Privacy Policy

Last updated: 27 Sep 2026

Entoura.Studio is operated by Entoura Brands, a company registered in British Columbia, Canada (referred to here as "we," "us," or "Entoura"). This page explains what data we collect, why, and what we do with it. If something here doesn't make sense, email hello@entoura.studio and we'll explain it in plain language.

Which law applies. Two privacy statutes cover this business, and which one applies depends on where the activity happens. British Columbia's Personal Information Protection Act (PIPA) covers the information we collect, use and disclose within British Columbia. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) covers the rest: clients in other provinces, and any information that crosses a border, including everything that goes to a service provider outside Canada. Your rights are substantially the same under both, and they are set out below.

Who is accountable

One person is accountable for privacy at Entoura, and BC PIPA requires us to publish who that is rather than wait to be asked.

Privacy Officer: Carter Nolan, Principal, Entoura Brands
Email: privacy@entoura.studio
Phone: 250 465 2892
Mail: Entoura Brands, Comox, British Columbia, Canada

Access requests, corrections, deletions, withdrawn consent and complaints all go to that address, and a person reads it. We respond within 30 days.

What we collect

When you contact us. If you fill out a form on this site, send us an email, or book a call, you give us your name, your email, and whatever you tell us about your business. We need that to reply. A successful form submit or booked call also sends a conversion event to Google Ads and Meta so we can measure advertising. Email may be hashed before it is sent.

When you subscribe to Field Notes. If you join the article digest on Resources or in the site footer, you give us your email and explicit consent to receive one weekly email summarising new articles. We log that consent in our database with a timestamp, the consent text you agreed to, where you signed up (footer or resources page), and your IP address and browser type. That IP address is kept deliberately, because it is the audit record Canadian anti-spam law (CASL) expects us to hold to prove you consented. Delivery runs through Resend. Unsubscribe links in every email stop future messages. To withdraw consent or delete your record, email privacy@entoura.studio.

When you request the AI guide. You give us your email and consent to receive the guide and follow-up notes. Your email is stored in Canada. Delivery runs through Resend (United States). Unsubscribe links in every email stop future messages. To withdraw consent or delete your record, email privacy@entoura.studio.

When you visit the site. First-party analytics counts page visits and which pages get read. Your browser sends those requests only to entoura.studio, and the anonymous measurement data is currently forwarded to PostHog in the United States while our Canadian analytics server is being set up. See Analytics and advertising below for the detail and the opt-out. Paid campaigns also load three advertising tags, Google Ads, the Meta Pixel, and the LinkedIn Insight Tag, so we can tell which ads led to a call or a form, and so we can show a follow-up ad to someone who already visited. Those tags are run by Google, Meta, and LinkedIn in the United States, and they can associate this visit with other sites and apps that use the same tools. We do not sell that data. You can turn analytics and the advertising tags off at any time. See Analytics and advertising below.

Why we collect it

To respond to you, to talk through your project, to do the work if you hire us, to bill you for it, and to measure whether paid ads led to a conversation.

Where it lives

Our own database runs in Canada, in Montreal, so the records we hold about you rest under Canadian privacy law. Several specific features depend on service providers outside Canada, and each one is named below with the country it runs in. Payments are the largest of those, and they have their own section.

When you pay us

Card payments are processed by Stripe. Your card details go directly to Stripe on a page Stripe hosts, and they never reach our servers, so we hold no card numbers at any point. What we hold against your record is a Stripe customer reference, a session and payment reference, your billing name and business address, the amount, and the last four digits and brand of the card as they appear on your receipt. We need those to issue your invoice, to answer a question about a charge, and to defend a payment dispute.

Your payment information is processed and stored outside Canada, in the United States. As a result it may be subject to disclosure as the law of that country requires, including to United States courts, law enforcement and national security authorities, without notice to you or to us. That is the consequence of using a payment processor based there, and we are telling you plainly rather than burying it.

