Privacy policy

1. Who we are

Mimlet Operations is a trade name of Mimlet Consulting Ltd. ("Mimlet", "we", "us"), based in Vancouver, British Columbia, Canada. This policy covers the website at mimlet.com, our client portal (Mimlet Portal, at mimlet.com/portal), and the services we provide to clients.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), and Canada's Anti-Spam Legislation (CASL) for email.

2. Privacy contact

Our founder, Gordon, is responsible for how we handle personal information. For any question, request or complaint, email gordon@mimlet.com with "Privacy" in the subject line.

3. What we collect

• Proposal request form: your name, email, business name and type, what you'd like your system to handle, team size, volume of events, jobs or orders, city, website, the tools you use, your timeline, your description of the problem and, if you choose, your phone number.
• Systems scorecard: your answers are scored in your own browser and are not sent to us unless you press "Send my results". If you do, we receive your answers, score, name, email and business name.
• How you found us: if you reached our site through one of our own tagged links (such as a link ending in ?src=linkedin) or from a link on another website, a form you send includes that tag or that website's name (never the page you were on).
• Newsletter sign-up: if you tick the newsletter box on a form, we keep the exact wording you agreed to and send you an email to confirm it was you. You're only added once you press the button in that email, and we record when you did.
• Client portal: for each person with a login, their name, email address and an encrypted password, plus the project information, messages, approvals, support tickets and files (such as screenshots) they add. When an agreement is viewed or signed in the portal, we record who, when, and their IP address and browser. Signing also records a fingerprint of the exact text, as evidence of the signature. Choosing an option on a proposal, or saying not right now, is recorded the same way: who, when, their IP address and browser, and a fingerprint of the option's text.
• Signing in with Microsoft or Google: if you choose this, Google shares your name, email address, a link to your profile picture and your Google account ID, and Microsoft shares your email address and a Microsoft account ID, so we can match you to your portal login. We don't receive your password or any access to your mailbox, contacts or files. Section 5 explains how we handle information from Google.
• Contacts and email records: we keep one contact list of the people we deal with: people who send us a form, clients, portal users, and business contacts from our own address book. For each contact we keep their name, email, business and phone number if we have them, a record of any consent (what was agreed, when and how), which of our emails they've chosen to get, and a log of the emails our systems sent them (date, subject, and whether it was delivered, blocked or bounced). We don't track whether you open our emails or click their links.
• Client engagements: business information you share with us to deliver our services, such as processes, performance numbers, documents and meeting notes.
• Email and calls: what you send us when you write or speak to us.
• Replies to portal emails: if you reply to an email from the client portal, we receive your reply and post its new text, and any images, PDFs or short videos attached, in the portal, on the ticket or with your messages. We keep a record of each email received (who sent it, the subject, the new text and what happened to it), and the original email itself briefly, to check it and handle problems.
• Technical data: our hosting provider automatically processes standard technical information such as IP address and browser type to deliver and secure the website. When you send a form, we use your connection's IP address to limit how many forms one connection can send, which keeps out spam. We keep only a scrambled version of it, mixed with a value that changes every day, and delete it after a day. We don't use analytics, advertising or tracking cookies.

4. How we use it

• To reply to your enquiry, prepare your proposal and follow up on it
• To deliver our services and run the client portal
• To invoice and keep business records
• To keep our website and systems secure
• To learn which of our channels (such as email, LinkedIn or print) bring enquiries
• To send the emails that go with your enquiry or account: a thank-you when you send a form, follow-ups about your enquiry for up to six months after it, and portal notifications if you're a client
• To send occasional notes on operations, only if you've ticked the box and confirmed it from our email

We don't sell, rent or trade personal information, and we don't use it for advertising.

5. Mimlet Portal and Google sign-in

Mimlet Portal, our client portal, lets people who have a portal login sign in with their Google account. This section explains what Mimlet Portal receives from Google and what we do with it.

• What we receive: when you choose Sign in with Google, Google shares your name, email address, whether Google has verified that email address, a link to your Google profile picture and your Google account ID. We ask Google only for this basic profile information. We don't receive your Google password, and Mimlet Portal has no access to your Gmail, contacts, calendar, Drive files or any other information in your Google account.
• How we use it: only to confirm who you are, match you to the portal login we created for you, and keep you signed in. Signing in with Google never creates a new login. We don't use it for advertising, we don't sell it, and we don't use it to develop, improve or train artificial intelligence or machine learning models.
• Sharing: we don't share it with anyone, except the provider that hosts the portal's sign-in system and database for us in Canada, which handles it only on our instructions, or where the law requires it.
• Storage and protection: it's stored with your portal login in the portal's database in Canada, encrypted in transit and at rest. Access is limited to the Mimlet staff who run the portal.
• Keeping and deleting it: we keep it while you have a portal login and delete it when your login is removed. You can ask us to delete it at any time by emailing gordon@mimlet.com. You can also remove Mimlet Portal's access to your Google account at any time from your Google Account's connections page (myaccount.google.com/connections).

