Privacy Policy

1. Who we are & our commitment

Movahedi Solutions is an independent privacy and AI governance consultancy based in Mississauga, Ontario, Canada. This site supports thought leadership, professional profile information, and inquiries about consulting and advisory work.

Personal information is handled in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private-sector privacy laws where they apply. Practices also reflect core principles of accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.

Québec: this company is based in Ontario, but Québec's Act respecting the protection of personal information in the private sector (Law 25) can apply to personal information collected about individuals in Québec. Where it applies, this policy is administered to meet its requirements, including the 30-day response period and the rules on consent, retention schedules, and confidentiality incidents described in this policy.

Privacy contact: mohammad@movahedi.ca

2. Scope

This policy applies to:

• Visitors and users of the website at movahedi.ca (and any staging or preview hostnames we control for the same property).
• Individuals who submit contact, discovery-call, newsletter, or similar inquiry forms.
• Limited technical data generated when the site is loaded (e.g., security logs, optional privacy-respecting analytics).

This policy does not cover personal information the founder processed as an employee of another organization. That processing was governed by that organization's policies and applicable employment law, not by this policy.

Separate written engagement letters or statements of work may set additional confidentiality and data-handling terms for paid consulting. Where those terms are more specific, they govern that engagement.

3. Personal information we collect

We collect only what is reasonably needed for the purposes described below (data minimization).

3.1 Information you provide

• Contact & lead details: name, email address, organization/company, role (if provided), service interest, message content, and preferred meeting times.
• Optional fields: phone number, LinkedIn URL, project context, or attachments you choose to send.
• Newsletter or resource downloads (if offered): email address and related preferences.

3.2 Information collected automatically

• Technical & security data: IP address (or truncated equivalent), user agent, referrer, request path, timestamps, and similar log data needed to operate, secure, and troubleshoot the site and form endpoints.
• Optional analytics (only with your consent): usage metrics such as page views, approximate geography, device/browser category, and referrers, collected through Google Analytics and Microsoft Clarity. These load only after you accept analytics in the cookie banner; declining leaves them off entirely. See Analytics.

3.3 Information we do not intentionally collect

We do not seek sensitive personal information (e.g., health, biometrics, government ID numbers, precise financial account data) through website forms. Please do not submit such data via public forms or email unless we have expressly arranged a secure channel for an engagement.

4. Why we use personal information

We use personal information for these identified purposes:

• Responding to inquiries and scheduling discovery or consulting conversations.
• Understanding your needs so we can propose appropriate services (privacy, AI governance, process excellence, advisory, etc.).
• Administering the website, preventing abuse/spam, and maintaining security and availability.
• Improving content and user experience using aggregated analytics (when analytics are enabled).
• Sending follow-up messages you request (e.g., proposals, resource links, or newsletter content you opt into).
• Meeting legal, regulatory, or professional obligations, and establishing, exercising, or defending legal claims.

We do not sell personal information. We do not rent or trade lead lists. We do not use contact-form data for unrelated third-party marketing.

5. Consent

By submitting a form or emailing us, you consent to our collection and use of the information you provide for the purposes stated on the form and in this policy, including using it to respond to your request. Contacting us does not subscribe you to marketing: the newsletter is a separate opt-in, and you can unsubscribe at any time. Where optional analytics or non-essential cookies are used, we obtain consent through the cookie banner as required by applicable law and present a clear choice (essential/security functions remain available without optional tracking).

You may withdraw consent subject to legal or contractual restrictions and reasonable notice. Withdrawal may limit our ability to respond to an inquiry or provide certain services. Contact mohammad@movahedi.ca to withdraw consent or update preferences.

6. Disclosure & service providers

We may share personal information with service providers who process it on our instructions, for example:

• Website hosting, CDN, DNS, and security: Cloudflare (including the movahedi-ca Worker that serves this site).
• Email hosting: Google Workspace (mohammad@movahedi.ca). Newsletter delivery: MailerLite (double opt-in; you can unsubscribe any time). Meeting scheduling: Cal.com (booking page embed).
• Calendar or scheduling tools if you book a meeting through a shared link.
• Optional analytics: Google Analytics and Microsoft Clarity, loaded only after you consent in the cookie banner.

