Privacy policy

This Privacy Policy explains how Good Creatives ("Good Creatives", "we", "us", or "our") collects, uses, shares, and protects personal information. Good Creatives is a creative subscription service operated by Gemibra Media Ltd, a company incorporated in Ontario, Canada. It applies to our website at goodcreatives.ca, our client portal, and the creative services we provide. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

1. Who this Policy covers

This Policy applies to:

• Visitors who browse the Site or contact us through our forms
• Prospects who book a call or request information
• Clients (subscribers) who sign up for our Services, and the individual users they authorize to use their account
• Anyone who otherwise communicates with us

When a client uploads materials that contain personal information about their own customers or staff (for example, a photo, a mailing list, or contact details in a brief), we handle that information on the client's behalf. In that situation the client decides how it is used, and we act only as a service provider carrying out the client's instructions. This Policy governs our own handling of personal information; a client's own privacy policy governs the information they collect from their customers.

2. Information we collect

Information you give us directly:

• Contact and enquiry details when you fill out a form, book a call, or email us (name, email, company, phone, and anything you choose to write in a message)
• Account details when you become a client (name, email, company, role, login credentials managed through our authentication provider)
• Project materials you send us so we can do the work (briefs, brand assets, logos, copy, images, files, and feedback)
• Billing information when you subscribe. Payments are processed by our payment provider (Stripe). We do not store your full card number on our own systems.
• Records of your communications with us

Information we collect automatically when you use the Site:

• Device and technical data such as IP address, browser type, operating system, and language
• Usage data such as pages viewed, links clicked, and time spent
• Cookies and similar technologies (see Section 6)

Information from third parties:

• Our booking, email, analytics, and error-monitoring providers may share limited technical or interaction data with us so we can operate the Site and Services

3. How we use your information

We use personal information to:

• Respond to your enquiries and provide information you request
• Set up and manage client accounts
• Deliver, maintain, and improve the Services and complete your creative requests
• Process payments and manage subscriptions and billing
• Communicate with you about your account, requests, and service updates
• Send marketing communications where we are permitted to (see Section 5)
• Keep the Site and Services secure, prevent fraud and abuse, and monitor for errors
• Meet legal, tax, and accounting obligations
• Enforce our Terms and protect our rights

We do not sell your personal information.

4. Our basis for processing (consent)

Under Canadian law we rely on your consent to collect, use, and share personal information, except where the law allows us to act without consent (for example, to detect fraud, meet a legal requirement, or as otherwise permitted by PIPEDA).

Consent can be express or, where appropriate and permitted, implied by your use of the Site or Services. You may withdraw your consent at any time, subject to legal and contractual limits, by contacting us (see Section 13). Withdrawing consent may mean we can no longer provide some or all of the Services.

5. Marketing communications

If we send you marketing emails, we do so in line with Canada's Anti-Spam Legislation (CASL). That means we contact you only where we have your consent or another lawful basis, we identify ourselves, and every marketing message includes an easy way to unsubscribe. Unsubscribing from marketing does not stop essential service messages about your account or requests.

6. Cookies and similar technologies

The Site uses cookies and similar technologies to make it work, remember your preferences, keep it secure, and understand how it is used. Some are necessary for the Site to function; others help us measure and improve it. You can control cookies through your browser settings, though disabling some may affect how the Site works.

Our bot-protection provider (Cloudflare Turnstile) runs on our forms to tell humans from automated abuse. It is designed to be privacy-respecting and to minimize the data it collects.

7. How we share information

We share personal information only as needed to run our business, and with parties that are bound to protect it. This includes service providers who help us operate the Site and Services. As of the date above, these include:

• Vercel (website hosting)
• Neon (database hosting)
• Clerk (login and account management)
• Resend (sending our transactional and service emails)
• Cal.com (call and demo booking)
• Cloudflare (bot protection and security)
• Scanii (malware scanning of uploaded files)
• Sanity (content management for our blog and site content)
• Sentry (error monitoring)
• Stripe (payment processing)

Our malware scanner is the only provider that receives the contents of files you upload.

Each provider only receives the information it needs to perform its function, and is required to protect it and use it only for that purpose. This list may change as our providers change; the current list is available on request.

We also disclose information where we are required by law, a court, or a regulator, or where disclosure is needed to protect our rights, our users, or the public. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

8. Where your information is stored and processed

We are based in Canada, but several of our service providers are located in the United States or other countries. This means your personal information may be stored or processed outside Canada, and may be subject to the laws of those countries, including lawful access by their courts, law enforcement, and national authorities. We take steps to ensure any provider we use offers a comparable level of protection to what is required under Canadian law.

This includes files you upload to the portal. Every upload is scanned for malware before it can be opened or downloaded, and our scanning provider processes it in the United States. There is no Canadian region available for this service.

9. How long we keep information

We keep personal information only as long as we need it for the purposes described in this Policy, or as required by law (for example, tax and accounting records).

• Enquiry and prospect data: kept while we are in contact and for a reasonable period afterward, then deleted or anonymized
• Client account and project data: kept for the life of the account and for a period after it closes, so we can meet legal, tax, and business needs, then deleted or anonymized
• Billing records: kept for the period required by tax and accounting law

Clients can request deletion of their data, subject to the limits above, by contacting us.

10. How we protect information

We use reasonable administrative, technical, and physical safeguards to protect personal information, including access controls, encryption in transit, and storage with reputable providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond appropriately if a problem occurs.

Files uploaded to the portal are scanned for malware before they become available. A file that does not come back clean is never made downloadable.

11. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Withdraw consent to our use of your information (subject to legal and contractual limits)
• Ask us to delete your information, where we are not required to keep it
• Ask questions or complain about how we handle your information

To exercise any of these, contact us using the details in Section 13. We may need to verify your identity first. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

12. Children

The Site and Services are meant for businesses and are not directed at children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Contact us

If you have questions about this Policy or how we handle your information, or to exercise your rights, contact our privacy contact:

Riley Stevens, Privacy Officer

Good Creatives, a service of Gemibra Media Ltd, Ontario, Canada

hello@goodcreatives.ca

Under Canadian law we are accountable for the personal information in our control and have designated the person above to oversee our compliance.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Last updated" date above and, for significant changes, provide a more prominent notice. We encourage you to review this Policy periodically.