Dalu Solutions

Privacy Policy

Last updated: September 17, 2026

We build website previews for Calgary businesses before they ask us to, so we owe you a particularly clear account of where the information came from and what happens to it. This policy is written against what our software actually does, line by line, rather than copied from somewhere else.

The short version: we collect very little, we sell nothing, there is no tracking on previews at all, and one message from you removes your business permanently.

01Who we are, and who to ask

Dalu Solutions is a web and AI agency in Calgary, Alberta. We have a designated privacy officer who is accountable for the personal information we hold and who answers privacy requests. Ask and we will tell you who that is.

Privacy questions: hello@dalu.ca
Phone: (587) 834-1595
Location: Calgary, Alberta, Canada
Mailing address

We aim to answer privacy requests within 30 days, which is the timeline Canadian privacy law works to.

02What this policy covers

This policy covers three things:

This website, dalu.ca.
Website previews we build at addresses like yourname.dalu.ca.
The platform that runs our customers’ websites, including billing and support.

It does not cover what our customers do on their own websites. A salon that publishes its own booking page, or connects its own Google Analytics, is responsible for its own privacy practices — see section 8.

We follow the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act, and Canada’s anti-spam law (CASL) for the messages we send.

03This website

dalu.ca uses Google Analytics 4 to count visits and see which pages people read. It sets Google’s cookies in your browser and sends Google your device and usage data. It runs only on the live site, not on previews.

If you would rather not be counted, Google publishes a browser add-on that opts you out at tools.google.com/dlpage/gaoptout, and most browsers can block cookies for a single site.

If you send us a message through the contact form, we receive your name, your email address and what you wrote. It reaches us as an email, sent through Resend, and we keep it while we are dealing with your enquiry and for a reasonable period afterwards. You can ask us to delete it at any time.

There is no advertising, no advertising pixel, no cross-site tracking and no newsletter list on this website. We do not sell or rent anybody’s information, ever.

04Previews built from public information

We build website previews for Calgary businesses before they ask us to, and then message the owner with a link. The preview is assembled only from information that is already public:

The business’s own public social media profile
Its existing website, if it has one
Business licence data published by the City of Calgary as open data

That content — text, service lists, prices, photographs — is used in that business’s own preview and nowhere else. We do not build a database of businesses to sell, we do not enrich it with data bought from anybody, and we do not profile anyone.

Every preview:

Is blocked from search engines
Expires automatically 30 days after it is built
Carries a removal link that needs no account and takes effect immediately

Messages we send

Outreach messages are written and sent by a person, by hand, from a personal Instagram or Facebook account. Each one says who we are and how to tell us to stop. We send one follow-up at most, five to seven days later, and nothing after that. Nothing is automated and nothing is bulk-sent.

05If you look at a preview

Preview pages deliberately collect close to nothing. There is no cookie of any kind, no advertising pixel and no analytics provider on them. For each visit we record only:

What happened: Which step: page opened, price viewed, domain searched, and so on
Which preview: Which business’s preview it was
Device type: Phone, tablet or desktop — nothing more specific
Where you came from: The website name only, such as instagram.com — never the full address
When: A timestamp

We do not record, and could not tell you:

Any identifier for you as a visitor
Your IP address
Your browser or user-agent string
Anything stored on your device

IP addresses are used for a moment, in memory, to stop one source flooding us with requests. They are not written down anywhere.

06If you write to us from a preview

“Request changes”

We collect your name, a phone number or email address so we can reply, and your message. It is stored and emailed to us.

“Remove this preview”

We record which business asked, and an optional message if you leave one. No name and no contact details are collected. The preview comes down immediately, and we ask you for no reason.

We keep removal records permanently, and that is on purpose. It is the only way to be sure that a business which has told us to go away is never contacted by us again.

07If you become a customer

Payment

Checkout is hosted by Stripe. Stripe collects your card details, billing address, phone number, email address and optionally a tax ID, and processes the payment. We never see, handle or store your card number. Stripe’s own privacy policy covers what it does with that information.

What we hold

Your email address
Your Stripe customer and subscription identifiers, which let us look up your billing without holding card details
The dates your site was activated, suspended or cancelled
Your login account: your email address and a password you set yourself

Passwords are stored as one-way hashes by our authentication provider. We never know your password and cannot look it up for you — we can only send you a reset link.

