Privacy Policy
Last updated: October 12, 2026
Harbourcut Studio ("Harbourcut", "we") makes short AI-assisted video ads and runs AI receptionist and automation services for businesses in Metro Vancouver. This policy explains what personal information we collect, why, how long we keep it and your choices.
We follow British Columbia's Personal Information Protection Act (PIPA). Where the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies, for example to information that crosses provincial or national borders in commercial activity, we follow it too.
Contact: [email protected] (subject "Privacy") · (604) 245-7813 · 329 Howe St #698, Vancouver, BC V6C 3N2
1. Our privacy officer
Questions, requests and complaints go to the Harbourcut Studio Privacy Officer at [email protected] (subject "Privacy") or by mail at the address above.
2. What we collect and why
| Where | What we collect | Why |
|---|---|---|
| Phone calls to our line | Your number, what you tell the assistant (name, business, what you need, preferred times, email if you give it), a written transcript and short notes, call time and length | Answer questions, book a call, pass on your message, follow up |
| Text messages | Your number, your texts, our automatic replies | Answer common questions, send a booking link you asked for, pass on urgent messages |
| Booked calls (Calendly / Google Calendar) | Name, business, email, phone, reason for the call, the time | Send the invitation and prepare for the call |
| Website forms and email | What you enter or write | Reply to you |
| Website visits (only what you allow; §8) | Pages viewed, how you arrived, device, rough location, cookie IDs | Measure our site and ads |
| Clients | Business contacts, project materials, invoices | Deliver the work, billing, legal records |
We don't ask for card numbers, government ID or health information by phone or text. Please don't send card details by text, phone or email. We use personal information only for these purposes, purposes a reasonable person would consider appropriate, or with your consent.
3. Our AI receptionist (calls)
- It's an AI, and it says so. Calls to (604) 245-7813 are answered by "Aubrey", an AI assistant, which tells you at the start that it is an AI, not a person.
- Call audio recording is off by default. We don't keep recordings of calls. Audio is processed in real time by our phone and voice providers so the assistant can hear and answer you. If that ever changes, the assistant will tell you at the start of the call and this page will be updated first.
- Written transcript and notes, kept 30 days. The assistant tells you this before it asks anything about you. Both are deleted after 30 days; after that we keep only anonymous counts.
- You can say no. Say so on the call and the assistant takes only a short message (name, how to reach you, one sentence). We then delete the transcript and its analysis right after the call. You can also email [email protected] instead.
- No live transfers. The assistant books a 15-minute call or takes a message.
- Automated replies, human decisions. The assistant doesn't make decisions about you with legal or similar effects.
4. Text messages (SMS)
- We text only when you texted us first or asked us to (for example, "text me the booking link").
- Texts and our automatic replies are kept 30 days, then deleted.
- Reply STOP (or ARRET) to stop texts; you'll get one confirmation. Reply START to resume, HELP for help.
- We follow Canada's Anti-Spam Legislation (CASL) and don't send promotional texts or emails without consent. Booking a call or answering an ad doesn't add you to any marketing list.
5. Where your information is stored
Our database is Supabase, in its Canada (Central) region (ca-central-1, Montréal). It holds call notes, messages, bookings and opt-outs. Supabase is a US-based company and may access the data to provide support. Our server runs on Fly.io in Canada (Toronto). Partner applications, referral sign-ups and contact requests submitted on this site are stored in Canada.
Referrals. If you arrive through a referral link, we keep the referral code with your enquiry so we can thank the person who referred you. It's stored only in your browser tab until you submit a form.
