Legal

Privacy Policy

Effective: November 12, 2026

1. Who we are

jostrive.com is the website of Jose Leonardo Yanez Hernandez, operating as Jostrive, an independent process and data consultant based in Toronto, Ontario, Canada. Jostrive decides why and how the personal information collected on this site is used. Depending on the law, that makes us the "organization", "controller" or "responsible party".

Person in charge of the protection of personal information: Jose Yanez, Owner.
Email: [email protected] · Address: Toronto, Ontario, Canada.

2. What we collect

a) What you enter in the contact form:

• Your name and email address.
• Your business name and country.
• Your message (optional).
• Your choices: that you agreed to let us reply, whether you want marketing emails, whether you'd prefer we not use AI with your information, and which version of the text you accepted, with the date.

We don't ask for sensitive information (health, ethnic origin, political opinions, ID numbers, banking details, etc.). Please don't include it in your message.

b) Minimal technical data:

• To serve and protect the site, Cloudflare processes data such as your IP address, browser and time of visit.
• To stop abusive submissions, we store with your request a one-way salted hash of your IP address (a fingerprint that can't be reversed), never the IP address itself, and your browser type (user agent). Both are removed after 30 days: an automatic clean-up runs with every new form submission, and Jose also runs a manual clean-up every month. So they're never kept much longer than 30 days.
• On the form, Cloudflare Turnstile checks that you're a person, not a bot (see the Cookie Policy).

c) What we DON'T collect: we don't use analytics, social media pixels, advertising, or third-party fonts or services that track you. We don't buy data or profile visitors.

3. How we use it

We don't make automated decisions that have legal or similarly significant effects on you. A person reads every request.

4. Legal basis

• Canada and most Latin American countries: your consent, which you give by ticking the box and submitting the form. Marketing emails have separate, optional consent.
• EU/EEA and UK (GDPR / UK GDPR):
  • Replying to you and preparing your Session: steps taken at your request before entering into a contract (Art. 6(1)(b)).
  • Marketing emails: consent (Art. 6(1)(a)), which you can withdraw at any time.
  • Security and abuse prevention: legitimate interests (Art. 6(1)(f)). We have weighed that interest against your rights: we use minimal data (IP only as a hash, removed after about 30 days), we use it for nothing else, and without this protection the form would be unusable because of spam. You can object (§9).
  • Client billing and records: legal obligation (Art. 6(1)(c)).

You can withdraw your consent at any time (§9). This doesn't affect what we did before. If you withdraw consent for us to reply to you, we won't be able to handle your request.

5. Who receives your information (service providers)

We don't sell, rent or trade personal information. Only these providers process it for us. They act on our instructions and under their own data-protection commitments:

We may also disclose information if a law or an order from a competent authority requires it. If we change providers, we will update this table.

6. Where it's stored and international transfers

Jostrive operates from Canada. Your information may be stored or processed outside your country, in Canada, the United States and other countries where our providers operate. Their laws may differ from yours, and their authorities may be able to access the information under those laws.

• From the EU/EEA and the UK: the European Commission recognizes that Canada provides adequate protection for commercial organizations subject to PIPEDA, and the UK does too. For providers in the United States, we rely on Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework (and its UK extension).
• From Quebec: before sending information outside Quebec, we assess whether it will be adequately protected (see A.11).
• From Latin America: we use the mechanisms each law requires or allows, such as contracts with data-protection clauses and the informed consent you give when you submit the form.

7. How long we keep it

If you ask us to delete your information, we'll do it sooner, except for anything the law requires us to keep.

8. How we protect it

Our safeguards are proportionate to the sensitivity of the information:

• Encrypted connections (HTTPS) across the whole site.
• Encryption at rest by our provider (Cloudflare).
• Two-step verification with an authenticator app on every account that controls the site, email and data (Cloudflare, GitHub and Google Workspace).
• Access limited to Jose and, when they take part in a project, his work team, who are bound by confidentiality.
• Bot and abuse protection on the form. We never store your IP address in plain form.
• Database backups: Cloudflare's point-in-time restore and a monthly encrypted export stored outside Cloudflare.
• Privacy by default: no analytics, no advertising, and optional boxes left unticked.

No system is 100% secure. If a breach creates a real risk of significant harm (or a "risk of serious injury", depending on the law that applies), we will notify you and report it to the relevant authorities within the deadlines the law sets. We keep a record of every breach.

