In plain terms: this website has no analytics, no advertising trackers and sets no cookies. The only personal information we get from it is what you type into the contact form and send us. We use that to reply to you. We do not sell it, and we never have.
This summary is here to be readable. The sections below are the ones that actually govern.
1. Who we are
Amanorn Solutions is a sole proprietorship carried on by Norman Sallah, based in Toronto, Ontario, Canada, providing business, trade and technology consulting to clients in Canada and internationally. In this policy, “we”, “us” and “Amanorn Solutions” mean that business. For data protection purposes we are the controller of the personal information described here.
This policy covers amanornsolutions.com and the consulting services we provide. It does not cover any other website, including sites we have built for clients.
Questions, requests or complaints about privacy go to normansallah@amanornsolutions.com, or +1 437 679 6760. If you need our postal address in order to exercise a legal right, ask and we will provide it.
2. The short version
- We collect what you send us through the contact form, by email, by phone or over WhatsApp.
- Our host records standard server logs, including IP addresses, for security and reliability.
- We run no analytics and no advertising or tracking technology on this site.
- The site sets no cookies at all. It stores one small non-identifying flag in your browser for the length of the tab session, described in section 8.
- Our Work section embeds two live websites — a client's hotel site, and The Yard, a student app we operate on its own domain — shown one at a time on a globe that turns from one to the next by itself; each loads the first time the globe turns to it while you are on that section, and either may set its own cookies or storage. The Yard's page also loads fonts from Google Fonts and a script from jsDelivr. These are the only outside connections this site makes, and section 8 says how to stop them.
- We do not sell, rent or share personal information for advertising, and we do not use it to build profiles or make automated decisions about you.
3. What we collect
3.1 Information you give us
When you use the contact form on our homepage, we receive:
- your name;
- your email address;
- your company name, if you choose to enter one — this field is optional;
- the message you write; and
- a record that you ticked the consent box, together with the exact wording you agreed to.
The form also carries a hidden decoy field that is invisible to people and only ever filled in by automated spam bots. If it is filled in, the submission is discarded.
If you email us, call us or message us on WhatsApp instead, we receive whatever that channel gives us — typically your name, your email address or phone number, and the content of your message.
Please do not put confidential, financial or sensitive personal information into a first message. Tell us the shape of the problem; we will agree a secure way to exchange details before you send anything sensitive.
3.2 Information collected automatically
Our host, Netlify, records standard web server logs when a page or file is requested. These typically include the IP address making the request, the date and time, the page or file requested, the HTTP status, the referring page and the browser user-agent string. We do not use these logs to identify or track individual visitors; they exist so the site can be kept available, debugged and defended against abuse.
We do not run Google Analytics or any other analytics product, advertising pixel, session recorder, heatmap, A/B testing tool, chat widget or social media tracker on this site.
3.3 Information we collect during an engagement
If you become a client, we will hold the information needed to do the work and to run the business relationship: contact details for you and your colleagues, the contents of our correspondence, engagement documents, notes and deliverables, and billing and payment records. What that includes depends entirely on the engagement, and is governed by our engagement letter and any confidentiality agreement between us, which take precedence over this section if they say something different.
3.4 What we do not collect
This website does not ask for and does not collect payment card details, government identification numbers, health information, or any other special category of sensitive personal data. There is no account, no login and no e-commerce checkout on this site.
4. Why we use it, and on what legal basis
The table below sets out each purpose and, for visitors covered by the EU or UK GDPR, the legal basis we rely on.
| What we do | Why | Legal basis (EU/UK GDPR) |
|---|---|---|
| Read and reply to your enquiry | You asked us to get in touch | Consent (Art. 6(1)(a)), which you give by ticking the box, and steps taken at your request before entering a contract (Art. 6(1)(b)) |
| Scope, quote and deliver consulting work | To perform the engagement | Performance of a contract (Art. 6(1)(b)) |
| Keep server logs; block spam and abuse | To keep the site working and secure | Legitimate interests (Art. 6(1)(f)) in the security and availability of our site |
| Keep invoices, contracts and tax records | Because the law requires it | Legal obligation (Art. 6(1)(c)) |
| Establish, exercise or defend a legal claim | To protect our position if a dispute arises | Legitimate interests (Art. 6(1)(f)) |
Under Canadian law (PIPEDA), we rely on your knowledge and consent for these purposes, and we limit what we collect to what is reasonably needed for them.
We do not send marketing emails, newsletters or promotional messages from the addresses collected through this site. If we ever start, we will ask for your consent separately first, as Canada's anti-spam legislation requires, and every message will carry a working unsubscribe link.
5. Who we share it with
We do not sell personal information, and we do not share it for anyone else's advertising. We disclose it only in these situations:
- Service providers who act for us. Our website host and contact form processor, Netlify, Inc.; our business email and document provider, Google Workspace, operated by Google LLC; and our accounting and payment providers for client billing. They may process personal information only on our instructions and for the purpose we gave them. We will name the specific accounting or payment provider on request.
- Professional advisers — for example an accountant or a lawyer — where they need it and are bound by professional duties of confidence.
- Where the law requires it, such as a valid court order, subpoena or lawful request from a regulator or law enforcement.
- To establish or defend legal claims, or to protect the rights, safety or property of any person.
- On a business transfer. If the business is sold or reorganised, information may pass to the new owner, who would remain bound by this policy or one no less protective.
We do not disclose client confidential information to anyone outside those situations. Confidentiality terms in an engagement letter override this section where they are stricter.