6. Service providers
These providers process information for us under contracts that limit its use. Some process it outside Canada, mainly in the United States, where it may be accessible to courts, law enforcement and national security authorities under local law.
| Provider | What they do | Where |
|---|---|---|
| Twilio | Phone number, call connection, texts | United States |
| ElevenLabs | AI voice assistant: speech recognition, voice, transcript (30 days) | United States and other countries |
| AI language model provider (via ElevenLabs) | Generates the assistant's replies; no retention requested where available | United States |
| Supabase | Database | Canada (ca-central-1) |
| Fly.io | Booking and messaging server | Canada (Toronto) |
| Resend | Sends our emails (booking links, confirmations, alerts) | United States |
| Calendly | Booking calendar, loaded only when you click "Book a call" | United States |
| Google (Workspace, Analytics, Ads) | Calendar, Meet, email; site analytics and ad measurement only if you allow them | United States and other countries |
| Meta, TikTok | Ad measurement only if you allow Advertising; deliver our ads | United States and other countries |
| Stripe | Payments | United States and other countries |
| Cloudflare | Website hosting | United States and other countries |
Meta, TikTok and Google may also use what they receive from our site for their own purposes (such as improving their ad services and preventing fraud) under their own privacy policies. We don't sell your personal information.
7. How long we keep it
| Information | How long |
|---|---|
| Call transcripts and notes | 30 days, then deleted |
| Call audio | Not recorded (off by default) |
| Callers who declined a transcript | Deleted right after the call; minimal record + message kept |
| Text messages and automatic replies | 30 days, then deleted |
| STOP / do-not-contact requests | 3 years and 14 days |
| Bookings, messages left, form enquiries | Up to 2 years |
| Client and billing records | As tax law requires (generally 6 years) |
| Your cookie choice | 12 months, then we ask again |
| Google Analytics data | 14 months |
Provider backups may keep a copy briefly after deletion until they roll over.
8. Cookies, analytics and advertising
You choose. Only essential cookies run by default. Analytics and Advertising stay off until you turn them on, and "Reject all" is as easy as "Accept all". Change your choice any time with Cookie settings at the bottom of every page.
| Category | Default | Tools | Cookies (provider, lifetime) |
|---|---|---|---|
| Essential | Always on | harbourcut.com; Calendly on click | hc_consent_v1 (us, 12 months); Calendly's own cookies when it loads |
| Analytics | Off | Google Analytics 4 | _ga, _ga_<ID> (Google, up to 400 days, about 13 months) |
| Advertising | Off | Meta Pixel + Conversions API, TikTok Pixel, Google Ads tag | _fbp, _fbc (Meta, 90 days); _ttp (TikTok, 13 months); _gcl_au (Google, 90 days); _gcl_ls (Google Ads, browser storage, 90 days); test_cookie (Google, 15 minutes); IDE (Google DoubleClick, up to 400 days in our browser test) |
With Advertising on, these tools learn that you viewed a page, booked a call, sent a form or tapped our number, never what you typed. If your browser sends Global Privacy Control, Advertising stays off by default. We use Google Consent Mode, so Google tags don't set cookies until you allow them. You can also control ad settings with Meta, TikTok and Google directly.
9. Your rights
You can ask what we hold about you, how we've used it and who we've shared it with; ask us to correct it; and withdraw consent (delete a transcript or messages early, stop texts, change your cookie choice). Email [email protected] (subject "Privacy"). We may confirm your identity first. We respond within 30 days, at no charge.
If you're not satisfied, contact the Office of the Information and Privacy Commissioner for BC (oipc.bc.ca) or, where PIPEDA applies, the Office of the Privacy Commissioner of Canada (priv.gc.ca).
10. How we protect it
Access is limited to authorized people and the providers above, with strong passwords and two-factor authentication. Data is encrypted in transit and our database blocks public access. Call and text content isn't used to train our own AI models. If a breach creates a real risk of significant harm, we'll notify you and the regulator as the law requires.
11. Children
Our services are for businesses and our ads aren't aimed at people under 18. We don't knowingly collect information from children under 13.
12. Changes
We'll post changes here and update the date. For material changes to information we already hold, we'll ask for consent where required.
Questions: [email protected] · (604) 245-7813 · Harbourcut Studio, 329 Howe St #698, Vancouver, BC V6C 3N2