Privacy notice

Last updated 19 October 2026. Written to meet Alberta’s Personal Information Protection Act (PIPA).

Who we are

BespokeFlo builds and runs business systems for companies in Alberta. The person responsible for privacy at the company is Devon Appleton. Reach them at privacy@bespokeflo.ca or by post at [business address].

This website

This site has no sign-up, no contact form and no analytics or advertising trackers. It is served through Cloudflare, which keeps standard server logs (IP address, browser type, pages requested) for a short period to run and protect the service. If you email us, we keep your message and our reply for as long as the conversation and any work that follows from it are live.

Information we handle for clients

When a company hires us, we build and run systems that hold that company’s information: employee records, customer records, job details, photos, documents and account data. In those systems the client company controls the information and we hold it on their behalf under a written agreement. The agreement names:

• what information the system holds and whose it is;
• where it is stored and processed, chosen with the client, and every service it touches named individually (for example email sending and document reading in the United States);
• how long each kind of record is kept and what happens to it when the client leaves;
• the security measures we apply and what we do if something goes wrong, including the client’s decision on notifying the Office of the Information and Privacy Commissioner of Alberta and affected people.

We never sell personal information, and we never share it or use it for anything other than running the client’s system. Where the system is hosted, in Canada or elsewhere, is the client’s decision and is written into the agreement.

If you are an employee or customer of one of our clients and have a question about your information in their system, ask that company first. They control it. We will help them answer.

How long we keep it

Client systems follow the retention schedule in each client’s agreement. Our own business records, such as contracts and invoices, are kept for six years after the tax year they relate to, as Canadian tax law requires. Email about a project is kept for the life of the engagement plus one year.

Your rights

Under PIPA you may ask what personal information we hold about you, ask for it to be corrected, and ask how it has been used or disclosed. Write to the address above. We answer within 45 days. If you are not satisfied with our answer, you may complain to the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca.

Changes

When this notice changes, the date at the top changes with it. Material changes are also written into client agreements at their next review.