Privacy Policy

Who we are

Future Source Inc., doing business as FutureSource, 1250 Boulevard Virginie-Roy, Notre-Dame-de-l'Île-Perrot, QC J7W 3M8, Canada. Our privacy officer, responsible under Quebec's Law 25 and Canada's PIPEDA, is Amit Sahni, reachable at privacy@futuresource.ca.

Two roles, two sets of data

We handle personal information in two capacities:

1. As a business (controller). Information about our own prospects, customers, website visitors, job applicants and partners.
2. As a service provider (processor). Information our CRM customers store about their contacts. That data belongs to the customer; we process it on their instructions under a data processing addendum, and requests about it should go to the customer, who is the organisation you dealt with. Where you cannot reach them, contact our privacy officer and we will relay the request.

What we collect as a business

• Website and forms: the details you enter (name, email, company, phone, message), the page you came from, and, only with your consent, a first-party visitor identifier for analytics.
• Prospecting: publicly listed business information (business name, website, address, phone, general mailbox, public social pages, search visibility) about companies we may approach. We do not collect personal information about individuals from these sources beyond what a business publishes about itself.
• Email engagement: when we send you a commercial message, whether it was opened or a link clicked, so we can stop contacting people who are not interested.
• Bookings and calls: the calendar event you book, its notes, and, if you call our AI phone agent or receive a call from us, a recording or transcript after we tell you it is being recorded.
• Job applications: what you submit and the interview notes we take. Applicants are never added to marketing lists.
• Billing: invoices and payment records. Card details are entered on Stripe's page and never reach us.

Why, and on what basis

To respond to you, deliver services you bought, invoice you, send you commercial messages you consented to or that an existing business relationship permits under CASL, improve our site, and meet legal obligations. Marketing to you is based on your consent or an existing business relationship, and every commercial message carries a working unsubscribe. An unsubscribe is honoured across every channel and kept on record so it cannot be undone by a later import.

Tracking and consent

Visitor analytics and advertising measurement on futuresource.ca use Google Analytics 4, the Google Ads tag and our own first-party tracker. Google Analytics and the Google Ads tag are on from your first visit; our own tracker sends nothing until you accept. The cookie banner lets you accept or decline, declining turns the Google cookies off, and you can change that choice at any time from the Cookies page. The Google Ads tag records which of our ads, if any, brought you to the site, so we can tell which ads produce enquiries.

If you accept cookies and submit one of our forms, your browser also sends Google a one-way SHA-256 hash of the email address and phone number you entered, so Google can match the enquiry to an ad click. Google receives the hash, not the details themselves. We never send Google your name or address. If you book a call after clicking one of our ads, we report the booking to Google Ads with Google's own click identifier and nothing about you.

Email open tracking uses an image in the message; you can block images to prevent it. We do not sell personal information.

Automated processing

We score and rank the businesses in our records so we know who to approach first, and that scoring is automatic. It is built from signals about the business — how its website performs, what it publishes, whether an earlier message was opened — and from where the record came from. It is not an assessment of you as a person.

That score decides the order of our own work. No automated process here grants, refuses, prices or ends anything for anyone: a person makes every decision of that kind, so no decision about you is based exclusively on automated processing. If that ever changes we will say so here first, and tell you at the time, as Quebec law requires.

You may ask what information was used to build a score we hold about your business, and ask us to correct it, under "Your rights" below.

Where your information is kept

Our database is hosted in Montréal, Quebec. Our daily backup is stored with Google Workspace, wherever Google holds our account, which may be the United States. Some services we use to deliver email, text messages, calls, AI drafting, search data and card payments are operated from the United States and receive only the information needed for that task, in transit. The full list, with each provider's purpose and location, is published as our Sub-processor list and is part of this policy. Transfers outside Quebec are assessed as Law 25 requires.

How long

For as long as needed for the purpose, then deleted or anonymised. Records of who edited or deleted what are kept 24 months. Unsubscribe records are kept indefinitely so they stay honoured. Applicant records are kept 12 months after a decision unless you ask us to delete them sooner.

Your rights

You may ask us to confirm what personal information we hold about you, to receive a copy in a portable format, to correct it, to withdraw consent, and to delete it, subject to legal retention. Write to the privacy officer. We answer within 30 days. You may also complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Security

Row-level access controls per company, encrypted credentials, encrypted connections, sign-in by invitation only for CRM users, password sign-in with lockout for portal users, and an audit trail. If a breach presents a risk of serious injury we notify the Commission and the people affected as our incident procedure requires.

Changes

We post changes here with a new effective date. Material changes to what we collect or who we share it with are announced to customers by email.

Sub-processors