Stripe acts in two capacities, and the distinction matters. For handling your payment and servicing our account, Stripe is our service provider and acts on our instructions. For its own fraud prevention, legal compliance and product purposes, Stripe decides for itself what it does with the data. Stripe's own privacy policy and sub-processor list govern that second capacity, and we have no control over it.

If you would rather not pay by card, invoiced amounts can be paid by e-transfer or direct deposit, and nothing about your payment then leaves Canada except what your own bank does. Ask us at hello@entoura.studio. What we charge, when, and how refunds and cancellation work is set out at Payment Terms.

When you sign a proposal

Proposals are delivered as a private, token-gated link. When you open one, we record that it was viewed, with the IP address and browser that opened it. When you sign one, we record your name, email, company, title and city, together with the IP address, the browser, the timestamp, and the exact version of the terms displayed on your screen at that moment.

That record is kept deliberately and for a long time. It is the evidence that an agreement was formed and what it said, which is what makes an electronic signature hold up under British Columbia's Electronic Transactions Act, and it is what we would file if a payment were ever disputed. We keep it for the life of the engagement and for seven years after, which is the period tax and limitation rules make relevant.

When you chat with our AI concierge

Some pages offer an AI concierge ("Entoura") you can talk to. If you use it, we store the content of your conversation along with any name and email you give us, so we can answer you and, if you want, book a call. Conversation text is used to respond, qualify the fit, and schedule a call. It is not sold and it is not sent to Google or Meta as ad creative. The page itself still loads the advertising tags named below unless you have opted out.

The conversation and your contact details are stored in Canada. Your IP address is stored as a salted one-way hash rather than as an address. Three parts of the concierge involve service providers outside Canada: the AI model that generates replies (Anthropic, United States), the email that notifies us of your message or booking (Resend, United States), and the calendar that holds your booking (Cal.com, United States). These providers process the minimum needed to do their job, under their own privacy terms and contractual safeguards. We keep the model configured so it does not retain your conversation after it answers. If you would rather not use the concierge, every page also has a direct booking link and our email address.

When you use the AI Opportunity Assessment

The assessment asks about how your business runs and where it loses time, then emails you a report. We store your answers, the report, and the contact details you give us (name, email, business name, and phone if you provide it), so we can produce the report, send it, and follow up. If you submit an email or book a call, we also send a conversion event to Google Ads and Meta so we can measure advertising. Email may be hashed before it is sent. Your report and answers are not sold and are not used as an ad audience.

Your answers and report are stored in Canada. Two parts of the assessment run on providers outside Canada: the AI that reads your answers, scores them, and writes the report (Anthropic, United States), and the email that delivers the report and holds our contact list (Resend, United States). These providers process the minimum needed to do their job, under their own privacy terms and contractual safeguards. Every page also has a direct booking link and our email address if you would rather reach us that way.

When we talk on a call

Discovery and project calls may be recorded and transcribed so we can scope the work accurately and refer back to what you told us rather than trusting memory. Where a call is recorded, we say so at the start of it, and you can ask us to stop and we will. Transcripts, summaries and our analysis of them are stored in Canada against your record, and they are used to do your work and nothing else. They are not sold, not used to train a public model, and not shared outside Entoura. Ask us to delete a transcript at privacy@entoura.studio and we will.

Partners, referrals and payouts

If you apply to the partner programme, you give us your name, email, company, phone, website, a description of your audience, and how you heard about us. Approved partners also give us the details we need to pay a commission, which are a legal name, a mailing address, and the payout destination you choose (an e-transfer email address or direct deposit details). We hold those to pay you and to meet our tax obligations, and for no other purpose.

If a partner refers someone to us, we receive that person's business name, contact name, email and phone, on the partner's confirmation that they had permission to share it. If you were referred to us and you would rather we did not hold your details, email privacy@entoura.studio and we will delete them and record that you should not be contacted again. You do not need to explain why.

Research we do before we contact you

Before we approach a business, we research it: the company, what it appears to do, publicly listed owner or manager names, a business mailing address, our notes on whether we can help, and our own scoring of the fit. That research is collected from public sources and from conversations, it is stored in Canada, and some of it is used to address a piece of direct mail.

