Privacy Policy - MapleMark Media Inc.

Effective date: November 7, 2026

1. Who we are

MapleMark Media Inc. ("MapleMark", "we", "us") is a federal Canadian corporation incorporated on 10 June 2024, with its registered office in Mississauga, Ontario. We provide strategic communications services to campaigns, advocacy organizations, public affairs firms, and professional services firms in Canada and the United States.

This policy explains how we collect, use, and protect personal information through our website at maplemarkmedia.com and through MapleMark ClientOS, our client analytics workspace at staff.maplemarkmedia.com and clients.maplemarkmedia.com (together, the "Services").

2. Information we collect

Account information

When we create a ClientOS sign-in for a staff member or client, we store a username, a display name, and a role (staff or client). Passwords are never stored in plain text: they are hashed with the scrypt algorithm with a per-user random salt.

Connected-service analytics

ClientOS lets a workspace connect its own analytics accounts so performance appears in one dashboard. With the account holder's authorization, we sync and store metrics such as sessions, users, page performance, search clicks, impressions, and video analytics. Connections currently supported or being configured use read-only access:

Connection tokens are stored encrypted (Fernet, AES-128-CBC with HMAC-SHA256). Analytics connections use read-only access to sync the workspace's own metrics. Separate official publishing connections, where enabled and authorized, can send content to the selected LinkedIn, Facebook Page, Instagram, YouTube, TikTok or Threads account. Availability depends on each provider's permissions, account eligibility and app approval. An authorized staff member selects the destination, reviews the exact content and publishing options, and explicitly approves each post, including any scheduled time. Connecting an account or generating an AI recommendation does not authorize a post.

Public mentions

We collect publicly available mentions of a workspace's brand (titles, links, publication dates, and summaries) through Google Alerts feeds, so the dashboard can show where the brand appears online.

Retained public social data

Earlier, the platform also collected public X (Twitter) posts and public profile counters for the MapleMark brand through an unofficial public feed. That collection is switched off, and the public records already collected remain stored with the workspace history.

Content and media uploads

Staff may upload draft text, images, and video to prepare client content. Uploads are stored on our servers and scoped to their workspace. When a staff member approves a post, its content, media and chosen publishing options are sent to the selected platform through its official API. Media may be made available to that platform through a time-limited link. No upload or draft is published merely because it is stored.

Sign-in and session data

When someone signs in, we create a server-side session that expires after 12 hours. The browser holds only an opaque session cookie (HttpOnly, host-only, no cross-site tracking). ClientOS itself does not use advertising or third-party analytics cookies.

Website analytics

maplemarkmedia.com uses Google Analytics and Cloudflare analytics to understand aggregate site traffic. These services may set their own cookies under their own privacy policies.

3. How we use information

We do not sell personal information, and we do not use client workspace data to train AI models.

4. AI-assisted review

ClientOS can generate draft growth recommendations using Cloudflare Workers AI. Today this runs only for MapleMark's own workspace, and the only data sent to Cloudflare for this purpose is that workspace's stored metrics and its public mentions, bundled with source status. Client workspace data is not sent to any AI provider without that client's consent.

Cloudflare's current published documentation for the model we use (@cf/meta/llama-3.3-70b-instruct-fp8-fast) states that standard inference carries zero data retention, meaning inputs and outputs are not retained after the response is delivered, and that customer content is not used to train AI models. We do not enable any Cloudflare logging, caching, or stateful features that would store content. Cloudflare may retain operational metadata (such as request sizes and timestamps), which excludes the content itself.

AI output is validated by our software and reviewed by a person before anything is acted on; no AI recommendation is published automatically.

5. Who processes data for us

Each provider handles data under its own terms and privacy policy. Because several of these providers operate outside Canada, information may be processed in other countries, including the United States, where it may be subject to local law.

6. How we protect information

No method of storage or transmission is perfectly secure, but we maintain these safeguards and review them as the platform evolves.

7. How long we keep information

Current practice: the platform keeps workspace history, including synced metrics, uploaded drafts, and previously collected public data, so trends and history remain available. Platform backups are also retained. There is no automatic deletion or backup-expiry schedule today; setting a formal retention schedule is an open decision for MapleMark.

You can ask us to delete your workspace data at any time through the contact address below. Because backups are retained, removal from backups is handled as part of the request and is not immediate.

8. Your choices and rights

Under Canadian privacy law (PIPEDA), you have the right to ask whether we hold personal information about you, to access it at minimal or no cost, and to challenge its accuracy and have it corrected as appropriate, subject to the exceptions the law sets out. You can:

PIPEDA requires a response to an access or correction request within 30 calendar days, with limited extensions the law itself permits; if an extension ever applies, we will tell you within the first 30 days and explain why, as the law requires. There is currently no self-serve export or account-deletion button; requests are handled directly. You also have the right to complain to the Office of the Privacy Commissioner of Canada.

9. Changes and contact

If we change this policy, we will post the updated version at the same address and update the effective date.

Questions or requests about this policy: [email protected], or MapleMark Media Inc., Mississauga, Ontario, Canada.