Privacy & Legal

This page was drafted for CX Strategy Hub with AI assistance and has not yet been reviewed by a lawyer. It's accurate to the best of our knowledge of how the site is actually built, and the analytics/consent design below has gone through a legal-research pass plus an adversarial review specifically looking for ways it could fail — but if you have questions about your specific situation, contact us directly.

CX Strategy Hub is a sole proprietorship operated by Rory Stennett. This site is hosted in Canada (Plesk, via Rebel.com). We don't sell personal data, to anyone, ever.

What we collect, and why

1. Analytics and ad-attribution — consent-based

When analytics are active, PostHog (via Google Tag Manager, container GTM-TGCRCW6F) records: pages visited, clicks and funnel-step events (which step of a form you reached — never what you typed into it), approximate location (country/region, from your IP — not a precise address), device and browser type, and referrer/campaign parameters (utm_*,gclid, fbclid) if you arrived from an ad or campaign link.

Lawful basis: your consent — for all of the above, including ad-attribution data.Campaign/ad-click parameters are gated by the same consent decision as the rest of analytics, not treated separately — we don't store them until your analytics choice (explicit or the region-based default below) is actually known. Analytics data is processed by PostHog in the United States, while the website itself is hosted in Canada — this cross-border transfer is disclosed here rather than papered over. See "Analytics defaults by region" below for exactly when consent is asked for versus assumed, and why that differs by where you're visiting from.

If you book a consultation, the booking form has a separate, unchecked-by-default checkbox asking whether we can link your prior on-site activity to your inquiry. Leaving it unchecked doesn't affect your ability to book — it only controls whether we connect that history to you specifically, versus keeping it anonymous.

2. Booking and payment — contract-based, not consent-based

If you book a paid consultation, we collect your name, email, phone (optional), your role, organization, the challenge you describe, and your availability preference. Payment is handled by Helcim's hosted checkout — your card details never reach our servers.

This data is not gated by the analytics-cookie choice above. Its lawful basis is performing the contract you're entering into — delivering the consultation you paid for — the same way a store needs your address to ship something you bought, not tracking consent. It's collected regardless of your analytics choice. This data stays on our Canadian-hosted servers; our payment processor, Helcim, is also Canadian (Calgary).

3. Jurisdiction check — used only to set your analytics default

Before you've made an explicit analytics choice, we check two things: whether your browser sends a Global Privacy Control signal (an explicit "don't track me" instruction some browsers/extensions send) — if so, we treat that as your answer immediately, no further check needed — and, if not, a brief, anonymous check of your general location (country and, for Canada, province — never a precise address) using your IP address, through a third-party lookup service (ipapi.co). This determines only which default this page's "Analytics defaults by region" section below applies to you — it is not stored by us, not linked to any other data we hold about you, and not used for any other purpose. If the check fails, times out, or is blocked (e.g. by an ad blocker), we default to the stricter, opt-in-required behavior — never the reverse.

Analytics defaults by region

Quebec (under Law 25 / Bill 96), the European Economic Area, the United Kingdom, Switzerland, Colombia, and Nigeria require explicit opt-in before non-essential analytics can run. If our jurisdiction check places you in one of these — or if your browser sends a Global Privacy Control signal, regardless of where you are — analytics stay off until you clickAccept — Reject is always an equal, one-click choice, never a harder path than Accept.

Everywhere else — including the rest of Canada and the United States — analytics are on by default, on the basis of legitimate interest in understanding how this site is used to improve it. You can turn this off at any time, with one click, with no penalty or degraded experience, using the notice shown on your first visit or the "Cookie preferences" link in the footer on any page. Turning it off also resets the anonymous identifier tied to your browsing so far, not just future activity.

This default is set by the automated jurisdiction check described above. It's a best-effort technical signal, not a guarantee — if you believe it placed you in the wrong default, you can always choose for yourself using "Cookie preferences," regardless of what default was applied.

Where your data goes

• PostHog (analytics, consent-gated) — processed in the United States.
• Helcim (payment processing) — Canadian (Calgary).
• Google Tag Manager — the container itself is Google infrastructure (United States); it currently hosts no tags beyond the PostHog migration in progress. Any future tag (e.g. Google Ads, Meta Pixel) will get its own entry here before it goes live.
• Our booking/lead database and the funnel API run on our own Canadian-hosted infrastructure — not a third party.

Your rights

• Withdraw or change your analytics choice anytime via "Cookie preferences" in the footer.
• Request access to, correction of, or deletion of any data we hold about you — including booking/payment records — by contacting us (see below). Sending the request itself is manual (email us — there's no self-serve form yet), but acting on it isn't: a real deletion mechanism erases your qualification answers and identifying details, and de-identifies our analytics profile of you, within 30 days. Tax/accounting records we're legally required to keep (see "Data retention" below) are exempt from deletion until that retention period passes, but any non-essential marketing or analytics data layered on top of a paying client's record is not exempt and will be deleted on request regardless.
• Quebec residents (Law 25): you have the right to be informed when your personal information is used to render a decision based exclusively on automated processing. The jurisdiction check above sets a cookie-consent default only — it does not decide anything about you individually beyond that, and never affects pricing, booking availability, or how your consultation is delivered.
• EEA / UK / Swiss residents (GDPR / UK GDPR / FADP): in addition to the above, you have the right to data portability and the right to lodge a complaint with your local data protection authority.

Data retention

We keep two categories of data for different lengths of time, because they're subject to different rules:

• If you never became a paying client (you started a form, or contacted us, but didn't book and pay): we delete or anonymize that record after 24 months of no further activity. This follows the shorter end of common practice under the EU/UK's data-protection rules — the strictest regime among the jurisdictions we serve — rather than a longer period that would only be justified for actual customer records.
• If you booked and paid for a consultation: Canadian tax law (the Income Tax Act) requires us to keep records supporting our tax filings — which includes payment and booking records — for at least six years from the end of the relevant tax year. This is a legal floor we cannot go below, not a target; we delete or anonymize these records once that period has passed, unless a longer period is required (e.g. an active CRA audit).

[CONFIRM — not yet reviewed by a lawyer]: this policy reflects general, sourced guidance (EU/UK inactive-lead practice; the CRA's six-year rule for Canadian tax records), not a legal opinion specific to this business. See the note at the top of this page.

Contact

General enquiries: contact@cxstrategyhub.com.

Privacy-specific requests (access, correction, deletion, or a question about this policy):[CONFIRM — placeholder, not yet decided] privacy@cxstrategyhub.com for now — contact us at the general address above if that doesn't reach you.

Changes to this policy

We'll update this page as the site's data practices change, and keep the update honest and current rather than backdated.