If we have contacted you and you want to see what we hold, or want it deleted and your business added to our do-not-contact list, email privacy@entoura.studio. We will confirm in writing.

How long we keep it, and what is automated

We are describing what actually happens here rather than what we intend to build, because a retention promise is worth nothing if no mechanism enforces it.

Deletion on request is immediate and manual, and it is the route that always works. Email privacy@entoura.studio and we delete your records and confirm within 30 days. That applies to everything on this page.

Our current retention practice, by record type:

  • Enquiries that lead nowhere. Reviewed and deleted periodically, by hand, and in any event within 12 months of the last contact.
  • Assessment sessions that never reached the email step. Held with no name or email attached, and deleted in periodic manual reviews.
  • Concierge conversations. Kept as long as needed to follow up, and deleted in periodic manual reviews within 12 months where they led nowhere.
  • Consent records for Field Notes, the guide and the assessment. Kept for as long as you are subscribed and for 3 years after you unsubscribe, because that is the audit trail CASL expects.
  • Signed proposals, agreements, invoices and payment records. Kept for the life of the engagement and 7 years after, for tax, limitation and warranty reasons. These are the records we cannot delete on request while that period runs, and we will tell you so if you ask.
  • Active client and project records. Kept while the engagement runs and for a reasonable period after.

We are building scheduled deletion for the first three of those. Until it is running and verified, the manual review above is the practice, and this page will say so. When it changes we will update this section and the date at the top.

Who we share it with

Almost no one. The exceptions:

  • Stripe, Inc. and Stripe, LLC, for payment processing, invoicing and payment dispute handling. Processed in the United States. See Stripe's privacy policy.
  • Supabase, for the database that holds our records, in the Canadian region (Montreal).
  • Vercel, for hosting and serving this website, in the Canadian region (Montreal).
  • Resend, for sending email and holding our mailing lists. Processed in the United States.
  • Anthropic, for the AI that powers the concierge and writes the assessment report. Processed in the United States.
  • Cal.com, for call bookings. Processed in the United States.
  • PostHog, Inc., for the anonymous page-view analytics described below. Currently processed in the United States. See PostHog's privacy policy.
  • Google LLC, for Google Tag Manager (tag delivery), Google Ads conversion measurement, and remarketing. Processed in the United States. See Google's privacy policy.
  • Meta Platforms, for the Meta Pixel and Conversions API (conversion measurement and remarketing). Processed in the United States. See Meta's privacy policy.
  • LinkedIn Corporation, for the LinkedIn Insight Tag (conversion measurement and remarketing). Processed in the United States. See LinkedIn's privacy policy.
  • Functional Software, Inc. (Sentry), for error monitoring and session replay. Processed in Germany, in the European Union. See Sentry's privacy policy.
  • Our accountant and, where a matter requires it, our lawyer, both under professional obligations of confidence.
  • Where we have a legal obligation to disclose (a court order, for example).

We do not sell or rent your data. Sending information to a service provider so it can do a job for us is a use of that information, not a sale of it, and we stay accountable for it while they hold it. Where a provider is outside Canada, we use contractual terms to hold them to a comparable level of protection, and the law of their country may still reach the data despite those terms.

Your rights

Under BC PIPA and PIPEDA you can:

  • Ask what personal information we hold about you, and get a copy
  • Ask us how we have used it and who we have given it to
  • Ask us to correct anything that is wrong
  • Ask us to delete it
  • Withdraw your consent at any time, for anything you consented to
  • Complain, and have the complaint answered by a named person

Email privacy@entoura.studio for any of these. We respond within 30 days. Where we decline part of a request, we will tell you why and which records are affected. The main case for declining is the tax and limitation retention above.

If you are not satisfied with how we handle a privacy concern, you can take it further. For matters under BC PIPA, the Office of the Information and Privacy Commissioner for British Columbia. For matters under PIPEDA, the Office of the Privacy Commissioner of Canada. You can go to either without going through us first.

