tracking pixels, or behavioural retargeting.

12. Children's privacy

Ontario Lead Networks is not directed at and does not knowingly collect personal information from individuals under the age of 18. If you believe a minor has submitted information to us, please contact the Privacy Officer and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The "Effective date" and "Last reviewed" fields at the top of this page record when it was last changed. If we make a material change — for example, expanding what information we collect or who we share it with — we will flag the change on the home page for at least 30 days.

You may want to bookmark this page and check it periodically.

14. How to make a complaint

If you have a concern about how we have handled your personal information, please contact our Privacy Officer first (see Section 2). We take all complaints seriously and will respond within 30 days.

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC):

• Website: priv.gc.ca/en/report-a-concern/
• Toll-free: 1-800-282-1376

The OPC investigates complaints free of charge under PIPEDA.