GuideFlow: Privacy Policy
In one line: We're a small Canadian software company. We collect only what we need to run GuideFlow, we tell you who we share it with, and you can always ask us what we have, fix it, or delete it. Just email ben@guideflow.ca.
Effective date: July 2, 2026 Who we are: 14926668 Canada Ltd., operating as GuideFlow ("GuideFlow," "we," "us," "our") Where we're based: Manitoba, Canada Website: guideflow.ca Privacy contact / data requests: ben@guideflow.ca Mailing address: 4 Reed Cove, Anola, MB R5L 0L5
GuideFlow is an early-stage product currently in private beta. This policy describes how we handle personal information today. As the product grows, we'll update this policy and change the effective date above.
1. Who this policy is for
GuideFlow is a booking and lead-management tool for hunting and fishing outfitters. Two different groups of people show up in this policy, and we handle their information differently:
- Outfitters, the businesses that sign up to use GuideFlow. This is your information, and we're responsible for it.
- Guests, the customers of those outfitters, whose details an outfitter enters into GuideFlow (names, trip inquiries, and so on). We handle this information on behalf of the outfitter, not for our own purposes. More on this important distinction in Section 3.
If you're a guest who booked a trip and you have a privacy question, the outfitter you dealt with is your first point of contact, because it's their record. We're happy to help route your request. See Section 3.
2. The two hats we wear
Privacy laws distinguish between the organization that decides why personal information is collected and used (sometimes called the controller) and a service provider that just processes information on someone else's instructions (sometimes called the processor). GuideFlow wears both hats depending on whose data we're talking about:
| Whose data | Our role | |
|---|---|---|
| Our own users | Outfitter account and signup info | We're the controller, so we decide why we collect it and we're responsible for it |
| Guests / customers | Info an outfitter enters about their own customers | We're the processor, so we only handle it to provide the service to the outfitter |
The rest of this policy is organized around those two roles.
3. When we're the CONTROLLER (your outfitter account)
This section covers information about you, the outfitter: the business and the person signing up.
What we collect
When you request beta access (public signup form):
- Your name
- Business name
- Phone
- Website
When you create an account and use GuideFlow:
- Business name, contact email, phone, website, province
- Login credentials (your email and a securely stored password)
- Basic usage information (e.g., that you logged in, which features you used) so we can run and improve the service
Why we collect it
- To create and run your account
- To provide support and respond to you
- To send you the emails described in Section 5
- To improve GuideFlow and understand how it's used
- To keep the service secure and prevent abuse
Our legal basis (Canada)
We collect, use, and disclose your personal information with your knowledge and consent, as required by PIPEDA (Canada's federal privacy law) and, for anyone in Quebec, Quebec's Law 25. By signing up and using GuideFlow, you're consenting to the handling described here. You can withdraw that consent at any time. See Section 8.
4. When we're the PROCESSOR (your customers' data)
When you, an outfitter, enter your customers' information into GuideFlow, you remain responsible for that data. You're the controller of it; we're just the service provider that stores and processes it so we can give you the tool.
What outfitters store in GuideFlow about their guests
- Guest first and last name
- Email and phone
- Trip details and booking dates
- Locations
- Free-text messages and notes
What we do with it
We only use guest information to provide the GuideFlow service to the outfitter, for example, storing the record, showing it in your dashboard, and sending follow-up emails on your behalf that you've set up. We don't sell it, and we don't use guest data for our own marketing.
What this means for you as an outfitter
- You're responsible for having the right to collect your guests' information and for any consent your guests need to give (including consent to receive emails, see Section 5).
- You control the records. You can edit or delete your guests' records yourself inside GuideFlow at any time.
- If one of your guests contacts us directly, we'll generally direct them to you, since it's your record. We'll help where we reasonably can.
5. Emails we send (and CASL)
We take Canada's anti-spam law (CASL) seriously. Here's every type of email GuideFlow sends:
- Guest Journey emails, automated follow-up emails sent to your leads, on your behalf, based on the sequences you set up. These go to your guests, not to you. You're responsible for making sure you have consent to email your own guests.
- GuideFlow Logbook emails, occasional product-update emails we send to outfitters about new features and changes.
- Transactional emails, things like your welcome email, password resets, and beta confirmations. These keep the service working and aren't marketing.
For every commercial email (Guest Journey and Logbook), we:
- Include a one-click unsubscribe link
- Include our mailing address (4 Reed Cove, Anola, MB R5L 0L5)
- Identify who the message is from
- Honour unsubscribe requests promptly
You can also just reply to any of our emails to opt out and we'll take care of it. Transactional emails don't have an unsubscribe link because they're necessary to run your account, but we don't use them to market to you.
6. Cookies and tracking
GuideFlow uses cookies and similar technologies for two purposes:
- Essential, things needed to log you in and keep the app working. These are always on.
