Contents
1. Who we are
This website (beta.output.systems, output.systems, and any subdomains including chat.output.systems, ai.output.systems, and customer.output.systems) is owned and operated by Output Systems, a trade name of 14305124 Canada Inc. (“Output Systems”, “we”, “us”, or “our”).
Registered address: 375 University Avenue, Suite 3267, Toronto, Ontario M5G 2J5, Canada.
Output Systems is the sole data controller for the personal information collected through this website. No third party has independent access to that information; the only parties who see it are (a) Output Systems personnel with a legitimate business need, and (b) the service providers listed in Section 8, who process it under contract on our instructions.
2. What we collect
2.1 Information you give us
Contact form. First name, last name, email address, company name, phone number (optional), the type of system you're interested in (optional), and the contents of your message.
AI chat assistant. The messages you type into the on-site chat widget, and any context you voluntarily share in that conversation.
Booking a discovery call. If you book a call through our calendar link, the calendar provider will collect the details you enter (name, email, meeting time) and share them with us.
Correspondence. Emails you send to us and any information you volunteer during discovery calls, follow-up conversations, or an active engagement.
2.2 Information we collect automatically
IP address, approximate geolocation derived from IP, browser type and version, operating system, device identifiers, screen size, and language preference.
Pages visited, time on page, referring URL, clicks, scroll behaviour, and access timestamps.
Session replays and interaction heatmaps produced by Microsoft Clarity (see Section 6).
Cookies and similar technologies (see Section 5).
2.3 Information we do not collect
We do not knowingly collect government-issued identifiers, health data, biometric identifiers, or information about your racial or ethnic origin, religious beliefs, or sexual orientation. If you send us any such information voluntarily, we ask that you don't.
3. How we use it
Respond to inquiries and schedule discovery calls.
Deliver, maintain, and support the systems we build for customers.
Measure how the website is used and improve its performance and content.
Run advertising on Meta platforms and measure the effectiveness of that advertising.
Send marketing and service communications where you have consented, or where CASL and other applicable laws permit implied consent.
Detect, prevent, and investigate fraud, abuse, or security incidents.
Comply with legal obligations and enforce our terms.
We do not use your information for automated decision-making that produces legal or similarly significant effects without your explicit consent.
4. Legal bases (EU / UK / Switzerland)
If GDPR or UK GDPR applies to you, we rely on one of the following lawful bases each time we process your personal data:
Consent — for optional analytics cookies, advertising cookies, marketing emails, and any use of sensitive data.
Contract — to answer inquiries you initiate, deliver services you engage us for, and respond to booking requests.
Legitimate interests — to secure the site, prevent fraud, and run basic aggregate analytics that don't identify you individually. You can object at any time (see Section 12).
Legal obligation — to comply with tax, accounting, and regulatory requirements.
5. Cookies & tracking
We use three categories of cookies and similar technologies:
Strictly necessary. Required for the site to function (session, security, load balancing). Always on; no consent needed.
Analytics. Google Analytics and Microsoft Clarity. Loaded only after you accept the analytics category in our consent banner (where required by law).
Advertising. Meta (Facebook) Pixel and related tracking. Loaded only after you accept the advertising category.
You can withdraw consent at any time by reopening our cookie banner, clearing cookies, or using your browser's privacy controls. We honour Global Privacy Control (GPC) browser signals as a valid request to opt out of advertising/analytics cookies and of any “sharing” of personal information for cross-context behavioural advertising, where required by applicable law.
6. Analytics & advertising
6.1 Google Analytics (GA4)
We use Google Analytics 4 to understand how visitors reach the site, which pages they read, and which content converts. Google receives a truncated IP address, a randomly-generated client identifier, and pageview data. Google acts as our processor for these purposes under Google's Data Processing Terms. IP anonymisation is enabled and we have not enabled Google Signals advertising features. Learn more at Google's Privacy Policy.
6.2 Microsoft Clarity
We use Microsoft Clarity to capture aggregated session recordings, heatmaps, and behaviour insights so we can improve the site. Clarity may record your interactions on the pages you visit (mouse movement, clicks, scrolling). Clarity automatically masks form inputs and other sensitive fields. Microsoft processes the data as our processor. Learn more in Microsoft's Privacy Statement.
