Privacy Policy

1. Who we are

KenjiFlow provides AI automation and business process services to small businesses. This website, kenjiflow.com, is operated by Nevesta Consulting Ltd., doing business as KenjiFlow ("KenjiFlow", "we", "us" or "our"), based in British Columbia, Canada.

Danny Carlson is our designated Privacy Officer, responsible for our compliance with privacy laws. You can reach us at privacy@kenjiflow.com.

2. Scope and our role

This policy applies to personal information we collect through our website, our booking and contact channels, our marketing, and our communications with prospective and current clients.

When we collect personal information about you for our own purposes, such as responding to your enquiry or marketing our services, we are the "controller" (or equivalent) of that information. When we build or run automations for a client, we may process personal information from the client's own customers or staff on the client's behalf. In that case the client decides why and how the information is used, we act as a "processor" or "service provider", and our client agreement governs that processing. If you are the customer of one of our clients, please contact that client about your information.

3. Information we collect

Information you give us

Contact and booking details. Name, email address, phone number, company, role and the details you enter when you book a call or contact us.
Enquiry content. Information about your business, processes and tools that you share with us before or during a consultation, by email, message or call.
Client and billing details. Business contact details, billing information and project information, if you become a client.
Communications. Records of emails, messages, call notes and, where permitted and with notice, call recordings or transcripts.

Information we collect automatically

Device and usage data. IP address, browser type, device type, operating system, language, pages viewed, links clicked, referring page, date and time, and approximate location derived from your IP address.
Cookie and pixel data. Identifiers and event data collected by cookies, pixels and similar technologies, as described in sections 4 and 6.

Information from other sources

Advertising and lead forms. Details you submit through lead forms on advertising platforms such as Meta, Google, LinkedIn or TikTok.
Scheduling and communication tools. Information passed to us by the booking, email, text-messaging and customer relationship management tools we use.
Business information. Publicly available business contact details, such as from company websites and professional networks, which we use for business-to-business outreach.

We do not ask for, and you should not send us, sensitive information such as government identification numbers, payment card numbers by email, health information or biometric data.

4. Cookies and similar technologies

Cookies are small files stored on your device. Pixels, tags, local storage and software development kits work in similar ways. We use them in these categories:

Strictly necessary. Needed to run and secure the website, such as security and load-balancing features provided by our hosting provider. These do not require consent.
Analytics. Help us understand how visitors use the site so we can improve it. We use, or may use, Google Analytics.
Advertising and marketing. Help us measure and improve our advertising and show relevant ads. We use, or may use, the Meta Pixel and Conversions API, Google Ads tags, the LinkedIn Insight Tag and the TikTok Pixel.

Where the law requires consent, including for analytics and advertising technologies for visitors in the European Economic Area, the United Kingdom, Switzerland and Quebec, we only turn them on after you opt in, and you can withdraw consent at any time through our cookie settings or your browser. You can also block or delete cookies in your browser settings, although parts of the site may not work as intended.

5. How we use information

We use personal information to:

respond to enquiries, schedule and hold consultations, and prepare proposals;
provide, manage and improve our services, and bill for them;
send service messages, such as confirmations, reminders and updates;
market our services by email, text message and online advertising, in line with section 7;
measure and improve our website, content and advertising;
keep our website and business secure, and prevent fraud and misuse;
comply with legal obligations and enforce our agreements.

Legal bases (EEA, UK and Switzerland)

Where the GDPR or UK GDPR applies, we rely on: contract (to take steps at your request before a contract and to perform it); legitimate interests (to run, secure and promote our business, balanced against your rights); consent (for non-essential cookies, advertising technologies and certain marketing, which you can withdraw at any time); and legal obligation (for example tax and accounting records).

Consent in Canada

In Canada we collect, use and disclose personal information with your knowledge and consent, which may be express or, where the law allows, implied, for example when you submit a booking request and we use your details to respond. You may withdraw consent subject to legal and contractual restrictions, by contacting us.

6. Analytics and advertising

We use analytics and advertising services provided by third parties to measure our marketing and to show our ads to people who may be interested in our services. These providers may collect or receive information about your activity on our site, such as pages viewed and actions taken, along with identifiers such as cookie IDs, device IDs, IP address and, in some cases, hashed email addresses, and may combine it with other information they hold about you. They use it to provide measurement, to personalize and measure ads across their own and other services, and for their own purposes under their own privacy policies.

Google (Analytics, Google Ads). See how Google uses information from sites that use its services. You can manage ad personalization at adssettings.google.com and opt out of Google Analytics with the browser add-on.
Meta (Facebook and Instagram). The Meta Pixel and Conversions API send event data to Meta. See the Meta Privacy Policy and manage your ad preferences in your Meta account settings.
LinkedIn. The LinkedIn Insight Tag supports conversion tracking and audience building. See the LinkedIn Privacy Policy and your LinkedIn ad settings.
TikTok. The TikTok Pixel supports conversion measurement and ad delivery. See the TikTok Privacy Policy and your TikTok ad settings.

You can opt out of interest-based advertising from participating companies through the Network Advertising Initiative, the Digital Advertising Alliance (US), Digital Advertising Alliance of Canada and Your Online Choices (EU). Opting out does not stop all ads; it stops personalized ads from participating companies.

We do not sell personal information for money. Sharing information with advertising partners for cross-context behavioral advertising may be considered a "sale" or "sharing" under some US state laws. You can opt out at any time as described in section 12, including through a Global Privacy Control signal.