9. Your rights and how to exercise them

Wherever you are, you can ask us for:

• Access: to know what information we hold about you and get a copy.
• Correction: to fix inaccurate or incomplete information.
• Deletion: to erase your information.
• Withdrawal of consent, including for marketing (you can also use the "unsubscribe" link in every email).
• Objection: to stop a particular use of your information. For example, AI analysis (tick the "no AI" box or email us).
• Portability: to receive your information in a commonly used electronic format.
• Information: about who we share your information with and why.
• Freedom from solely automated decisions with legal effects (we don't make them).

How: email [email protected] with your request and the email address you used to contact us. If we can't confirm your identity, we may ask for one more detail (never an ID document unless it's truly needed). It's free. We respond within 30 days at most, or sooner if your law sets a shorter deadline (see A.14). If a request is complex and the law allows, we'll tell you if we need more time. You can act through an authorized agent. We will never treat you differently for exercising your rights.

10. Complaints

Please contact us first; we want to fix it. If you're not satisfied, you can go to the relevant data-protection authority:

• Canada: Office of the Privacy Commissioner of Canada (www.priv.gc.ca). Quebec: Commission d'accès à l'information (www.cai.gouv.qc.ca).
• EU/EEA: the supervisory authority in the country where you live or work, or where the alleged infringement took place (in Spain, the AEPD, www.aepd.es). UK: the ICO (ico.org.uk).
• United States: your state attorney general or, in California, the California Privacy Protection Agency.
• Latin America: see the table in A.14.

11. If you're in Canada

• PIPEDA. We follow its 10 fair information principles: accountability (Jose is the accountable person), identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.
• Quebec (Law 25). If you live in Quebec:
  • The person in charge of the protection of personal information is Jose Yanez, Owner, [email protected].
  • Privacy by default: the most privacy-protective settings are on from the start (no analytics, optional boxes unticked).
  • Transfers outside Quebec: before communicating your information outside Quebec (e.g. to Cloudflare or Anthropic), we assess whether it will be adequately protected and put written agreements in place.
  • We don't use technology that identifies, locates or profiles you.
  • If a confidentiality incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people affected.
• CASL (Canada's Anti-Spam Legislation). We send commercial electronic messages only with your express consent (the marketing box, unticked by default) or where the law allows (e.g. to answer your inquiry). Every message identifies us, includes our contact information and a working unsubscribe link, and we process unsubscribe requests within 10 business days. We keep a record of your consent (date and wording accepted).

12. If you're in the United States

• State privacy laws (California's CCPA/CPRA and similar laws in Colorado, Connecticut, Virginia, Texas and other states). These laws apply above certain thresholds of annual revenue or number of consumers. Jostrive likely doesn't meet them today. We follow these practices anyway:
  • We don't sell personal information and don't "share" it for cross-context behavioural advertising.
  • We don't collect sensitive personal information or build profiles.
  • We honour Global Privacy Control (GPC) signals from your browser as a request to opt out of sale and sharing, and we turn off anything non-essential (see §C.6).
  • You can ask for access, correction or deletion as explained in §9. We'll respond within your state's deadlines.
  • Categories we collect: identifiers (name, email), commercial information (business name, country, message) and limited technical data (IP hash and browser, kept about 30 days). Purposes: see §3. Retention: see §7.
• CAN-SPAM. Our commercial emails don't use misleading sender information or subject lines, are identified as promotional when they are, will each include a valid postal address, and offer an opt-out that we honour within 10 business days.

13. If you're in the EU/EEA or the UK

• Controller: Jose Leonardo Yanez Hernandez, operating as Jostrive, Toronto, Ontario, Canada. Contact: [email protected].
• Purposes and legal bases: see §3 and §4.
• Transfers: Canada has an adequacy decision for commercial organizations subject to PIPEDA. For US providers, we use Standard Contractual Clauses and, where applicable, the Data Privacy Framework (§6).
• Your rights (GDPR Articles 15 to 22): access, rectification, erasure, restriction of processing, portability, objection (including to processing based on legitimate interests and, always, to direct marketing), and withdrawal of consent at any time. You can lodge a complaint with a supervisory authority (§10).
• Automated decision-making (Art. 22): we don't make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
• Do you have to give us your information? There's no legal requirement. Without your name, email, business and country, we can't respond to your request.

14. If you're in Latin America

Every visitor gets the rights in §9 through the same process. Depending on your country, you also have these:

15. Minors

This site is meant for business owners and managers. We don't knowingly collect information from anyone under 18. If you think we have, let us know and we'll delete it.

16. Changes to this policy

If we change this policy, we'll post the new version here with its date. If the change is significant and we have your email address, we'll tell you before it takes effect. If a change requires new consent, we'll ask for it.

17. Contact

Jose Leonardo Yanez Hernandez, operating as Jostrive · Toronto, Ontario, Canada · [email protected]