Privacy Policy.

This is the privacy policy for Bally Does AI. It explains, in plain English, what information we collect, why we collect it, who we share it with, and what control you have over it. If you read one section, read the Your Rights and Contact sections at the bottom. That's where you take action.

Bally Does AI is operated by Hunter Ballantyne, a one-person business based in Ontario, Canada. When this policy says "we," "us," or "Bally Does AI," that means Hunter. There is no team behind the curtain. You can reach the actual operator at the phone number and email at the bottom of this page.

What This Policy Covers

This policy covers three groups of people:

1. Visitors to ballydoesai.com and any website we build for a client.
2. Prospects who fill out a form, book a call, or text us before becoming a paying client.
3. Clients who have paid a one-time build fee and run a monthly care plan, and who use the websites, chat tools and automation provided.

It applies to information we collect through our website, our intake forms, our text-message replies, our billing system, and the AI tools used on client sites.

It does not cover what third-party websites do with your information when you click a link to leave one of our sites. Once you're on someone else's site, their policy applies.

What We Collect

We try to collect as little as possible. Here is the full list.

When you visit the website. Standard web request information: IP address, browser type, the page you landed on, the page you came from, and rough geographic location (city/region, not your exact address). This is the same kind of information every website on the internet sees when you load a page.

When you fill out a form or book a call. Your name, email address, phone number, the name of your business, and whatever you typed into the message field. If you book a discovery call, the calendar booking tool also stores your time zone and selected meeting time.

When you become a client. Everything above, plus billing details (handled by Stripe, we never see your full credit card number), the domain name or business details we need to build your site, any logos, photos, or copy you send us, and the login credentials for any service we need to access on your behalf (these are stored in an encrypted password manager, not in plain text).

When you text us or call. The phone number you texted from, the content of your message, and the time stamp. Calls to (519) 761-2251 may show up in a call log; we do not record calls.

When you use a website or chat tool we built for you. This depends on what we built. A typical website logs page views, form submissions, and chat conversations. The AI front desk logs the messages typed into it so it can answer follow-up questions and so we can improve the responses. If you are a visitor to a client's site (not a client of ours directly), the client owns that data. We just process it on their behalf.

We do not collect: government ID, social insurance numbers, health information, or banking information beyond what Stripe needs for a card payment. We have no reason to ask for any of that.

Cookies and Tracking

The Bally Does AI website uses a small number of cookies, the kind that keep a form from forgetting what you typed, and that count unique visitors so we know whether the site is working. We do not use third-party advertising trackers, we do not run Facebook Pixel, and we do not sell visitor data to ad networks.

If we set up analytics on a website we build for a client, we use a privacy-respecting analytics tool by default and disclose it on that site. We do not enable ad-network retargeting unless the client specifically asks for it and accepts responsibility for the disclosure.

How We Use What We Collect

We use the information above to do the work you hired us to do. Specifically:

• To answer questions you sent us through a form, an email, or a text.
• To send you a quote, an invoice, or a receipt.
• To build and maintain the website, chat tool, or automation you signed up for.
• To process payments and renewals.
• To send you service messages (a notice that your card is about to expire, that we're pausing a service for maintenance, or that we need a piece of information from you).
• To follow up on a discovery call you booked, or a message you sent that we have not answered yet.
• To improve how the tools work, for example, looking at why a chat tool gave a bad answer so we can fix it.

We do not use your information to train public AI models, to build a marketing list we sell to anyone, or to send you unrelated promotions. Marketing emails (if any) follow Canada's Anti-Spam Legislation (CASL): you only get them if you signed up or are an existing client, every email includes an unsubscribe link, and we honour unsubscribes within 10 business days as the law requires.

Who We Share It With

We do not sell your information. We share it with a short list of service providers who need it to run the business. Here they are, and what each one sees:

• Netlify hosts our forms. When you submit a contact form, Netlify receives it and forwards it to us.
• Stripe processes payments. When you subscribe, Stripe sees your card details, billing address, and the amount charged. We see only the last four digits of the card, the cardholder name, and the transaction history.
• Vercel hosts the websites we build and the dashboards we use. Page request data passes through Vercel's edge network.
• Supabase is the database where we store client account information, chat conversations, and form submissions. Supabase offers Canadian data residency and a data-processing agreement, which we use when available.
• Twilio sends and receives text messages. When you text us, Twilio is the carrier in the middle.
• OpenAI and Anthropic power the AI features in chat tools and content tools. When a visitor types a question into a chat we built, that question is sent to OpenAI or Anthropic so they can generate an answer, then the answer comes back. The model providers have agreed in their API terms not to train their models on this traffic.
• Calendly handles booking the 15-minute discovery call. When you book a time, Calendly stores your name, email, time zone, and any notes you add. Calendly is a U.S. processor.
• Google Fonts and jsDelivr are the CDNs that serve our fonts and a couple of small JavaScript libraries. Your browser requests these files when you load a page; the request includes your IP address but no personal information from us.
• Microsoft 365 hosts our business email at hunter.ballantyne@ballydoesai.com. Any email you send us lives in Microsoft's data centres.

