Legal
Privacy Policy
Effective: October 14, 2026 · Version: 2026-10-14
Idextrus Inc. ("Idextrus", "we", "us") is an Ontario corporation that provides technology assessment and consulting services, including the Modern Stack Snapshot™. This policy explains what personal information we collect through idextrus.com, chrisbruce.me and our services, why we collect it, who we share it with and the choices you have. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
Who is responsible
Chris Bruce, Founder, is accountable for our privacy practices. Contact: chris@idextrus.com · Idextrus Inc., 18 King Street East, Suite 1400, Toronto, ON M5C 1C4.
What we collect
When you request a Snapshot or contact us:
- your name, work email address, company name and website domain;
- your answers to our request form, such as approximate annual revenue, hosting provider, how you heard about us and what concerns you about your technology;
- email addresses you give us for the optional breach exposure check;
- your agreement to our terms and the date and time you gave it.
When you pay: our payment processor, Stripe, collects your card and billing details. We receive confirmation of payment and limited details such as your name, email address and the amount. We do not receive or store your full card number.
When we assess your domain: we collect technical information about the domain you submit and the assets related to it, such as security findings, certificates, software versions, email authentication records, and performance and accessibility results. This is mostly information about systems rather than people. It can include personal information, such as names in certificate or DNS records, or the email addresses you asked us to check.
When you book or attend a call: our scheduling tool, Calendly, collects your name, email address and the time you choose.
When you visit idextrus.com or chrisbruce.me: we use Google Analytics to understand how visitors use the sites, such as which pages are viewed, roughly where visitors come from and what device they use. Google Analytics uses cookies, and only runs if you allow analytics cookies in our cookie banner. You can change your choice at any time from the "Cookie settings" link in the footer. We have turned off Google's advertising features and do not use analytics data to identify you.
Why we use it
- to deliver the Snapshot and any other service you ask for, including follow-up scanning described in our Service Terms;
- to communicate with you about your request, your report and related services;
- to process payments and keep business and tax records;
- to send you occasional emails about our services, which you can unsubscribe from at any time (see "Email from us");
- to improve our methods, using de-identified, aggregated information that does not identify you or your organization;
- to meet legal obligations.
We do not sell personal information, and we do not use it for advertising.
Who we share it with
We use the following service providers to run our business. They process information on our behalf, under contract, and only for the purposes above:
| Provider | What it does for us |
|---|---|
| Attaxion | Discovers and scans the assets related to your domain |
| Google (Workspace, PageSpeed Insights) | Stores requests, reports and records; measures site performance and accessibility |
| Anthropic | AI-assisted drafting of report text from the assessment results. Every report is reviewed by Idextrus before delivery. Under Anthropic's commercial terms, our data is not used to train its models. |
| Amazon Web Services | Hosts idextrus.com and chrisbruce.me; produces the summary presentation in its Canadian region |
| Qualys SSL Labs, Cloudflare DNS | Checks encryption settings and DNS records |
| Cloudflare Turnstile | Checks that form submissions come from a person, not a bot |
| Have I Been Pwned | Checks email addresses you provide against known breaches |
| Stripe | Processes payments |
| MailerLite | Sends our emails |
| Calendly | Schedules calls |
| Google Analytics | Measures how visitors use idextrus.com and chrisbruce.me (only with your consent) |
| Slack, Outline | Internal team notifications and working documents |
| n8n (cloud-hosted) | Runs the workflows that connect these steps |
We may also disclose information when required by law, or to a buyer or successor if our business is sold or reorganized. In that case the information remains protected by this policy.
Where it is stored
Some of our service providers store or process information outside Canada, mainly in the United States and the European Union. Information held outside Canada is subject to the laws of that country and may be accessible to its authorities.
How long we keep it
- Requests, reports and assessment data: 3 years after delivery, so we can follow up and compare later assessments. You can ask us to delete them sooner.
- Breach exposure results: with the report they appear in.
- Payment and tax records: 7 years, as Canadian tax law requires.
- Email list: until you unsubscribe.
How we protect it
We limit access to the people and providers who need it to deliver our services. We use providers that encrypt data in transit and at rest, and we protect our accounts with strong authentication. No method of storage or transmission is completely secure. If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the Privacy Commissioner of Canada as the law requires.
Email from us
If you request a Snapshot, buy from us or ask us a question, we may email you about our services, as Canada's Anti-Spam Legislation (CASL) permits. Every marketing email includes an unsubscribe link, and unsubscribing does not affect emails about a service you are receiving.
Your choices and rights
You can ask us to:
- tell you what personal information we hold about you, and give you access to it;
- correct information that is inaccurate;
- delete your information, unless we must keep it for legal or tax reasons;
- withdraw your consent, for example to continued scanning or marketing email. Withdrawing consent may mean we cannot provide a service.
Email chris@idextrus.com. We respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.
Changes to this policy
We will post any update here with a new effective date and version. If a change materially affects how we use information we already hold, we will tell you before it applies.