6.3 Meta advertising (Facebook / Instagram)
We use the Meta Pixel and the Conversions API to reach relevant audiences on Facebook and Instagram and to measure the results of that advertising. Meta receives events tied to hashed identifiers (for example, a hashed email if you submit a form after clicking a Meta ad) and page interaction data. We do not send special-category data to Meta.
Please note: although we do not sell your personal information for money, our use of the Meta Pixel and Conversions API may be considered a “sale” or “share” of personal information for cross-context behavioural advertising under certain U.S. state privacy laws (including California's CPRA). You have the right to opt out of this — see Section 12.3, “Do Not Sell or Share My Personal Information.” You can also control ad personalisation from your Meta account settings and via the industry opt-outs at AdChoices Canada, the Digital Advertising Alliance, and Your Online Choices (EU).
7. AI chat assistant
The chat widget on this site is powered by a large-language-model provider that Output Systems has contracted to answer questions about our services. The provider is our processor: they may only use the messages you send to generate a reply and to enforce their platform's safety rules; they may not use your messages to train their own general-purpose models.
We store chat transcripts on our own infrastructure so we can improve the assistant and follow up with you if you leave contact details. Please do not send confidential business information, credentials, government IDs, or the personal information of others through the chat.
8. Sharing & service providers
We do not sell personal information for monetary consideration. Our only disclosure of personal information for advertising purposes is described in Section 6.3, and you can opt out of it under Section 12.3. Beyond that, we share personal information only in the following circumstances:
Service providers who process it on our behalf, under contract, on our instructions, for the purposes described in this policy. The main categories are: cloud hosting (Vercel), database and identity (Supabase and Clerk), email delivery (transactional email providers), analytics (Google, Microsoft Clarity), advertising measurement (Meta), calendar and scheduling (Google, Cal.com or equivalent), and the LLM provider that powers our chat assistant.
Legal and regulatory disclosures where we are required to by law, a valid court order, or another lawful demand, and to protect our rights, users, or the public.
Business transfers. If Output Systems is involved in a merger, acquisition, or asset sale, personal information may transfer as part of that transaction; we will notify you before your information is transferred and becomes subject to a different privacy policy.
With your explicit consent, for anything not covered above.
9. Retention
| Category | Retention period |
|---|---|
| Inquiries that don't lead to an engagement | Up to 24 months from last contact, then deleted or anonymised |
| Customer records for active engagements | Duration of the engagement plus 7 years (Canadian tax and contract law) |
| Marketing list membership | Until you unsubscribe or ask us to remove you |
| Website analytics (Google Analytics, Microsoft Clarity) | Up to 26 months |
| Meta advertising events | Retained by Meta per their retention schedule; deleted from our systems within 24 months |
| Chat transcripts | Up to 24 months, unless part of an active engagement |
| Records required by law | As long as the applicable law requires |
10. Security
Encryption in transit (TLS/SSL) for every request and encryption at rest for data we store.
Role-based access controls; personnel access is limited to what is necessary for their role.
Vendor due diligence and data-processing agreements with every processor.
Regular security review and dependency updates.
Breach notification to you and to the relevant supervisory authorities as required by law.
No online system is perfectly secure. If you believe your interaction with the site was insecure, contact the Privacy Officer immediately.
11. International transfers
Output Systems is based in Canada, which the European Commission has recognised as providing an adequate level of protection for personal data. Some of our processors (for example Google, Microsoft, and Meta) transfer data to the United States. Those transfers are governed by Standard Contractual Clauses (or the UK equivalent), the EU-U.S. Data Privacy Framework where applicable, and additional safeguards required by GDPR and UK GDPR.
Quebec residents: where your personal information is transferred or stored outside the province of Quebec (including to our processors in the United States), we have assessed those transfers and rely on the contractual and technical safeguards described above to protect your information, consistent with Quebec's Law 25.
EU / UK representative: we do not currently target or actively market our services to individuals in the United Kingdom or the European Union. If and when we begin doing so and become required to appoint a representative under Article 27 of the UK GDPR or the EU GDPR, we will update this policy to name that representative and provide their contact details.
12. Your rights
12.1 Rights available to everyone
Access — request a copy of the personal information we hold about you.