We may also share information when the law requires it, for example, a court order from an Ontario court, or a valid request from the Canada Revenue Agency about billing records. If that happens and we are legally allowed to tell you, we will.

If the business is ever sold, transferred, or shut down, your information would be handled according to this same policy by whoever takes it over, or it would be securely deleted.

Where Your Information Lives (Foreign-Jurisdiction Disclosure)

This part is important under Canadian privacy law, and Quebec's Law 25 in particular.

Some of the service providers listed above store data on servers outside Canada, most commonly in the United States. Specifically: Stripe, Twilio, OpenAI, Anthropic, Calendly, and Microsoft 365 process data primarily in the U.S. Vercel and Supabase can be configured for Canadian regions and we use those when available, but parts of their networks still touch other countries.

When your information is processed outside Canada, it is subject to the laws of the country it sits in. In practice, that means U.S. government authorities could compel access to it under U.S. law, even though we are a Canadian business operating under PIPEDA.

By using our services, you are consenting to this cross-border processing. If you are uncomfortable with this, you can contact us before signing up and we will tell you what (if any) parts of the service we can deliver with Canada-only providers, and at what cost.

If you are a Quebec resident or your business operates in Quebec, the same disclosure applies under Quebec's Act respecting the protection of personal information in the private sector (Law 25). You have the same right to know where your data goes and to refuse the transfer, with the understanding that some features will not work without the U.S.-based providers listed.

How Long We Keep It

We keep things only as long as we need to:

• Form submissions from prospects who didn't become clients: up to 12 months, then deleted, in case you come back.
• Chat logs from AI tools: by default, 90 days. Clients can change this for their own deployments.
• Client account data: kept for the life of the engagement, then deleted within 30 days of cancellation (we confirm by email), unless you ask us to hold your setup so you can come back later without rebuilding.
• Billing records: 7 years, because the CRA requires it.
• Text messages with us: up to 24 months.

You can ask us to delete things earlier. See the next section.

Your Rights

Under PIPEDA (and Quebec's Law 25 if it applies to you), you have the right to:

• Know what personal information we hold about you.
• See a copy of it.
• Correct anything that is wrong.
• Withdraw consent to us using it, with the understanding that we may not be able to deliver the service afterwards.
• Request deletion of information we no longer have a legal or operational reason to keep.
• Move your data to another provider where reasonably possible (account exports, chat transcripts, content files).
• Complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d'accès à l'information (cai.gouv.qc.ca).

To exercise any of these rights, just text or email. See the contact section below. We aim to respond within 30 days, which is the timeline PIPEDA sets out.

Security

We use industry-standard practices: encrypted connections (HTTPS) on every site, encrypted storage for credentials, multi-factor authentication on the accounts that matter, and the principle of least privilege when granting access to client systems. The reality, though, is that no system is impossible to breach. If we ever suffer a breach that creates a real risk of significant harm to you, we will notify you as PIPEDA requires.

Subscription, Billing, and Cancellation

We mention this here because it intersects with privacy. Websites are a one-time build fee of $800, $2,000 or $2,500 CAD, followed by a care plan of $70, $90 or $90 CAD per month. You can stop the care plan by text or email to (519) 761-2251, on thirty days notice. No portals, no support tickets, no scripts to read. There is no money-back guarantee and no results guarantee, on purpose. When you cancel, your service stops at the end of the current billing period, and your data is handled according to the retention schedule above unless you ask us to delete it sooner.

Children

Our services are intended for businesses and adults. We do not knowingly collect information from children under 13. If you believe a child has submitted information to us, contact us and we will delete it.

Changes to This Policy

If we change this policy in a meaningful way, we will update the "Last updated" date at the top, post the new version on this page, and email active clients about the change before it takes effect. Old versions are kept on request.

Contact

For any privacy question, data access request, deletion request, or general concern, reach Hunter directly:

• Phone or text: (519) 761-2251 (Monday to Friday, 8 a.m. to 6 p.m. Eastern)
• Email: hunter.ballantyne@ballydoesai.com
• Mail: Bally Does AI, Ontario, Canada (full mailing address on request)

If you contact us and feel you didn't get a fair response, you can escalate to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, for Quebec residents, to the Commission d'accès à l'information at cai.gouv.qc.ca.

That's the whole policy. If anything is unclear, send a message. A real person will answer.