Privacy Policy

Plain-English explanation of what Rough Works collects when you visit roughworks.ca, how we use it, and what control you have over it. We don't sell your data. We collect as little as possible to do the job.

1. Who we are

"Rough Works" (also referred to as "we," "us," or "our") is a Canadian design and engineering studio operated by Rough Works Co., located in Vancouver, British Columbia. We build websites, brand systems, and AI integrations for our own clients; we are not an advertising agency and do not run advertising on behalf of third parties.

This policy applies to roughworks.ca and any subdomains we operate. It does not apply to third-party websites we link to.

2. What we collect

Information you give us

• Contact form submissions — your name, email address, optional company name, and the contents of your message. Used solely to reply to you.
• Newsletter / subscription submissions — your email address, when you opt in.
• Project-inquiry submissions — any information you choose to provide when describing a project, including company, role, project scope, budget range, and timeline.

Information collected automatically

• Web analytics (Google Analytics 4) — pages viewed, time on page, referring site, approximate location (country / region — IP is anonymized before storage), device category (desktop/mobile/tablet), browser, and operating system. We do not enable Google Signals or cross-device user identification.
• Server logs — IP address, request time, requested URL, response code, and user agent. Held by our hosting provider for diagnostic purposes only and rotated within 30 days.
• Cookies — see Section 4.

What we do not collect

• We do not collect sensitive personal information (financial, health, government identifiers).
• We do not collect data from anyone under the age of 16.
• We do not use session replay, heatmaps, or any tool that captures keystrokes, mouse trails, or screen recordings.

3. How we use information

• Respond to your inquiries — answer your questions, send you a proposal, schedule a call.
• Send you newsletters and updates — only if you opt in, and you can unsubscribe from every message.
• Measure site performance — understand which pages are visited and what visitors do, in aggregate.
• Measure advertising performance — when we run paid campaigns on Google, LinkedIn, or Reddit, we use first-party conversion tracking and platform pixels to attribute conversions back to specific ad sources. This is limited to ads we run for Rough Works directly.
• Improve our services — identify broken pages, slow-loading content, and gaps in what we offer.
• Comply with legal obligations — respond to subpoenas, court orders, and lawful requests.

4. Cookies and tracking technologies

Cookies are small data files saved by your browser. We use them in three categories:

Strictly necessary

Required for the site to function (e.g., form anti-spam tokens). These cannot be disabled.

Analytics

Google Analytics 4 (GA4) with IP anonymization enabled. GA4 sets cookies starting with _ga and uses them to count unique visitors and analyze site traffic patterns. We have not enabled Google Signals (cross-device tracking) or the Demographics & Interests features.

Advertising

When we run paid campaigns (Phase 2 of our marketing program), the following pixels and cookies may be present on roughworks.ca:

• Google Ads conversion tracking + Google tag (gtag.js) — measures whether visitors who clicked our Google Ads complete a form submission.
• LinkedIn Insight Tag — measures whether visitors who clicked our LinkedIn ads complete a form submission, and enables remarketing audiences.
• Reddit Pixel — same role for Reddit-sourced visitors.

These tags fire only after page load. We do not use them to collect data we couldn't already see through GA4; their purpose is attribution and remarketing.

How to control cookies

Most browsers let you block all cookies, block third-party cookies only, or delete cookies after each session. Blocking analytics or advertising cookies will not prevent you from using roughworks.ca, but may reduce the relevance of ads you see from us elsewhere on the web. Useful links:

• Opt out of Google Analytics for all sites: tools.google.com/dlpage/gaoptout
• Manage Google Ads personalization: adssettings.google.com
• Manage LinkedIn ad preferences: linkedin.com/psettings/advertising

5. Third-party services that process your data

To run the site we rely on a small set of vendors. Each is contractually bound by their own privacy commitments. We share the minimum information necessary for them to perform their role.

• WP Engine, Inc. (United States) — website hosting.
• Cloudflare, Inc. (United States) — DNS, CDN, and traffic-edge security.
• Google LLC (United States) — Google Analytics, Google Ads.
• LinkedIn Corporation (United States) — LinkedIn Ads (when active).
• Reddit, Inc. (United States) — Reddit Ads (when active).
• Web3Forms (Germany) — receives contact-form submissions and forwards them to our email inbox.
• Anthropic PBC (United States) — provides AI assistance we use internally for editorial summaries of our own analytics data; no visitor or customer personal information is sent to Anthropic.

6. How we share information

We do not sell, rent, or trade personal information. We share information only:

• With the vendors listed in Section 5, strictly to operate the site.
• When required by law, court order, or to respond to lawful requests by Canadian public authorities.
• If we are acquired or merge with another organization, in which case personal information may be transferred as part of that transaction. We would notify you before any such transfer.

7. International data transfers

We are based in Canada (PIPEDA jurisdiction). Several of our vendors operate primarily in the United States; this means your personal information may be transferred to, stored in, or processed in the United States. We rely on the vendors' published transfer mechanisms (Standard Contractual Clauses, certifications under the EU–U.S. Data Privacy Framework where applicable, or equivalent safeguards) for any cross-border transfer of EU/UK personal data.

8. How long we keep information

• Contact and inquiry submissions: retained for up to 24 months in our email inbox unless you ask us to delete them sooner.
• Newsletter subscriptions: retained until you unsubscribe.
• Server logs: rotated within 30 days.
• GA4 analytics data: retained per our GA4 property settings (currently 14 months for event data).
• Advertising-platform pixel data: retained per each platform's own policy; we do not export this data into our own systems.

9. Your rights

Canadian residents (PIPEDA)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) you have the right to:

• Know what personal information we hold about you.
• Request correction of inaccurate information.
• Withdraw consent at any time (subject to legal or contractual restrictions).
• File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you believe we have mishandled your data.

EU / EEA / UK residents (GDPR / UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Request rectification of inaccurate data, or erasure ("right to be forgotten").
• Restrict or object to our processing.
• Data portability (receive your data in a machine-readable format).
• Lodge a complaint with your local supervisory authority.

The legal basis for our processing is (a) your consent, when you submit a form or opt into the newsletter; (b) our legitimate interest in measuring and improving site performance.

California residents (CCPA / CPRA)

You have the right to:

• Know what categories of personal information we have collected.
• Request deletion of that information.
• Opt out of any "sale" or "sharing" of personal information — though as noted above, we do not sell or share for cross-context behavioral advertising in CCPA's sense.
• Be free from discrimination for exercising any of these rights.

How to exercise any of these rights

Email [email protected] with the subject line "Privacy Request" and tell us what you'd like. We aim to respond within 30 days. We may need to verify your identity before disclosing or deleting data.

10. Children's privacy

Rough Works is a business-to-business studio. Our services are not directed at children under 16, and we do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it.

11. Security

We use HTTPS for all site traffic, store contact-form submissions in vendor-encrypted systems, and limit internal access to the email inbox to the studio principal. Despite these measures, no transmission over the internet is 100% secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy as our tools or legal obligations change. The "Last updated" date at the top of this page will reflect the most recent revision. Material changes will be announced on the site for at least 30 days before taking effect.

13. Contact us

If you have questions about this policy or about how Rough Works handles your data: