Privacy Policy

Scope

This policy covers the Steele Aerospace Ltd. website at steeleaerospace.ca, including the contact form on that site. Steele Aerospace Ltd. is a consultancy incorporated in British Columbia, Canada. Its sole principal is Brandyn Steele.

This policy describes what the website collects, where that information goes, how long it is kept, and how to make a privacy request. It does not cover personal information handled under a signed contract or subcontract, which is governed by the terms of that agreement.

What the website collects

There is one collection point on the site: the contact form. It collects four fields, all typed by the person submitting:

• Name
• Agency or organization
• Email address
• Message, free text, up to 4,000 characters

When a form is submitted, the server-side handler also has access to three pieces of technical information:

• The sender’s IP address. It is passed to Cloudflare Turnstile for the bot check only. Steele Aerospace does not store it and it is not included in the notification email.
• A two-letter country code that Cloudflare derives from that IP address. This is included in the notification email.
• The time of submission. This is included in the notification email.

Nothing else is collected. There is no account system, no login, no e-commerce, no payments and no newsletter.

What the website does not do

• The site sets no cookies of its own, and uses no local storage or session storage.
• The site runs no client-side analytics. Cloudflare Web Analytics has been deliberately disabled. No analytics beacon, tag manager, tracking pixel or third-party marketing script runs in a visitor’s browser.
• Web fonts are served from the site’s own domain, so no font CDN sees visitors.
• There is no embedded video, no embedded map, and no social media widget.
• The only third-party script on the site is the Cloudflare Turnstile challenge, and it loads only on the contact form.

Automated submissions

The contact form contains a hidden field that people do not see and do not fill in. Submissions with that field completed are treated as automated and discarded. No personal information from a discarded submission is retained.

Service providers and where information goes

Cloudflare

Cloudflare hosts the site through Cloudflare Pages and acts as CDN and reverse proxy. As a normal part of delivering and protecting the site, Cloudflare processes request metadata including IP address, user agent, request time and requested URL. From those logs Cloudflare produces aggregate, server-side traffic statistics that Steele Aerospace can view. Those statistics are counts, not profiles of individual visitors. Cloudflare is headquartered in the United States and operates a global edge network.

Cloudflare Turnstile

Turnstile is the anti-bot check on the contact form. It runs a challenge in the visitor’s browser and issues a token that is verified server-side, using the visitor’s IP address as part of that check. Cloudflare describes Turnstile as a privacy-preserving alternative to CAPTCHA that does not use cookies for cross-site tracking and does not fingerprint visitors for advertising purposes. It does examine signals from the browser and the request to judge whether the request is automated. Cloudflare’s own privacy documentation governs what it does with that data.

Resend

Resend is a United States company and provides the transactional email service that delivers form submissions. Resend sends through Amazon SES infrastructure in the AWS us-east-1 region in Northern Virginia, United States. The sending domain is send.steeleaerospace.ca. Resend retains sending logs that contain message metadata and message content for its own operational purposes.

Proton Mail

Proton Mail is the destination inbox where Brandyn Steele receives and stores enquiries.

Cross-border transfer

Contact form submissions are transmitted through and processed by service providers in the United States, specifically Resend and Amazon Web Services, before reaching the inbox. Cloudflare’s network is global and a request may be handled at an edge location outside Canada.

Personal information held by a service provider subject to United States law may be accessible to United States authorities under that law. Anyone who does not want their information handled this way should not use the contact form and should reach Steele Aerospace by another route.

How the information is used

Information submitted through the contact form is used to respond to the enquiry and to carry on the business conversation that follows from it. It is not sold, rented, traded, or used for advertising, marketing lists or profiling. No automated decision-making is applied to it.

Retention

Enquiries are kept for 24 months from the date of last contact. Once a year, on the anniversary of the company’s incorporation, enquiry records are reviewed and everything older than 24 months is deleted. A record may therefore remain until the annual review that follows its 24-month point.

Copies held in service provider logs are subject to that provider’s own retention practices.

Safeguards

The site is served over HTTPS only and sends HTTP Strict Transport Security, a strict Content-Security-Policy and other hardening headers. The contact endpoint accepts same-origin submissions only and is protected by the bot check described above. Received enquiries are held in a single mailbox controlled by the principal. No method of transmission or storage is completely secure, and Steele Aerospace does not claim any certification, audit or formal security standard for this website.

Breaches

If a breach of security safeguards involving personal information creates a real risk of significant harm, Steele Aerospace will report it to the Office of the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible. A record is kept of every breach of security safeguards, whether or not it meets that threshold.

Applicable law and your rights

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to personal information collected, used or disclosed in the course of commercial activity that crosses provincial or national borders. Because contact form submissions are transmitted to and processed in the United States, PIPEDA applies to them.

British Columbia’s Personal Information Protection Act (PIPA) applies to personal information handled by an organization in the course of activity within British Columbia. BC PIPA has been declared substantially similar to PIPEDA. Depending on the circumstances of a particular enquiry, BC PIPA may also apply.

Under those laws an individual may:

• ask what personal information about them Steele Aerospace holds, and ask for access to it
• ask for correction of personal information that is inaccurate or incomplete
• withdraw consent to the use of their personal information, subject to legal and contractual limits, understanding that this may mean an enquiry cannot be answered
• complain to the Office of the Privacy Commissioner of Canada, or, where BC PIPA applies, to the Office of the Information and Privacy Commissioner for British Columbia

A request for access or correction will be answered within the time limits set by the applicable Act.

How to make a privacy request

The individual accountable for personal information at Steele Aerospace is the principal, Brandyn Steele.

Steele Aerospace does not publish a postal address, telephone number or email address. All privacy requests go through the contact form on this site and reach the principal. Identify the request as a privacy request and describe what you are asking for. A reply will come from the principal by email.

Changes to this policy

This policy will be updated when the website, the services behind it, or the handling described here changes. The effective date at the top of this page reflects the version in force. There is no separate notification mechanism, since the site holds no subscriber list.