7. Email and text marketing

We send marketing emails and, where you have agreed, text messages about our services. We do this only with the consent required by law, including Canada's Anti-Spam Legislation (CASL), the US CAN-SPAM Act and the Telephone Consumer Protection Act, and, in the EEA and UK, the ePrivacy rules.

Every marketing email identifies us and includes a working unsubscribe link, and we honour unsubscribe requests promptly and in any case within 10 business days.
Text messages are sent only if you have given consent. Consent to receive texts is not a condition of buying anything. Message and data rates may apply. Reply STOP to opt out and HELP for help. We do not share mobile numbers or text-messaging consent with third parties for their own marketing.
You will still receive non-marketing messages about services you have asked for.

We share personal information only as described here:

Service providers. Companies that help us run our business, under contracts that limit how they use information: website hosting and security (Cloudflare), scheduling (Cal.com), email, text-messaging and customer relationship management tools, analytics, payment processing, accounting, document signing and AI service providers.
Advertising and analytics partners. The platforms listed in section 6.
Professional advisers such as lawyers, accountants and insurers.
Business transfers. If we are involved in a merger, financing, acquisition or sale of assets, information may be transferred, and we will tell you if your information becomes subject to a different policy.
Legal and safety. Where required by law, court order or a lawful request, or to protect rights, property and safety.
With your direction. Where you ask us to, or consent.

9. International transfers

We are based in Canada. Our service providers and the platforms we use are located in Canada, the United States and other countries, so your information may be processed outside your own country, including outside Canada, where it may be accessible to courts and authorities under local law. Where required, we use safeguards such as adequacy decisions and standard contractual clauses (including the UK addendum), and for Quebec residents we assess privacy risks before transferring information outside Quebec. You can contact us for more information about our service providers and safeguards.

10. Retention

We keep personal information only as long as needed for the purposes in this policy, and to meet legal, tax and accounting requirements. As a guide: enquiry and lead records are kept for up to 24 months after our last contact unless you become a client; client records are kept for the duration of the engagement and the period required for legal and tax purposes afterwards; and marketing preferences are kept until you unsubscribe, with a record of your opt-out kept so we respect it. When information is no longer needed we delete or anonymize it.

11. Security

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit and the use of reputable providers. No system is completely secure. If a breach creates a real risk of significant harm, we will notify affected individuals and regulators as the law requires.

12. Your rights and choices

Depending on where you live, you may have some or all of the rights below. To exercise any of them, email privacy@kenjiflow.com. We may need to verify your identity, and we respond within the time the law requires (generally 30 days in Canada and the EEA/UK, and 45 days in California, with extensions where permitted).

Canada (PIPEDA, BC PIPA, Quebec Law 25 and other provincial laws)

Access the personal information we hold about you and ask how it is used and shared.
Ask us to correct inaccurate or incomplete information.
Withdraw consent, subject to legal or contractual restrictions.
In Quebec: receive your information in a structured, commonly used format, ask us to stop disseminating it or to de-index it in certain cases, and be informed of automated decisions made about you.
Complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or the Commission d'accès à l'information du Québec.

European Economic Area, United Kingdom and Switzerland

Access, rectification, erasure, restriction of processing and data portability.
Object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent at any time, without affecting earlier processing.
Complain to your local supervisory authority, for example the Information Commissioner's Office in the UK.

United States (California and other states)

Know and access the categories and specific pieces of personal information we collect, use, disclose and share, and request deletion or correction.
Opt out of the sale or sharing of personal information and of targeted advertising, and limit use of sensitive personal information (we do not intentionally collect sensitive personal information for these purposes).
Not be discriminated against for exercising these rights.
Where available (for example Virginia, Colorado, Connecticut and Texas), appeal our decision by replying to our response; if you are still not satisfied you may contact your state attorney general.
You may use an authorized agent to make a request, and we may ask for proof of authorization.

In the past 12 months we have collected the categories of information listed in section 3 (identifiers, commercial and business contact information, internet or network activity, approximate geolocation, and information in your communications), for the business purposes in section 5, and disclosed them to the recipients in section 8. We do not knowingly sell or share the personal information of anyone under 16.

Australia and elsewhere

If you are in Australia, New Zealand or another country with privacy rights, you may ask us for access to and correction of your information and may complain to your national regulator, such as the Office of the Australian Information Commissioner. Contact us and we will help.

Opting out of marketing and tracking

Use the unsubscribe link in any email, reply STOP to any text, use the cookie settings on this site or your browser settings, or use the opt-out links in section 6.

13. Children

Our services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

14. AI tools and automated decisions

We use artificial intelligence tools, such as large language model services, to help us run our business and deliver our services, and may process the details of your enquiry with them. We do not use personal information from enquiries to make decisions that have legal or similarly significant effects on you based solely on automated processing. We select providers with appropriate contractual protections, and we do not send sensitive information to them unless required for a service you have asked for.

15. Do Not Track and Global Privacy Control

Browsers' "Do Not Track" signals do not have a common standard, so we do not respond to them. Where required by law, we treat a valid Global Privacy Control signal as a request to opt out of the sale or sharing of personal information and targeted advertising for that browser.

16. Third-party links

Our site links to other websites and services, such as our booking page, social networks and the tools above. We do not control them and are not responsible for their privacy practices. Please read their policies.

17. Changes to this policy

We may update this policy as our business, technology or the law changes. We will post the updated version here with a new "last updated" date and, where the changes are material, take additional steps to notify you as the law requires.

18. Contact us

Questions, requests or complaints about privacy: privacy@kenjiflow.com.

Mailing address: 319 W Hastings St, Vancouver, BC V6B 1H6, Canada.

If you are in the EEA or UK and we are required to appoint a representative, we will list their details here.