Socratic Systems is an AI automation and local marketing agency based in the North Okanagan, British Columbia, Canada. We serve home service businesses, including HVAC, plumbing, electrical, and roofing contractors, by diagnosing operational inefficiencies and implementing AI-powered systems.

We are the data controller for personal information collected through our website and services. Our privacy practices comply with BC's Personal Information Protection Act (PIPA), which governs our relationships with BC-based clients, and Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), which applies when we engage in interprovincial commerce or serve clients outside BC. Where the two laws overlap, we apply the higher standard.

We collect information in three ways:

Information you provide directly:

• Name, business name, email address, phone number
• Business details shared during a Socratic Audit or onboarding
• Foundation intake responses submitted through our Foundation setup form, including your trade, towns served, how your phone is currently handled, your lead-delivery and booking preferences, and similar operational details we need to build your call agent
• Operational data, workflows, and systems you share to enable our work
• Communications via email, forms, or calls

Information about other people you provide: The Foundation intake form includes an optional field for anyone else who should receive leads (for example a partner, office manager, or dispatcher). If you enter another person's name, phone number, or email there, you are sharing a third party's contact details with us. Please only provide this information if you are authorized to do so, and let that person know we will use it solely to route leads as you've instructed.Information collected automatically:

• Website usage data (pages visited, time on site, referring URLs)
• Device and browser type via cookies or analytics tools
• IP address used for geographic analytics only, not personal identification

Information from third parties:

• Publicly available business information (e.g. Google Business Profile) used to prepare your Audit
• Referral information if you were introduced by a partner or colleague

Under both PIPA and PIPEDA, we collect only the minimum information necessary for the identified purpose, and we will tell you why we need it before or at the time of collection.

We use the information we collect to:

• Deliver the Socratic Audit and all contracted services
• Communicate with you about your project, invoices, and updates
• Improve our service delivery and internal processes
• Send relevant business insights or service updates. You may opt out at any time
• Comply with legal obligations and enforce our Terms of Service

Both PIPA and PIPEDA require that we use your information only for the purposes identified at the time of collection, or purposes a reasonable person would consider appropriate. We do not use your information for undisclosed purposes without obtaining fresh consent.

Socratic Systems uses AI tools as part of our research, analysis, and automation work. We are transparent about how your data interacts with these systems:

• We do not use your business data to train AI models. Client information is used only to produce your specific deliverables.
• AI tools we use operate under enterprise or privacy-forward agreements. Where those tools are hosted outside Canada, we take reasonable steps to ensure comparable protection applies.
• All AI-generated outputs are reviewed by a human team member before delivery. We do not send raw AI output to clients.
• If you have concerns about a specific tool being used with your data, contact us before work begins and we will clarify.

Claude (Anthropic)n8n AutomationGoHighLevel CRMGoogle Workspace

We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:

Recipient	Purpose	Safeguard
Service delivery tools (n8n, GoHighLevel, etc.)	Required to build and operate your automations	Data minimization: only what is necessary
Calendly LLC (United States)	Scheduling discovery calls when you use the booking widget on our Contact and Services pages	Name, email, and any details you submit during booking
Accounting & invoicing software	Billing and payment processing	Name, email, and payment details only
Legal or regulatory authorities	When required by law or valid court order	We notify you when legally permitted to do so
Business successors	In the event of a sale or acquisition of Socratic Systems	Same privacy obligations apply to any successor

Where data is transferred outside BC or Canada, we ensure equivalent privacy protections are in place as required under PIPA s.30.1 and PIPEDA Schedule 1 Principle 4.1.3.

We use a small number of cookies and similar technologies on this website. Nothing non-essential loads until you've given consent through our cookie banner.

• Essential: Required for the site to function (e.g. remembering your cookie choice). Cannot be disabled.
• Analytics (with your consent): Google Analytics 4 and Microsoft Clarity. We use these to understand which pages help visitors and where the site falls short. Clarity records anonymized session replays; we do not see your keystrokes in form fields, and IPs are masked.
• Marketing (with your consent): Meta Pixel and Google Ads conversion tracking. These help us measure whether our ads are reaching the right contractors and decide how to spend our marketing budget.
• Booking widget (functional): When you view our Contact or Services pages, the Calendly booking widget loads and may set session cookies needed for the calendar to function. These are limited to scheduling and confirmation, are not used for advertising, and are governed by Calendly's own privacy notice at calendly.com/privacy.

