Trust
Privacy policy
This site collects what you give it, in the contact form, when you book and when you chat with the assistant. It also notes how you arrived. This policy explains what happens to it.
Scope
What this policy covers
This policy covers whiteglovelabs.ai and any enquiry you send to our published email addresses. WhiteGlove Labs AI Ltd. is responsible for the personal information described here. We are a small Canadian professional-services firm. This policy does not cover personal information we handle while working for a client; see client engagement data.
Collection
What we collect, and what we do not
We collect seven kinds of information. If it is not listed here, this website does not collect it.
What we collect
- Contact form fields
- Name, work email, organization, role, the workflow or enquiry you describe, and any timing you add.
- Submission metadata
- Date and time, plus technical signals used only to detect automated abuse of the form.
- Hosting logs
- Our host logs the IP address, page and time of each request to run and secure the site. Kept for the host’s standard log period, never joined to a lead record.
- How you arrived, if you send a form or contact card
- The page you landed on, the UTM source, medium and campaign of your link (direct if none), the website you came from and up to 20 pages you read. Kept on your lead record and deleted with it.
- Booking details
- The name, work email and details you enter on the booking form, and the time you pick.
- Assistant answers
- Your answers to the assistant’s fit questions, kept under a random code and not under your name. We do not keep the conversation itself.
- Email correspondence
- Your messages and our replies, held in our business email system.
What we do not collect
- No third-party advertising trackers, no retargeting pixels, no advertising identifiers.
- No sale of personal information, and no sharing of it for another organization’s marketing.
- No third-party analytics, tag manager or pixel, and no persistent device identifier. Our own visit counts hold no identifier. The browser section below lists what they contain.
Why does White Glove Labs collect this information?
We use it to answer your enquiry, prepare for a 30-minute call, send a scheduling link, and keep an accurate record of what we discussed and agreed. We do not use it to profile you, score you for advertising, or infer anything beyond what you told us in your own words.
Lawful basis
Consent under PIPEDA
We operate under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and under substantially similar provincial law where it applies. We collect the information above on the basis of your consent. You give it when you submit the form or email us, for the purpose identified at the point of collection.
We collect only what that purpose needs. We do not use it for anything else without asking you first. You can withdraw consent at any time by writing to info@whiteglovelabs.ai. We then stop processing and delete the enquiry record, except for anything the law requires us to keep. Once you withdraw, we can no longer respond to your enquiry.
Handling
How form submissions are handled and stored
The form posts to our own server endpoint over Transport Layer Security (TLS). The server validates the submission and screens it for automated abuse. It then emails the founders’ business inbox and stores a lead record in a managed database (Convex, hosted in Canada). The record holds every field you filled in, such as your name and work email, plus your language and the date of each submission. Our team adds a stage and notes.
If you book a session, on the booking page or with the assistant, we create the event in our Google Calendar (Google Workspace). The event carries the details you enter on the form. The calendar invitation sent to your email is the confirmation. We also add the booked time to your lead record, and a booking from someone who had not written to us creates that record.
A daily job deletes any record with no contact for 24 months, along with everything attached to it, bookings included. When you ask us to delete your data, we delete the calendar event too.
| Record | Retention | Disposition |
|---|---|---|
| Contact form enquiry record | 24 months from last contact, or sooner on request | Deleted from the lead database, with its submissions, notes and bookings: automatically at 24 months, or when you ask |
| Email correspondence | 24 months from last contact, or sooner on request | Deleted from mailboxes and archive |
| Abuse-prevention signals | 30 days | Deleted automatically |
| Assistant answers, kept under a random code | 30 days after your last message | Deleted automatically; if you left your details, the answers live on in your lead record and go when it does |
| Contract and engagement records | As required by the contract and by Canadian tax and corporate record-keeping obligations | Governed by the engagement, not by this policy |
Assistant
The chat assistant and your answers
The chat on this site is an AI model. What you type goes to the model providers that run it, which process it in the United States. Your first message also carries the page you are on and the campaign parameter of the link you followed, if any. We send every request with zero data retention requested and data collection denied. We do not keep the conversation itself. We keep your answers to its fit questions under a random code held in your browser tab, not under your name. They are deleted on the schedule in the retention table above.
If you type an email address or phone number into the chat anyway, we remove it before the message reaches a model.
Your contact details never pass through the model
The assistant does not ask for your name, email or phone number. Once your answers are enough for a fit check, a card asks for them. You tick a consent box that names the purpose, a founder following up on your enquiry, and the details go straight to our database. Until you send that card we hold no contact details from the chat.