6. Where your information is stored and sent
Our website host and form processor, Netlify, Inc., is based in the United States, and our business email runs on Google Workspace, operated by Google LLC, which stores and processes data across a global infrastructure. This means information you send us — including contact form submissions, emails and server logs — may be stored on or accessed from servers outside your own country, including in the United States.
While information is in another country it is subject to that country's laws, and may be accessible to its courts, law enforcement and national security authorities. Where we transfer personal information out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) in our agreements with those providers.
If you would prefer not to have your information routed through a US provider, do not use the contact form — call or message us instead, and say so.
7. How long we keep it
| What | How long |
|---|---|
| Contact form submissions and enquiry emails that do not lead to work | Up to 24 months from your last message to us, then deleted |
| Client files, correspondence and deliverables | For the engagement, then 7 years, unless the engagement letter says otherwise |
| Invoices, receipts and other accounting records | At least 6 years, as Canadian tax law requires |
| Server logs held by our host | Per our host's own retention schedule, typically a matter of weeks |
| Session flags stored in your browser | Deleted by your browser when you close the tab |
You can ask us to delete an enquiry sooner, and we will unless we are required to keep it. See section 9.
8. Cookies and local storage
This website sets no cookies. It has no analytics cookies, no advertising cookies and no third-party cookies of its own, which is why you are not being shown a cookie banner.
The site does store one small flag using your browser's sessionStorage. It contains no identifier, is not sent to any server, and your browser deletes it when you close the tab:
amn.loader.seen— records that the opening animation has already played, so it is not replayed on every page view in the same visit.
One qualification. Our Work section embeds two live websites. Each loads automatically the first time the globe in that section turns to it while you are there. From that moment your browser is connected to a separate site, which may set its own cookies or storage inside the frame. This site cannot read them and receives nothing from them — but they are set without our asking you first. Our Cookie Policy explains this in full, including how to stop the frames loading if you would rather they did not.
9. Your rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and what we do with it;
- give you a copy of it;
- correct it if it is wrong or incomplete;
- delete it, where we are not required to keep it;
- stop or limit a particular use; and
- withdraw your consent at any time, which does not affect anything we did before you withdrew it.
Email normansallah@amanornsolutions.com. We will respond within 30 days. There is no charge. We may need to confirm your identity first, and we will only ask for what is necessary to do that. We will never treat you worse for exercising a right.
10. Region-specific rights
Canada
The Personal Information Protection and Electronic Documents Act (PIPEDA) gives you the right to access and correct your personal information and to challenge how we handle it. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Residents of Quebec, Alberta and British Columbia have equivalent rights under their provincial legislation; Quebec residents additionally have rights to data portability and to be informed about automated decision-making — we do not carry out automated decision-making.
European Economic Area and United Kingdom
If the GDPR or UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection — including an unconditional right to object to direct marketing, which we do not carry out. Where we rely on legitimate interests, you may object on grounds relating to your particular situation. You may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office at ico.org.uk. We have not appointed an EU or UK representative under Article 27, as our processing is occasional, low-risk and does not involve special category data on any significant scale.
California and other US states
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act — there is nothing here to opt out of. California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and are entitled to non-discrimination for exercising those rights. In the past twelve months we have collected the categories described in section 3: identifiers, commercial information relating to an enquiry, and internet activity in the form of server logs. Residents of other US states with comparable privacy laws may exercise the equivalent rights those laws give them by contacting us the same way.
11. Security
The site is served only over HTTPS and sends a Strict-Transport-Security header, so browsers refuse to load it insecurely. Response headers block content-type sniffing and restrict framing, and the browser features for camera, microphone and geolocation are switched off site-wide. Access to enquiries and client files is limited to people who need it, and business accounts are protected with strong, unique credentials and multi-factor authentication.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Email in particular is not a secure channel. If we become aware of a breach of security safeguards that creates a real risk of significant harm to you, we will notify you and the relevant regulator as the applicable law requires.
12. Children
This is a business-to-business site. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us and we will delete it.
13. Other people's sites
Our site links to and can embed content from sites we do not operate:
- A client site preview in the Work section. This loads automatically as you scroll to it. Once loaded, the embedded site can see that a request came from your browser — including your IP address and browser details — and may set its own cookies. See our Cookie Policy for how to prevent this.
- A preview of The Yard, also in the Work section. The Yard is a student app we build and operate on its own domain, under its own privacy policy; anything you do inside that frame is handled under that policy, not this one. It loads automatically when the globe turns to it, and its page fetches fonts from Google Fonts and a script from jsDelivr, so those providers see your IP address and browser details when it loads.
- WhatsApp links. Choosing to message us on WhatsApp takes you to a service operated by Meta, under Meta's own terms and privacy policy. We receive your phone number and the messages you send.
- Email links. These open your own email program; nothing is sent until you send it.
We are not responsible for the privacy practices of any site or service we do not operate. Read their policies before using them.
14. Changes to this policy
We may update this policy as the site or the business changes. The “last updated” date at the top always reflects the current version. If a change materially affects how we handle personal information we already hold, we will take reasonable steps to tell you directly and, where the law requires it, ask for your consent again.
15. Complaints
Please raise any concern with us first — it is usually the fastest route to a fix. Email normansallah@amanornsolutions.com with “Privacy” in the subject line. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or to the supervisory authority for your own country.
Amanorn Solutions
A sole proprietorship of Norman Sallah
Toronto, Ontario, Canada
normansallah@amanornsolutions.com · +1 437 679 6760