On your first visit you'll see a consent banner with three choices: Accept All, Reject, or Manage. You can change your mind anytime by clicking Cookies in the footer of any page. If you've already accepted and want all third-party cookies fully removed, also clear them in your browser settings.

We retain personal information only as long as necessary for the identified purpose or as required by law:

• Active clients: Retained for the duration of our engagement plus 3 years for legal and accounting purposes
• Prospective clients (Audit inquiries): Retained for 12 months from last contact, then securely deleted
• Website analytics: Aggregated data up to 24 months; no individual records beyond 12 months
• Financial records: 7 years as required under Canadian tax law

Under PIPA s.35, we must destroy or de-identify personal information that is no longer required. You may request early deletion at any time (see Section 08).

Under both PIPA and PIPEDA you have the following rights regarding your personal information:
We will respond to all privacy requests within 30 days as required under PIPA s.32 and PIPEDA s.8(3). If we cannot respond within 30 days, we will notify you of the reason and the extended timeline.

Where to escalate a complaint:

We take reasonable technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, or destruction:

• Encrypted data transmission (HTTPS/TLS) across all client-facing surfaces
• Access controls limiting internal visibility of client data on a need-to-know basis
• Secure password management and two-factor authentication on internal tools
• Regular review of third-party tool security practices

In the event of a breach that creates a real risk of significant harm, we will notify affected individuals and the relevant Commissioner as required: the OIPC BC under PIPA and/or the OPC under PIPEDA's mandatory breach reporting rules (in force since November 2018).

Our services are intended exclusively for business owners and professionals. We do not knowingly collect personal information from individuals under the age of 16. If we become aware that we have inadvertently collected such information, we will delete it promptly and without notice.

We may update this Privacy Policy to reflect changes in our practices, technology, or applicable law, including any amendments to PIPA or PIPEDA. When we make material changes we will:

• Update the effective date at the top of this page
• Notify active clients via email at least 14 days before changes take effect
• Post a notice on our website for a minimum of 30 days

Your continued use of our services after a policy update constitutes acceptance of the revised terms.

For all privacy-related inquiries, data access requests, or complaints, contact us at:

Socratic Systems: Privacy Officer
North Okanagan, British Columbia, Canada
Email: admin@socraticsystems.ca
Response time: within 30 days of receipt

If you are unsatisfied with our response you have the right to contact:

This section applies to you if you reside in a U.S. state with a comprehensive consumer privacy law — including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states whose laws are in force in 2026. Rights described elsewhere in this Policy apply universally; the items below are specific to U.S. state law.

Categories of personal information we collect:

• Identifiers — name, email, phone number, IP address. Where you complete a Foundation intake, this may include the contact details of another person you designate to receive leads.
• Commercial information — company name, industry, audit-form responses, and Foundation intake responses (trade, towns served, phone-handling, lead-delivery and booking preferences)
• Internet or network activity — pages visited, referring URLs, device and browser info (only with your analytics consent)
• Geolocation — approximate region inferred from IP address (not precise)
• Inferences — segmentation derived from the above (e.g. likely industry vertical)

Sources: directly from you via our forms (including the Foundation intake form); automatically via your browser; from publicly available business data used to prepare your audit.

Sale and sharing of personal information. We do not sell your personal information for money. If you consent to our Marketing cookie category and we have an active Meta Pixel or Google Ads remarketing integration, your interaction data may be considered “sharing” under the CCPA/CPRA because it can be used for cross-context behavioral advertising. You can prevent this in three ways: (a) decline the Marketing category in the consent banner; (b) click the Cookies button in the footer at any time to change your choice; or (c) send a browser-level Global Privacy Control (GPC) signal, which we honor automatically as a valid opt-out of sale and sharing.

Your rights under U.S. state laws:
How to exercise these rights: email admin@socraticsystems.ca with the request type and the email address you used with us. We will respond within 45 days (extendable once by an additional 45 days where reasonably necessary, with notice to you). We will verify your identity proportionately to the sensitivity of the request — typically by confirming control of the email on file.

Global Privacy Control. If your browser transmits a GPC signal on your first visit, we treat it as an opt-out of all non-essential analytics and marketing cookies and we do not show the consent banner. You can override this at any time via the Cookies button in the footer.

Children. Our services are directed to business owners. We do not knowingly sell or share the personal information of consumers under 16 and do not knowingly collect personal information from anyone under 13 without verifiable parental consent.