We use your email address to send you things you need: invoices and receipts, payment failure notices, suspension and cancellation notices, and replies to your support messages. We do not have a marketing list and we do not add you to one.

08Your own website, and your visitors

As a customer, whatever you publish through your login is stored by us so that your website can show it: business details, opening hours, services, prices, photographs, and optionally your own Google Analytics measurement ID.

If you turn on Google Analytics

Analytics is off unless you switch it on. If you connect your own Google Analytics account, your website begins setting Google’s cookies and your visitors are tracked by Google under your account, not ours.

When you turn Analytics on, you become responsible for disclosing it to your own visitors and for obtaining any consent the law requires of you. We do not display a consent banner on your site unless you add one. If you are not sure what that obligation means for your business, ask us before switching it on and we will explain what it does.

Any personal information your visitors give you through your website — a booking, an enquiry — is yours, and you are responsible for how it is handled. We process it only to run your website for you.

09Where the data physically lives

We use service providers to store and process information on our behalf. Here is exactly where things sit:

Database: Supabase, region ca-central-1 — Canada. Business details, accounts and records.
Photographs and uploads: Vercel Blob, region pdx1 — United States.
Hosting and delivery: Vercel — United States.
Payments: Stripe — United States and Ireland.
Email: Resend — United States.
Analytics on dalu.ca: Google — United States and elsewhere.

Customer photographs and website files are stored in the United States. While information is in another country it is subject to that country’s laws, and may be accessible to that country’s courts, law enforcement and national security authorities, under their laws rather than Canada’s. By using our services you understand that this transfer happens.

We only use service providers that are contractually required to protect the information we give them and to use it solely to provide their service to us.

10How long we keep things

Previews: Deleted automatically 30 days after they are built, or immediately when someone asks.
Preview visit records: Kept as anonymous counts. They contain nothing that identifies anyone.
Removal requests: Kept permanently, so that we never contact that business again.
Enquiries and support messages: Kept while we deal with them and for a reasonable period afterwards. Ask us and we will delete yours.
Customer content and photographs: Deleted 90 days after a subscription is cancelled. We email you at cancellation so the clock is never a surprise.
Billing and tax records: Kept as long as Canadian tax law requires, currently six years.

11What we do not do

Stated plainly, because a policy that only lists what is collected tells half a story:

We do not sell, rent or trade personal information. There is no circumstance in which we would.
We do not run advertising, advertising pixels or retargeting anywhere.
We do not build profiles of people, and we make no automated decisions about anyone.
We do not put third-party tracking on preview pages.
We do not store card numbers.
We do not share your information with anyone except the service providers listed in section 9, or where the law requires it.

12How we protect it

Traffic to our sites and services is encrypted in transit. Passwords are stored as one-way hashes. Card details never enter our systems. Access to the database and the hosting accounts is limited to the owner of the business, on accounts protected by two-factor authentication.

We do not currently run database backups or point-in-time recovery — the platform is on a free database tier while the business is being proven. That is a real limitation and we would rather say it here than imply a durability we do not have. Keep your own copies of photographs and text that matter to you.

No system is perfectly secure. If a breach ever affects your information in a way that creates a real risk of significant harm, we will tell you and the Privacy Commissioner, as the law requires.

13Your rights

Under Canadian privacy law you can:

01Ask what personal information we hold about you, and get a copy of it.
02Ask us to correct anything that is wrong.
03Ask us to delete it, unless we are required to keep it — billing records, for instance, or a removal request whose whole purpose is to keep you off our list.
04Withdraw your consent to us using it, understanding that some things, such as running your website, cannot continue without it.
05Tell us to stop contacting you. One message is enough and it is permanent.

Email hello@dalu.ca and say what you want. We may need to confirm who you are before handing over information, and there is no charge.

If we handle your request badly, you can complain to the Office of the Privacy Commissioner of Canada or, in Alberta, to the Office of the Information and Privacy Commissioner of Alberta. We would appreciate the chance to fix it first.

14Children

Our services are sold to businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you think a child’s information has reached us, tell us and we will delete it.

15Changes to this policy

If we change how we handle personal information, we will update this page and change the date at the top. If the change is significant and affects our customers, we will email them about it rather than leaving it to be noticed.

The version on this page is always the one that applies.

16Contact

Anything at all about privacy, including a request to delete what we hold:

Email: hello@dalu.ca
Phone: (587) 834-1595
Mailing address
Or: Use the contact page