If something goes wrong

We keep a record of every breach of our security safeguards, whether or not it is serious enough to report, and we keep those records for at least 24 months. Where a breach creates a real risk of significant harm to you, we report it to the Privacy Commissioner of Canada and tell you directly, as soon as feasible after we work out what happened. We also tell any other organisation that can help reduce the risk to you. Telling you is not conditional on the Commissioner asking us to.

Analytics and advertising

We run first-party analytics (PostHog) to count visits and understand which pages get read. Your browser talks only to entoura.studio, which is served from a Canadian region, and that server forwards the measurement data to PostHog's cloud in the United States. We are standing up our own analytics server in Canada and will update this page when the data stops leaving the country. In the meantime this stream carries anonymous page-view data only: your name, email, and anything you type into a form, the concierge, or the assessment are deliberately kept out of it. It is not sold and it is not sent to Google or Meta.

The Google Ads tag measures conversions (including booked calls and assessment leads) and can build a remarketing list of site visitors, so a follow-up ad can appear on Google, YouTube, and partner sites. The Meta Pixel and Conversions API do the same for ads on Meta properties. The LinkedIn Insight Tag does the same for ads on LinkedIn. All three are processed in the United States. They set cookies (including _gcl_*, _fbp, _fbc, and li_fat_id) unless you opt out.

Analytics and those three advertising tags are on by default. You can opt out below and we will not load them on future visits from this browser. If your browser sends a Global Privacy Control signal, we treat that as an opt-out automatically and you do not need to do anything.

Two things the opt-out does not currently stop, stated so you are not misled. Google Tag Manager, which delivers and manages the tags above, loads on every page before your preference is read, and it is run by Google LLC in the United States. Error monitoring and session replay, described below, also load regardless. We are changing the first of those so the opt-out covers it. Until then, opting out stops PostHog, Google Ads, the Meta Pixel and the LinkedIn tag, and leaves Google Tag Manager and Sentry running.

Separately, when you submit a form, a conversion event is sent from our server to Meta with your email as a one-way hash, your IP address and your browser. That server-side event is how we measure advertising accurately, and the browser opt-out does not suppress it. To have it stopped for you, email privacy@entoura.studio.

Your choice is stored in this browser only, so it does not follow you to another browser, another device, or a private window, and clearing your site data clears it. Booking a call through Cal.com may set cookies from Cal.com when you open the scheduler. Those are governed by Cal.com's privacy policy.

Error monitoring and session replay

When a page or a request on this site fails, a diagnostic report is sent to Sentry so we can find the fault and fix it. Sentry also records a replay of a proportion of browsing sessions, and records the session whenever an error occurs, so we can see the sequence of events that produced a fault rather than guessing at it. A replay captures the pages you moved through, what you clicked, and how the page changed. Text you type into a field is masked before it leaves your browser.

Those reports and replays are processed on Sentry's European servers in Germany, not in Canada. A report can include your IP address, your browser, the page you were on, and the technical detail of what failed. It is diagnostic data, not marketing data: it is never sold, never used to build an ad audience, and never sent to Google or Meta. If you would rather we deleted a report or a replay tied to you, email privacy@entoura.studio.

Cookies

The site uses essential cookies, the ones needed for it to work, and a first-party cookie that records your analytics choice. Unless you opt out, it also uses a first-party analytics cookie to count visits, and cookies from Google, Meta, and LinkedIn to measure ads and to show follow-up ads. Paying through Stripe sets cookies from Stripe on the Stripe-hosted checkout page, which Stripe uses for fraud prevention.

Changes to this policy

If we update this materially, we'll change the date at the top and post the new version. Substantive changes for active clients get an email.

Contact

Privacy questions, data requests, complaints: privacy@entoura.studio. Anything else: hello@entoura.studio.

Entoura Brands, Comox, British Columbia, Canada. Trade name: Entoura.Studio. Related pages: Terms, Payment Terms.