- Analytics and advertising (non-essential), to understand how the site is used and to measure our marketing. We use Google Analytics 4, Google Ads, and the Meta (Facebook) Pixel for this. These may load when you visit our site.
We're building a consent banner that will let you accept or decline non-essential trackers up front. Until that's live, you can opt out using your browser settings or the tools below, and you can always email ben@guideflow.ca with any questions.
You can control cookies through your browser settings, and you can opt out of some ad tracking directly:
- Google Analytics opt-out: tools.google.com/dlpage/gaoptout
- Google Ads settings: myadcenter.google.com
- Meta ad preferences: in your Facebook/Instagram account settings
7. Who we share data with (our service providers)
We don't sell your personal information. We do use a small number of trusted service providers ("sub-processors") to run GuideFlow. Each one only receives the data needed to do its job:
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database and login/authentication hosting | Cloud (see Section 9) |
| Vercel | Application hosting | Cloud (see Section 9) |
| Resend | Sending transactional and follow-up emails | Cloud (see Section 9) |
| Anthropic (Claude API) | Powers an admin-only "import packages from a website" feature, which sends the text of a web page to an AI model to help set up package listings | Cloud (see Section 9) |
| Google Analytics 4 & Google Ads | Analytics and advertising | Cloud (see Section 9) |
| Meta / Facebook Pixel | Advertising measurement | Cloud (see Section 9) |
The "import from a website" feature is used by us/admins, not something guests interact with, and it sends web page text (not guest personal records) to the AI model to help build package listings.
We may also disclose information if we're legally required to (for example, a valid legal request), or to protect our rights, users, or the security of the service.
8. Your privacy rights
Under PIPEDA and Quebec's Law 25, you have the right to:
- Access the personal information we hold about you
- Correct it if it's wrong
- Delete it (subject to any legal reason we might need to keep something)
- Withdraw consent to our use of it, or to our marketing emails
- Ask how we've handled your information
To exercise any of these, email ben@guideflow.ca and we'll respond within the timeframes required by law. If you're an outfitter, remember you can also directly edit or delete your guests' records inside GuideFlow yourself.
A note for Quebec visitors (Law 25): If you're in Quebec, Law 25 gives you these rights and a few extras, including the right to know when we use automated decision-making about you (we don't currently make automated decisions about individuals) and the right to data portability as those provisions come into force. Our privacy contact above also serves as the person responsible for the protection of personal information for GuideFlow. Reach them at ben@guideflow.ca.
9. Where your data is stored
GuideFlow's service providers may store and process data in Canada and/or the United States. This means your information (and your guests' information) may be transferred to, stored in, or processed in the U.S. by the providers listed in Section 7. We choose established providers and rely on their security practices, but you should know that data stored outside Canada may be subject to the laws of the country where it's held.
10. How long we keep data (retention)
- We keep outfitter account information for as long as your account is active, and for a reasonable period afterward if we need it to meet legal, security, or record-keeping obligations.
- We keep guest data for as long as the outfitter's account needs it to provide the service. Outfitters can delete guest records themselves at any time.
- When information is no longer needed, we take reasonable steps to delete or de-identify it.
Want your data deleted sooner? Email ben@guideflow.ca.
11. How we protect data (security)
We're a beta product, so we'll be honest rather than oversell this. We use reasonable safeguards appropriate for our size, including:
- Encryption in transit (data is encrypted as it travels between you and us)
- Row-level access isolation so one outfitter's data isn't visible to another
- Access controls limiting who on our side can see data
No online service can promise perfect security, and we won't pretend otherwise. If we ever experience a breach affecting your information, we'll notify affected users and any regulators as required by law.
12. Children
GuideFlow is a business tool built for outfitters. It's not directed at children under 18, and we don't knowingly collect personal information from children. If you believe a child has given us personal information, email ben@guideflow.ca and we'll delete it.
13. International visitors
GuideFlow is built for a Canadian audience and this policy is written to comply with Canadian law first. If you visit from outside Canada, please be aware your information will be handled in Canada and the U.S. as described above, under Canadian law. We haven't tailored this policy to the GDPR or other regional laws.
14. Changes to this policy
As an early-stage product, we'll update this policy from time to time. When we make a meaningful change, we'll update the effective date at the top and, where appropriate, notify outfitters by email or an in-app notice. Continuing to use GuideFlow after an update means you accept the revised policy.
15. Contact us
Questions, requests, or complaints about privacy? We'd rather hear from you than not:
14926668 Canada Ltd. (operating as GuideFlow) Email: ben@guideflow.ca Mail: 4 Reed Cove, Anola, MB R5L 0L5
If you're in Canada and aren't satisfied with our response, you also have the right to contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, if you're in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).