Mimlet Portal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Consent

By sending us a form or using the portal, you consent to us using your information for the purposes above. Marketing email is opt-in: the newsletter box on our forms is never pre-ticked, and ticking it only counts once you confirm from the email we send you. Business contacts from our address book don't get newsletters or other automated email from us unless they've agreed to it.

Every email our systems send (enquiry follow-ups, portal notifications and newsletters) identifies us, includes our mailing address and an unsubscribe link, and links to a page where you can choose which emails you get. Unsubscribing through those links takes effect straight away, and we act on unsubscribe requests sent by email within 10 business days. Sign-in emails, such as a password reset or a sign-in link, are only sent when you ask for one. You can withdraw consent at any time, subject to legal or contractual limits.

7. Data we handle for clients

When we build or operate software for a client, that system may hold personal information about the client's own customers, such as names, contact details, bookings, orders and payment records. In that role we act on the client's behalf: the client decides what is collected and why, and we handle it only to build, host, support and maintain their system, under our agreement with them. Questions about that information should go to the business you dealt with, and we'll help them respond.

Card payments in client systems are handled by a third-party payment processor. Card numbers are entered directly with the processor and are not stored in our databases.

8. Service providers and where data is stored

We use trusted service providers to run our business and the systems we build, in these categories:

• Cloud hosting and databases, including the database behind the client portal and website forms
• Website delivery and security
• Email, file storage and productivity tools
• Email delivery and notifications (the emails our systems send go out from Canada)
• Sign-in with Microsoft or Google, if you choose to use it
• Payment processing, where a client system takes payments

Providers process personal information only on our instructions, for the purposes in this policy, under contracts that require them to protect it. The providers used for a client's own system are agreed with that client.

We store data in Canada wherever a Canadian option is available, and the client portal and website forms are stored in Canada. Some providers may process information outside Canada, including in the United States, where it may be accessible to courts and authorities under local law. You can ask us for the current list of providers that handle your information.

9. How long we keep it

• Enquiries and scorecard results: up to two years after our last contact, unless you become a client.
• Client records: for the length of the engagement, then as long as needed for legal, tax and accounting purposes (generally six years in Canada).
• Portal accounts: removed when a client relationship ends, unless the client asks us to keep access open.
• Consent records and the email log: for as long as we keep your contact details, then only as long as needed to show what you agreed to and when.
• Unsubscribes: if you unsubscribe from everything, we keep your email address on a do-not-email list so our systems never email you again.
• Form spam checks: the scrambled connection address is deleted after a day.
• Microsoft and Google sign-in details: kept while you have a portal login, and deleted when it's removed.
• Replies to portal emails: the original email is deleted after 30 days, and our record of it after 90 days. What was posted stays with the ticket or message it belongs to.

When information is no longer needed, we delete or anonymize it.

10. How we protect it

Data is encrypted in transit and at rest with our providers. Portal access requires a personal login, and database rules ensure each client can only see their own business's information. Access to client information within Mimlet is limited to the people who need it to do the work. No system is perfectly secure; if a breach creates a real risk of significant harm, we'll notify affected people and the Privacy Commissioner as the law requires.

11. Your rights

You can ask to see the personal information we hold about you, correct it, or have it deleted, and ask how it has been used or shared. Email gordon@mimlet.com. We'll respond within 30 days and may need to confirm your identity first. There's no charge for a reasonable request.

If you're not satisfied with our response, you can contact the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

12. Cookies and browser storage

The public website doesn't set advertising or tracking cookies. While you browse, the website keeps the tag or website name described under "How you found us" in your browser's session storage, which is cleared when you close the tab; it's only sent to us as part of a form you choose to send. The client portal stores a sign-in token in your browser so you stay logged in; signing out removes it. The portal also keeps a copy of its own pages, code and icons in your browser, so it opens quickly and can run as an app; none of your information is kept in that copy. Our hosting provider may set a strictly necessary security cookie to protect the site from abuse.

13. Children

Our website and services are for businesses. We don't knowingly collect information from anyone under 19.

14. Changes to this policy

We'll update this page when our practices change and revise the effective date at the top. Significant changes will be communicated to clients directly.