Providers are expected to protect information with appropriate safeguards and use it only to perform services for us. We may also disclose information if required by law, court order, or to protect rights, safety, and security.

7. Cross-border storage & processing

Infrastructure and vendors may process data in Canada, the United States, or other jurisdictions. When personal information is processed outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by foreign authorities. We take reasonable contractual and organizational steps to protect information consistent with this policy and PIPEDA's accountability principle.

8. Retention

• Lead / inquiry data: retained only as long as needed to respond, follow up on an active opportunity, and meet record-keeping needs, typically up to 24 months after last meaningful contact, unless a longer period is required for a live engagement, legal hold, or accounting obligation.
• Security logs: retained for a short operational period (often 30–90 days) unless needed to investigate abuse or security incidents.
• Engagement records: governed by the written agreement and professional record-keeping needs for that project.

When retention ends, we delete or irreversibly anonymize information where feasible.

9. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including HTTPS/TLS in transit, access controls on administrative and form backends, least-privilege practices, and vendor selection that considers security posture. No method of transmission or storage is perfectly secure; absolute security cannot be guaranteed.

10. Your rights

Subject to exceptions under applicable law, you may request to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete information where we no longer have a legitimate need or legal obligation to keep it.
• Withdraw consent for optional processing (e.g., marketing emails, non-essential analytics), where consent is the basis for processing.
• Challenge compliance with this policy or applicable privacy law.

To exercise these rights, email mohammad@movahedi.ca with enough detail to verify your identity and locate your records. We will respond within a reasonable time and in any event within timelines required by applicable law. Under Québec's Act respecting the protection of personal information in the private sector, access and rectification requests are answered within 30 days of receipt.

A note on portability (Québec): where the law gives you a right to receive your information in a structured, commonly used technological format, it covers computerized personal information collected from you. It does not cover information we create or infer about you, such as analysis or assessments.

If you are unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec if you are in Québec, or your provincial privacy regulator, as applicable.

11. Cookies, local storage & analytics

Essential technologies may be used for security, load balancing, preference storage (e.g., light/dark theme), and basic site function. These are not used to build advertising profiles.

Optional analytics: with your consent through the cookie banner, we load Google Analytics and Microsoft Clarity to understand aggregated traffic and content performance (page views, approximate geography, device and browser categories, referrers). Without your consent these do not load at all. You can change your choice at any time from the cookie preferences link in the footer.

We do not deploy advertising pixels and we do not sell data to ad networks. If other non-essential cookies or similar technologies are introduced that require consent under applicable law, a consent mechanism will be provided and this policy will be updated.

Public editorial content on this site (articles, pages, and the machine-readable llms.txt file) is open to search engine and AI indexing crawlers; robots.txt does not block GPTBot, ClaudeBot, or PerplexityBot.

12. How AI is used on this site

Ask widget: the question box on article and site pages sends your question to this site's own /api/chat endpoint. Answers are generated by Google's Gemini Flash model family (via the paid Google AI Studio / Gemini API) with Cloudflare Workers AI as a fallback; the API key stays on the server and never reaches your browser. The movahedi.ca application does not store your chat questions in an application database or use them to train AI models. Paid API traffic is not used to train models, but the platforms may retain transient technical metadata and abuse-monitoring logs under their respective platform terms.

Article audio: some articles offer a pre-generated audio version (MP3). Playing it loads the audio file; no account or additional data collection is involved.

NotebookLM link: some articles link to NotebookLM so you can open the article in your own NotebookLM session. That is your action in your Google account, governed by Google's terms, not by this policy.

Human review: site content, including articles and Trust Center documents, is reviewed by the founder before publication. AI assistance may be used in drafting; the published content is the founder's responsibility.

13. Children

This site is directed to professionals and organizations. We do not knowingly collect personal information from children. In Québec, a child under 14 cannot consent to the collection of their personal information; a parent or guardian must consent on their behalf. If you believe a child has provided information, contact us and we will take appropriate steps to delete it.

14. Changes to this policy

We may update this policy to reflect operational, legal, or technical changes. The "last updated" date at the top will change when we do. Material changes will be highlighted on this page or by other reasonable notice where required.

15. Contact

Questions, access requests, corrections, deletion requests, or complaints about privacy practices: