Privacy policy
What this site collects, where it goes, how long it is kept, and how to get a copy or have it deleted. Written to be read, not to be scrolled past.
This site is operated by NCGI (Nagi Consulting Group Inc.), trading as Nagi Solutions, from Calgary, Alberta. We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).
The short version: we collect what you type into a form, plus ordinary website analytics. We do not sell anything to anyone, we do not run advertising trackers, and there is no mailing list you can be added to without asking.
What we collect
When you send an enquiry
The contact form asks for your name, email address, an optional company name, which service you are asking about, and your message. All of it is voluntary. The only field we genuinely need is an email address, because otherwise we cannot answer you.
Along with what you type, the form records the page you submitted it from, the site that referred you, and your IP address. The IP address is used for one thing: limiting how many submissions can come from one place in ten minutes, so the form cannot be used to flood us with spam.
When you use Atlas
Atlas is the AI assistant on /atlas and on the contact page. What you type into it is sent to Anthropic's API to generate a reply. Do not put confidential information into it. The conversation is not saved to an account and is not linked to you; it disappears when you close the tab.
When you just read the site
We use Google Analytics 4 through Google Tag Manager to see which pages get read and roughly where visitors come from. That involves cookies and a truncated IP address. It tells us that forty people read an article; it does not tell us who they were.
We also keep a count of our own, so we are not reading someone else’s dashboard to find out how the site is doing. When a page loads, it tells our server which page it was and which site sent you — nothing else. No cookie, no identifier, no IP address, and nothing that follows you from one page to the next. What is stored is a running total: how many times each page was viewed on each day, and from which source. It cannot say that any particular person read anything.
Alongside that total we keep the last few hundred arrivals — the city, region and country Cloudflare already reads from the connection, and the page that was opened. That is what feeds the live list beside the globe on /atlas, which shows the city, the country and the page. It holds nothing that identifies a visitor and no identifier of any kind, so two lines in it cannot be known to be the same person. Each entry falls off the end as newer ones arrive.
Cloudflare, which hosts the site, keeps standard server logs (IP address, time, page requested) for security and abuse prevention. A couple of scripts are loaded from Cloudflare’s CDN, which sees your IP address as part of serving the file.
Some pages carry a strip of headlines, and the homepage shows the weather in Calgary. Both are fetched by our server from public sources, not by your browser, so reading the page sends nothing about you to any of them. The weather is for a city, not for you: we do not ask where you are and could not tell you if we wanted to. Following one of those headlines takes you to that publisher’s own site, where their terms and their tracking apply, not ours. Our own articles in that strip stay on this site.
If you are an administrator
Signing in at /admin sets one session cookie. It is HttpOnly, Secure and SameSite=Lax, and it exists only to keep you signed in. There is exactly one of these accounts and it belongs to the owner.
Cookies
| Cookie | Set by | What for | How long |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Counts a returning visitor as one person rather than two | Up to 2 years |
session | This site | Keeps the site owner signed in to the admin area. Never set for visitors. | Until sign-out |
There are no advertising cookies, no retargeting pixels and no social media trackers on this site. You can block or clear cookies in your browser, or turn on Do Not Track, and every page here still works normally.
Where it goes
An enquiry is delivered to us by email and is saved in our own database so it cannot be lost to a spam folder. If your enquiry relates to one of our own products it may also be recorded in that product's customer system. Nothing else is passed on.
| Who | What they get | Why |
|---|---|---|
| Cloudflare | Server logs; the enquiry database and uploaded images | Hosting the site |
| Google (Analytics, Tag Manager) | Page views, approximate location, IP address | Knowing which pages are worth writing |
| Anthropic | Whatever you type into Atlas | Generating the reply |
| Shopify | Enquiries relating to our ecommerce brands | Answering them in the system that holds the order history |
Some of these providers process data outside Canada, including in the United States, which means it can be subject to the laws of those countries. If that is a problem for your enquiry, email us instead and it stays between the two of us.
We do not sell, rent or trade personal information. Ever. The only circumstance in which we would hand it to anyone else is a legal obligation to do so.
How long we keep it
- Enquiries: kept while there is an active conversation, and for up to three years afterwards, so we can pick up where a project left off. Then deleted.
- Analytics: retained by Google for 14 months, then aggregated.
- Server and spam-limit logs: weeks, not years.
- Atlas conversations: not stored by us at all.
How it is protected
Everything is served over HTTPS. The enquiry database is not public and is reachable only through an authenticated admin area. Admin passwords are never stored, only a salted PBKDF2-SHA256 hash, and the database holds only a hash of each session token, so a stolen copy of it hands nobody a working login. Uploaded images live in a private bucket and are served through the site rather than from a public URL.
No system is perfect. If we ever discover a breach that creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and tell the people affected, as PIPEDA requires.
Your rights
Under PIPEDA and Alberta's PIPA you may ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct anything that is wrong;
- delete it, where we are not legally required to keep it;
- withdraw a consent you previously gave.
Email info@nagisolutions.com and say what you want. We will answer within 30 days, and it costs nothing. We may need to confirm who you are first, which is a protection for you rather than an obstacle.
If you are not satisfied with how we handled it, you can complain to the Office of the Privacy Commissioner of Canada or, in Alberta, to the Office of the Information and Privacy Commissioner of Alberta.
Children
This site is aimed at businesses. We do not knowingly collect personal information from anyone under 13. If you believe a child has sent us something, email us and it will be deleted.
Changes to this policy
If this changes, the date at the top changes with it. Material changes will be described here rather than quietly applied. A policy nobody can diff is a policy nobody can trust.
Contact
NCGI Nagi Consulting Group Inc.
Calgary, Alberta, Canada
info@nagisolutions.com
We run email-only intake by choice, so there is no phone number to call. Email gets a real answer, usually the same day.