Privacy,
explained clearly.

Scope & accountability

Who this policy covers

Script Orbit (also referred to as “ScriptOrbit,” “we,” “us,” or “our”) is a Toronto, Ontario digital design and development company. This policy applies to personal information under our control when you visit scriptorbit.com, contact us, book a consultation, apply for a role, become a prospective or current client, or otherwise interact with our services.

We are accountable for personal information under our control and handle it in accordance with Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other applicable privacy laws. Our Privacy Lead is responsible for questions, requests, and concerns about these practices.

This policy does not govern a client’s website, product, or database that we may build or support. In those situations, the client generally determines why personal information is processed and its own privacy notice applies.

Information we collect

Only what is relevant to the interaction

How we use information

Defined business purposes

We may use personal information to:

• respond to enquiries and communicate about a requested service;
• schedule consultations and import booking details into our internal lead tracker;
• qualify opportunities, prepare proposals, deliver projects, provide support, and manage client relationships;
• record activities, follow-ups, discovery insights, referrals, and outcomes in our internal CRM;
• associate an enquiry with its landing page and campaign source, measure which channels produce genuine opportunities, and avoid relying only on optional analytics cookies;
• review job applications and communicate with candidates;
• authenticate authorized internal users and protect our systems, website, and business;
• understand website performance and improve content when analytics consent is provided;
• maintain business records, enforce agreements, and meet legal, tax, accounting, or regulatory obligations; and
• investigate misuse, fraud, security events, or other activity that may threaten Script Orbit, our clients, or others.

We will not use personal information for a materially different purpose without obtaining any consent required by law.

Consent

Meaningful choices, appropriate to context

We seek meaningful consent where required. Consent may be express—for example, when you choose optional analytics cookies—or implied from the context, such as when you send a message and reasonably expect us to respond. We limit required collection to information reasonably necessary for the stated purpose.

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawal may mean we cannot continue an optional activity or provide a requested service that depends on the information. We will explain relevant consequences when they are not obvious.

Cookies & analytics

Essential by default. Optional by choice.

Cookies are small files stored by your browser. Script Orbit uses essential cookies for security, session management, CSRF protection, and remembering your privacy preference. These are necessary for the site to operate and cannot be switched off through our banner.

With your permission, we use Google Analytics 4 to understand aggregate site usage. Its default implementation may process a random client identifier, browser and device information, approximate geography, session statistics, page URLs, page titles, and on-site activity. Script Orbit does not intentionally send names, email addresses, phone numbers, form contents, or other directly identifying information to Google Analytics.

Analytics is not loaded by this website unless your saved preference allows it. We do not currently deploy advertising or marketing cookies on this site. If that changes, those technologies will remain optional and this policy and our controls will be updated.

Sharing & service providers

We do not sell personal information

We do not sell or rent personal information. We may disclose it only as reasonably necessary to:

• Service providers: hosting, infrastructure, database, backup, security, email, analytics, scheduling, and other suppliers that support our operations. This includes Google for Calendar bookings and, with consent, Google Analytics.
• Professional advisers: legal, accounting, insurance, and other advisers where access is necessary for their work.
• Legal and safety purposes: authorities or other parties where required by law, legal process, or where reasonably necessary to protect rights, security, and safety.
• Business changes: a prospective purchaser, successor, or adviser involved in a financing, reorganization, merger, sale, or transfer, subject to appropriate confidentiality and legal requirements.
• With your direction: another party when you ask us to share information or separately consent.

We expect providers to use personal information only for authorized purposes and to apply safeguards appropriate to its sensitivity.

International processing

Some providers operate outside Canada

Script Orbit is based in Canada, but some service providers—including Google—may process or store information in Canada, the United States, or other jurisdictions. When information is processed outside your province or country, it may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement, or national-security authorities in accordance with local law.

We remain accountable for personal information under our control and use contractual, technical, and organizational measures appropriate to the circumstances.

Retention

Kept only as long as reasonably needed

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including to manage an active or potential business relationship, consider an application, provide services, maintain appropriate business and financial records, resolve disputes, enforce agreements, meet legal obligations, and protect security.

Retention periods vary according to the record’s purpose, sensitivity, legal requirements, and whether information is needed to establish or defend a claim. As operational defaults, anti-abuse fingerprints are retained for 7 days, suspected spam for 90 days, job applications for 365 days, and unconverted enquiries for up to 730 days. Records connected to a client engagement, accounting requirement, dispute, or legal hold may be retained for the applicable longer period. When information is no longer required, we delete, securely destroy, or anonymize it. Residual copies may remain temporarily in protected backups until they cycle out.

Security & incidents

Safeguards matched to sensitivity

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. Depending on the system, these include HTTPS in transit, authentication, role-based access, restricted administrative tools, CSRF protection, secure session settings, backups, logging, and limiting access to people who require it for their work.

No system is completely secure, and we cannot guarantee absolute security. If a privacy or security incident occurs, we will investigate, take appropriate containment and remediation steps, and notify affected individuals and regulators where required by applicable law.

Your rights & choices

Access, correction, consent, and complaints

Subject to applicable law and limited exceptions, you may:

• ask whether we hold personal information about you and request access to it;
• ask us to correct inaccurate or incomplete information;
• withdraw consent to optional collection, use, or disclosure;
• ask us to delete information that is no longer required, subject to legal and operational retention needs;
• change optional cookie choices using the control in this policy; and
• raise a question or complaint about our privacy practices.

To protect you, we may need to verify identity before acting on an access or correction request. We will respond within the timeframe required by applicable law. If we cannot fulfil all or part of a request, we will explain why, unless the law prevents us from doing so.

If you receive a commercial email from us, you may use its unsubscribe mechanism or contact us. Transactional or service communications may continue where necessary for an active relationship.

Children & third-party sites

Boundaries of this policy

Children

Our website and services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13 through this website. If you believe a child has provided it, please contact us so we can review and take appropriate action.

Third-party websites

Our site links to third-party websites, portfolios, social networks, and Google booking pages. Their privacy practices are controlled by their operators, not Script Orbit. Review the privacy notice of a third-party service before providing information to it.

Changes to this policy

We may update this policy to reflect changes to our services, technology, providers, or legal obligations. We will post the revised version here and update the “Last updated” date. If a change materially affects how we use information already collected, we will provide additional notice or seek consent where required.