Privacy policy

Contact for privacy

Privacy questions, data access, deletion requests:

Andrii Andriushchenko, Licensed Dealing Representative · NRD #4575551 · andrii@sky-fort.ca · +1-403-397-2553

Calgary, Alberta, Canada

What we collect

Depending on how you interact with the site:

If you just read: IP address (hashed), browser, OS, language — for analytics via Google Analytics 4 and Microsoft Clarity. Cookie consent required (see Cookies section).

If you subscribe to email: email, name (optional), subscription source, UTM parameters. Stored in Brevo (our email provider) and Supabase (backup).

If you book a discovery call: name, email, context (as filled in the form), time zone. Stored in Calendly + Supabase.

If you become a portal client: full name, email, province, language, data you enter yourself about your accounts (balance, account type — this is your own information, not an official statement). Stored in Supabase, accessible only to you via Row-Level Security.

As an EMD client (formally through Axcess Capital Advisors): additional KYC documents, Suitability Assessment — stored per CSA regulatory requirements (minimum 7 years after relationship ends).

How we use it

Only for purposes explicitly stated at collection:

— Educational materials and answering your questions via email/portal

— Discovery call booking via Calendly

— Aggregate analytics (anonymized — not linking visitors to identities)

— KYC + Suitability for EMD services (where regulatorily required)

— We do not sell or transfer to third parties for marketing.

Who we share it with

Third parties — only with specific purpose and minimum necessary scope:

— Brevo (France, GDPR-compliant) — for email. Privacy policy

— Supabase (US, hosted us-west-1) — for data storage. Privacy policy

— Google Analytics 4 (Google LLC, US) — analytics. Privacy policy

— Microsoft Clarity (Microsoft, US) — session replay. Privacy policy

— Calendly (US) — discovery calls. Privacy policy

— Vercel (US) — site hosting. Privacy policy

— Axcess Capital Advisors Inc. (Canada) — as dealer firm, required to receive EMD-related data.

How we store it

Encryption at rest in Supabase (AES-256), encryption in transit (TLS 1.3 everywhere).

IP hash instead of IP — for analytics we cannot identify specific people.

We follow principle of least privilege — each service key has minimal scope.

EMD regulatory data — per CSA NI 31-103 (minimum 7 years after relationship ends).

Your rights

Under PIPEDA you have the right to:

— Access — request a copy of all your data we hold

— Correction — fix inaccurate information

— Deletion — request deletion (with limits for regulatory EMD documents)

— Withdraw consent to email — one-click "unsubscribe" in every email

— Complaint to the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you believe we've violated this policy

For any request — email andrii@sky-fort.ca. I respond within 30 days (PIPEDA requirement).

Cookies

The site uses three types of cookies — details in the Cookie policy:

Necessary — session, security (always on)

Analytics — Google Analytics 4, Microsoft Clarity (can be disabled)

Marketing — Brevo tracking pixel (optional)

On first visit a cookie banner appears with options. You can change your decision anytime — link in footer.

Cross-border data transfer

Some providers (GA, Clarity, Vercel, Supabase) are in the US. PIPEDA requires informing you. Data is encrypted in-transit and at-rest, but formally falls under US jurisdiction when stored there.

Brevo — France (EU GDPR, even stricter protection).

Children's data

The site is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you learn that a child has provided us data — let us know and we will delete it.

Policy changes

We may update this policy. For material changes we will notify subscribers by email 30 days in advance. Update date at the top.