Correction — ask us to fix information that is inaccurate or incomplete.
Deletion — ask us to erase your personal information (subject to legal retention obligations).
Withdraw consent — where we rely on your consent, you can withdraw it at any time.
Complain — you can file a complaint with the relevant regulator (see Section 12.5).
12.2 Additional rights under GDPR (EU/UK/Switzerland residents)
Restrict processing while a request is being resolved.
Portability of the data you provided to us, in a structured, machine-readable format.
Object to processing based on legitimate interests or direct marketing.
Not be subject to a decision based solely on automated processing with legal or similarly significant effects.
12.3 Additional rights under U.S. state privacy laws
Residents of California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), and other U.S. states with comprehensive privacy laws have specific rights, including:
The right to know what personal information we collect, use, and disclose.
The right to request deletion or correction.
The right to opt out of the sale or sharing of personal information for cross-context behavioural advertising.
The right to opt out of profiling that produces legal or similarly significant effects (we do not do this).
The right to limit the use of sensitive personal information (we do not collect sensitive personal information for these purposes).
The right not to be discriminated against for exercising any of these rights.
Authorised agents may submit requests on your behalf; we may need to verify their authority.
Do Not Sell or Share My Personal Information. As explained in Section 6.3, our use of the Meta Pixel and Conversions API may qualify as a “sale” or “share” for cross-context behavioural advertising under some U.S. state laws. To opt out you can: (a) decline or withdraw consent for the advertising category in our cookie banner; (b) send a Global Privacy Control (GPC) signal from your browser, which we honour automatically where required by law; or (c) email curtis@output.systems with the subject line “Do Not Sell or Share.” We do not require you to create an account to exercise this right, and we will not discriminate against you for using it.
12.4 Additional rights for Quebec residents (Law 25)
If you are a resident of Quebec, Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, gives you the right to: be informed of the personal information we collect and the purposes for it; access and correct that information; withdraw consent, including consent to tracking technologies; request that we cease disseminating your information or de-index it in certain circumstances; and receive the computerised personal information you provided to us in a structured, commonly used technological format (data portability). Our Privacy Officer (Section 16) is the person responsible for the protection of personal information at Output Systems, and we report confidentiality incidents to the Commission d'accès à l'information du Québec where the law requires.
12.5 How to exercise your rights
Email curtis@output.systems or use the contact form on this site. We will respond within 30 days (or the shorter period your local law requires). We may need to verify your identity before we act.
If you are not satisfied with our response, you can complain to the appropriate authority:
Canada — Office of the Privacy Commissioner of Canada.
Quebec — Commission d'accès à l'information du Québec.
EU — your national data protection authority.
UK — Information Commissioner's Office (ICO).
California — California Privacy Protection Agency (CPPA).
13. Marketing communications (CASL)
Canada's Anti-Spam Legislation (CASL) governs the commercial electronic messages we send. We will only send you marketing email where we have express or implied consent under CASL. Every marketing email includes an unsubscribe link that we honour within 10 business days. You can also unsubscribe by emailing curtis@output.systems with the subject line “Unsubscribe”. Service and transactional messages (such as replies to your inquiry, appointment confirmations, and account-related notices) will continue.
14. Children
This website and our services are directed at businesses and their operators, not at children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact the Privacy Officer and we will delete it promptly.
15. Changes to this policy
We may update this policy from time to time to reflect changes in the law, our services, or our privacy practices. When we update the policy, we will change the “Last updated” date at the top. Material changes will be highlighted at the top of this page or communicated to you by another reasonable means. Your continued use of the site after a change becomes effective indicates your acceptance of the updated policy.
16. Contact & Privacy Officer
For any question about this policy or how we handle your personal information:
Privacy Officer: Curtis Grier-Coward
Email: curtis@output.systems
General contact: connect@output.systems
Postal: Output Systems (14305124 Canada Inc.), 375 University Avenue, Suite 3267, Toronto, Ontario M5G 2J5, Canada
This policy is governed by the laws of the Province of Ontario and the laws of Canada, without giving effect to conflict-of-law rules. The courts of Ontario have exclusive jurisdiction over disputes arising from this policy, except where a local mandatory provision gives you the right to bring proceedings elsewhere.