Privacy
Denety Consulting ยท 28 Ted Rogers Way, Toronto, Ontario M4Y 2J4, Canada
Last updated: 30 September 2026
This describes what we collect through this website, why, who else sees it, and how to get it removed. It is written to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to us because we collect personal information in the course of commercial activity.
Who is accountable
The Privacy Officer at Denety Consulting is accountable for personal information held by the practice. We will give you their name on request, which is what PIPEDA requires. Reach them at help@denetyconsulting.com.
What we collect, and only this
When you sign up to read the articles
| What | Required | Why |
|---|---|---|
| Email address | Yes | To send the confirmation link, then the articles |
| The article that prompted you | Yes | Recorded automatically, so we send related pieces rather than everything |
| The topic of that article | Yes | Recorded automatically, so we only email you about the subject you came for |
The form asks for one thing. We do not ask for your name, company, phone number, job title or address to read an article, and we do not buy or append data about you from anywhere else.
Before we send the confirmation, we check the domain part of your address (example.com, never the whole address) against a list of known disposable-mail providers, and look up whether that domain accepts email at all. The lookup goes to Cloudflare's DNS service and contains the domain only.
Automatically
Our host, Cloudflare, records the usual server information for every request: your IP address, browser user-agent, the page requested and the time. This is used to serve the site, to block abuse, and to keep the first article free as described below, and nothing else. We do not run advertising trackers, and we do not build a profile of what you read.
To keep the first article free
One article opens without signing up. To make that one article rather than one per browser window, we record that a free read has been used. Two things carry that record: a cookie in your browser, and a matching entry on our side, so that clearing the cookie does not simply reset the count.
The entry on our side is not your IP address and does not contain it. It is a short keyed hash, computed from your IP address and your browser's user-agent string together with a secret that only we hold, stored with the name of the one article you opened. We cannot read an address or a device back out of it, and we do not try to.
We should be plain about what that is, though: it is a pseudonymous identifier, not anonymous data. Anyone holding both the secret and a list of candidate IP addresses could test them against it, so we keep the secret the way we keep our other signing keys, and we treat the entry as personal information under PIPEDA. It records only that a device has used its free article, and which article that was. It is never stored next to your email address or anything else about you. We keep it for 180 days, the same as the cookie, then it is deleted automatically.
This is the only thing on this site that works this way. There are still no analytics and no advertising trackers.
Cookies and storage
| Name | Type | Contains | Lifetime |
|---|---|---|---|
__Host-denety_member | Cookie | An expiry timestamp, an opaque id and a signature. Not your email address. | 365 days |
__Host-denety_free | Cookie | Which single article you read free | 180 days |
| Free-article record | Record on our server, not in your browser | A keyed hash of your IP address and browser user-agent, plus which single article was opened. Not your email address. | 180 days |
The membership cookie is deliberately anonymous: it proves someone confirmed an address, not which address. It is HttpOnly and Secure, so scripts cannot read it and it never travels over plain HTTP. If you log out, we add that cookie's opaque id to a deny list so the cookie stops working even if someone had copied it. That list holds the id and nothing else, for the same 365 days.
Clearing your cookies removes both cookies. If you have not confirmed an address you will see the sign-up wall again, but your one free article stays used, because that is also recorded on our side. See "To keep the first article free" above.
There are no analytics cookies and no advertising cookies on this site.
Consent
We use double opt-in. Entering your address does nothing until you click the confirmation link in the email we send. That click is your express consent under Canada's Anti-Spam Legislation, and it is what unlocks the articles.
You can withdraw consent at any time. Every marketing email we send you after you confirm has a one-click unsubscribe, and it takes effect immediately; CASL allows up to ten business days, and we do not need them.
The one exception is the confirmation email itself. It is a single transactional message and it carries no unsubscribe link, because at that point there is nothing to unsubscribe from: if you do not click, we never email you again. You can also write to us at any time and we will remove you.
Unsubscribing stops the emails. It does not re-lock the library. That is the cookie in your browser, and the two are separate.
What we send you
The article you asked for, then two follow-up emails over about three weeks pointing at related pieces, and occasional new articles on the topic you signed up for. That is all. We do not sell, rent, trade or share your address with anyone for their own marketing.
Who else processes your information
| Processor | What they hold | Where | Why |
|---|---|---|---|
| Resend (Resend, Inc.) | Your email address and the title of the article you asked for, in order to send you one message | United States | Sending the confirmation email |
| Kit (ConvertKit, LLC) | Your email address, the topic tag and the article you converted on. Nothing about you reaches Kit until after you click the confirmation link. | United States | Sending the articles and the follow-ups |
| Cloudflare, Inc. | Server logs (IP, browser, page, time), the sign-up record described under "How long we keep it", and the free-article record | Global edge, including outside Canada | Hosting, and running the sign-up itself |
| Google LLC | Your IP address, when your browser fetches the page fonts | United States | Web fonts |
Your information is stored and processed outside Canada. PIPEDA permits this, but requires we tell you plainly: while it is held in another country it is subject to that country's laws, including lawful access by its courts and government agencies. If that is a problem for you, email us instead of using the form and we will send you the articles directly.
How long we keep it
| Record | Kept for |
|---|---|
| Sign-up record (your address and the article) | Up to 48 hours while it is unconfirmed. Confirming does not delete it: it is replaced by a record that still holds your address and expires up to 24 hours after your click. Both go automatically. |
| Rejected-domain log: the domain and the reason only, never your address | 180 days, then deleted automatically |
| Free-article record: a keyed hash of your IP address and browser user-agent, plus which single article was opened | 180 days, then deleted automatically |
| Enquiry and article-signup records | No longer than 24 months after your last interaction with us |
| Records relating to a client engagement (only if you become a client, not for reading articles) | 7 years, for professional and tax reasons |
| Cloudflare server logs | Set by Cloudflare, not by us. We cannot delete these on request. |
After that we delete them. If you unsubscribe we keep only the minimum needed to honor that: a record that you asked not to be contacted.
Keeping it safe
The site is served over HTTPS only. The membership cookie is signed, so it cannot be forged, and it is HttpOnly, so no script can read it. Access to the subscriber list is limited to people at Denety who need it and is protected by multi-factor authentication. We hold no payment details on this site at all.
Suppliers we use
Where we pass information to a supplier to process on our behalf, our contract with them requires protection comparable to our own. We remain accountable for it.
Seeing, correcting or deleting what we hold
Write to help@denetyconsulting.com and ask. You can ask us to:
- tell you what we hold about you and who we have disclosed it to
- correct anything that is wrong
- delete it entirely
- stop emailing you
We will respond within 30 days, which is the PIPEDA limit, and usually much sooner. We will not charge you, and we will not ask why.
If you are not satisfied
Tell us first and we will try to put it right. If you are still unhappy you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.
If you are in the EU or UK
We are a Canadian company and do not offer services to, or monitor people in, the EU or UK, so the GDPR generally does not apply. It makes no practical difference: anyone anywhere can use the address below to see, correct or delete what we hold, and we will do it.
Changes
If we change this page we will update the date at the top. If a change materially affects how we use information we already hold, we will email subscribers before it takes effect rather than relying on you to re-read this.