How the assistant uses your answers
As you answer, the assistant puts our offers in order. It uses six things you told it: AI platforms in use, workflows named, systems to integrate, team size, timeline and budget band. That changes only which offer comes first. It never blocks booking or decides whether we reply.
Once your answers suffice for a fit check, the assistant computes a fit score. It saves the score with the answers, under the same random code and schedule. It is not linked to your name unless you send your details.
If you choose your kind of business on the consulting page after opening the assistant, we save that choice with your answers. If you send your details, we copy it to your lead record.
Third parties
Providers that process your information
We keep this site’s own records in Canada. That is your lead record, with your booked time and assistant answers attached to it. The calendar event itself is held by Google Calendar. Six providers handle your information for us, and each receives only what it needs. Four of them are not in Canada. The assistant’s chat text is processed in the United States. Resend and Stripe are in the United States. Google chooses where Google Calendar keeps its data.
| Provider | What it does | Where it stores it |
|---|---|---|
| Vercel | Hosts the site and runs its servers; keeps request logs | Canada (Montréal region) for the servers; its network delivers cached pages from locations worldwide; log storage is managed by Vercel |
| Convex | Holds your lead record, forms, bookings, assistant answers and fit score | Canada (AWS Canada Central region) |
| OpenRouter, routing to DeepInfra | Runs the assistant model on what you type; each request asks for no retention and denies data collection | Processed in the United States; not stored |
| Google Calendar (Google Workspace) | Holds the event for a booked session and sends the invitation | Google Workspace data centres, location chosen by Google |
| Resend | Sends the notice of your form to our inbox and our confirmation emails | United States |
| Stripe | Takes payment if you buy a product; we receive your name, email and the order, never your card number | United States |
For changes to this list as they happen, email info@whiteglovelabs.ai. If you need your data to stay in Canada, ask before we scope the work.
Client work
Information handled inside a client engagement
This policy covers our website and our own enquiry records. It does not cover information we handle while delivering work for a client. In an engagement, the client stays the controller and custodian of its own records. We act on the client’s instructions under the contract, statement of work and any data-processing or security schedule attached to it. Those terms cover residency, classification handling, access, retention, breach notification, and return or destruction at the end of the engagement.
Your own privacy law applies to your records, not PIPEDA and not this page. For a federal institution, that is normally the Privacy Act and its own privacy management framework.
Your rights
Access, correction, deletion and complaints
How do I ask what you hold about me?
Email info@whiteglovelabs.ai from the address you contacted us with, and say what you want: a copy of what we hold, a correction, or deletion. We acknowledge your request within one business day and respond in full within 30 days, the PIPEDA timeline. We may ask a question to confirm your identity, but no more than we need. A routine request is free. If we refuse any part, for example where we must keep a record for a legal obligation, we tell you in writing which part and why.
Our privacy officer is Alexander Leslie, Co-Founder of WhiteGlove Labs AI Ltd. Reach him at info@whiteglovelabs.ai.
To delete everything we hold about your email address and stop all email to it, use the opt-out page. We send a link to confirm, and nothing is deleted until you open it.
Note
If you are not satisfied
Tell us first, in writing, so we can fix it. If our answer does not resolve your concern, you can complain to the Office of the Privacy Commissioner of Canada. You do not need our permission, and we will not stop dealing with you because you did.
Jurisdiction and security
Where information goes, and how it is protected
International transfer and jurisdiction
We prefer Canadian-hosted services and choose them where they meet the need. Some information leaves Canada. Common business software (email, spam filtering, content delivery, support tooling) may process or transit data outside Canada. A provider may be subject to the laws of the country where it or its parent operates, including lawful access requests.
If a client requires Canadian residency or specific jurisdictional terms for engagement data, we settle them in the contract before work starts.
Security
We protect what this site holds: a modest volume of business contact information. Data travels over TLS and sits encrypted in our providers’ platforms. Every account is unique and uses multi-factor authentication. Access is least-privilege, and we remove it as soon as someone no longer needs it. We claim no certification we do not hold.
If you find a vulnerability, report it to info@whiteglovelabs.ai or via /.well-known/security.txt. If a breach of personal information creates a real risk of significant harm, we notify affected individuals and the Privacy Commissioner, as PIPEDA requires.
Source
Last updated 21 October 2026. Any material change appears here under a new date, and we never edit this page silently. Privacy officer: Alexander Leslie, WhiteGlove Labs AI Ltd., info@whiteglovelabs.ai. Related pages: opt out and delete my data, terms of use, accessibility. To ask a question before you send anything, use the contact page.