This section applies to you if you reside in the European Union, the United Kingdom, the EEA, or Switzerland. The General Data Protection Regulation (GDPR), the UK GDPR, and the ePrivacy Directive set additional requirements beyond what is described above.

Data controller. Socratic Systems is the data controller for the information you provide to us through this website. You can reach us at admin@socraticsystems.ca. We do not currently maintain an EU/UK representative because our processing of EU/UK personal data is occasional and low-risk; if our processing changes we will appoint one and update this Policy.

Lawful bases for processing (GDPR Article 6 / UK GDPR Article 6):

• Consent (Article 6(1)(a)): for non-essential cookies and trackers in the Analytics and Marketing categories. We do not load these until you actively opt in via the consent banner. You can withdraw consent at any time using the Cookies button in the footer — withdrawal is as easy as giving consent and takes effect immediately for future processing.
• Legitimate interests (Article 6(1)(f)): for processing inquiries submitted via the audit and contact forms, responding to your questions, security, and fraud prevention. We balance these interests against your rights and freedoms.
• Contract (Article 6(1)(b)): where you become a client, to deliver the services you have engaged us for.
• Legal obligation (Article 6(1)(c)): for tax, accounting, and statutory record-keeping.

Your GDPR / UK GDPR rights (in addition to the access, correction, deletion, withdrawal, portability, and complaint rights described in Section 08):

• Restriction of processing — ask us to pause processing while we resolve a dispute about accuracy or our basis for processing.
• Objection — object to processing based on legitimate interests, including any direct marketing.
• Right to lodge a complaint with your national supervisory authority — for example the UK ICO (ico.org.uk), Ireland’s DPC, France’s CNIL, Germany’s BfDI, or the relevant authority in your country of residence.
• Not to be subject to automated decision-making that produces legal or similarly significant effects. We do not make such decisions about you.

International transfers. Socratic Systems is based in Canada, which the European Commission has recognized as providing an adequate level of data protection under PIPEDA (subject to that adequacy decision’s continued validity). To deliver the website and respond to inquiries we also use service providers located in the United States, including:

• Vercel — static hosting and CDN edge delivery
• Supabase — database and backend for form submissions
• Calendly — scheduling discovery calls (only when you use the booking widget)
• Google — Google Analytics 4 (only with your consent)
• Microsoft — Microsoft Clarity (only with your consent)
• Meta — Meta Pixel (only with your consent)

Transfers of personal data to the United States are protected by the EU-U.S. and UK-U.S. Data Privacy Framework (where the recipient is certified) and/or Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where appropriate. You should be aware that U.S. law — including FISA Section 702 and Executive Order 14086 — may permit U.S. government authorities to access personal data held by U.S. providers in some circumstances. A copy of the relevant transfer mechanism is available on request.

Retention. Audit-form and contact-form leads are retained for 12 months from last contact. Active client records follow the periods in Section 07. Consent records (the choices you made in the banner) are stored locally in your browser and are not transmitted to our servers unless you submit a form.

Children. Our services are not directed to children. We do not knowingly process personal data of anyone under 16 (or under 13 in the United Kingdom) without verifiable parental consent.

You have four direct ways to control how we process information about you:

1. Change your cookie categories. Click Cookies in the footer of any page to reopen the consent banner. Your choice takes effect immediately for future processing; analytics and marketing scripts are loaded only after you opt in.

2. Send a Global Privacy Control signal. If your browser transmits the GPC signal on your first visit, we automatically record an opt-out of all non-essential analytics and marketing cookies and skip the consent banner. Most major privacy-respecting browsers and extensions support GPC (DuckDuckGo, Brave, Firefox via about:config, the Privacy Badger extension, and others).

3. Submit an access, deletion, correction, or portability request. Email admin@socraticsystems.ca with:

• The type of request (access, delete, correct, portability, or opt-out of sale/share)
• The email address you used with us, so we can locate your records
• Any additional context that helps us respond accurately

We will acknowledge within a few business days and respond substantively within 30 days (PIPEDA / PIPA) or 45 days (U.S. state laws and GDPR), whichever applies to you. We may verify your identity by confirming control of the email on file; for sensitive requests we may ask for additional verification proportionate to the risk.

4. Withdraw consent for marketing communications. Every email we send includes an unsubscribe link. You can also reply to any message with “unsubscribe” or contact us at admin@socraticsystems.ca.

We will never deny service, charge a different price, or otherwise discriminate against you for exercising any of these rights.