Privacy Policy

Who we are

Neotheos Inc. is a Canadian federal corporation under the Canada Business Corporations Act. Sorcerer Solutions is the name of this consulting service. The registered office is 1665 Four Mile Creek Rd, Unit 7, Niagara-on-the-Lake, ON L0S 1J0.

Privacy contact: Spencer Hall, spencer@neotheos.com.

What we collect

Contact form

If you write through the contact form, we collect your name, email address, company if you give one, subject, and message. We use that to reply.

Account

An account stores your name, email address, company, job title, phone number, address fields (country, region, city, street, postal code), and company URL, as you provide them. It also stores the password as a hash, not as plain text, and whether the email address has been confirmed.

Location at registration and sign-in

When you register or sign in, we look up your IP address with ipinfo.io. We keep the country, region, city, organisation, and IP address with the account. We use that for security and fraud prevention. The operator of this site can see it.

Google sign-in

Google is an optional way to sign in. Email and password remain available. If you continue with Google, we receive your name, your email address, and your Google account id. We recommend a company email. During that sign-in your browser talks to Google, which may set its own cookies.

Quotes, messages, and files

A quote request stores the kind of work, the option you chose, your description, whether you marked it as sensitive, any budget you named, and the technology notes you added. Messages you send, and messages we send on the account, are stored with the account. Files you upload are stored with the quote or with the account. We use them only to prepare the estimate or deliver the engagement.

Cookies

We use essential cookies only.

• sorc-auth. Keeps you signed in. It is HttpOnly. The session can last up to 14 days and renews as you use the site.
• Antiforgery cookie. A cookie set by the server so a form on this site cannot be posted from another website. It is HttpOnly.
• sorc-claim. Set for up to 7 days when you submit an estimate or a budget before you have an account. It lets us attach that request to the account you create. It is HttpOnly, and we remove it once the request is attached.

The contact page embeds a Google map, and every page loads the Inter font from Google. Google may set or read its own cookies when your browser loads the map. We do not set analytics or advertising cookies.

Preferences stored in your browser

Your browser keeps a few settings on your device only. We do not receive them as account data. They are the theme (sorc-theme), visual preferences such as motion and effects (sorc-site-settings), a performance reading used to choose those effects (sorc-perf-benchmark), and whether you dismissed the short cookie notice (sorc-cookie-ok).

Server logs

The web server records access logs: IP address, user agent, pages requested, and referrer. We analyse those logs with self-hosted tools, GoAccess and AWStats, to run and secure the site. Those tools run on our server. They are not a third-party analytics service.

We do not use third-party analytics, advertising cookies, or tracking pixels. We do not sell personal information.

Who else processes it

• Amazon Web Services. The site is hosted in Canada, in the ca-central-1 region. Account data, quotes, messages, files, and server logs sit there.
• Google Workspace. Our email is Google Workspace. Email you send us, and email we send you, goes through Google.
• Google Fonts. Your browser downloads the Inter font from Google. Google can see your IP address when it does.
• Google Maps. The contact page embeds a map of the registered office. Your browser loads that map from Google, which can see your IP address.
• ipinfo.io. At registration and sign-in we send the IP address to ipinfo.io so we can record country, region, city, and organisation.
• Google sign-in. If you choose Continue with Google, Google authenticates you and sends us your name, email address, and Google account id.

We do not use an advertising network, and we do not share personal information for advertising.

How we use it

We use personal information to reply to you, prepare estimates and budgets, deliver an engagement, keep the service secure, and meet legal obligations. Service email about your own request, such as a confirmation link or a password reset, is part of that request.

We do not sell personal information. We do not share it for advertising. We do not add you to a marketing list because you used the contact form.

How long we keep it

We keep account data while the account is active, and as needed for the engagement and for our legal and accounting obligations. Invoices and payment records are kept for as long as tax law requires. Server logs are kept for a limited period, typically up to 12 months.

When you ask us to delete an account, we delete the personal information we are not required to keep.

Your rights in Canada

Neotheos Inc. is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). You may ask for access to the personal information we hold about you, ask us to correct it, and withdraw consent where consent is the basis for our use, subject to legal and contractual limits.

You may also complain to the Office of the Privacy Commissioner of Canada, at priv.gc.ca. Write to us first at spencer@neotheos.com if you want us to look at the matter.

If you are in the United States

We do not sell or share personal information as those terms are used in US state privacy laws. We honour requests to access, correct, or delete personal information. Email spencer@neotheos.com.

We do not knowingly collect personal information from children under 16. If you believe we have, write to us and we will delete it.

Commercial email

Canada’s anti-spam law (CASL) applies to commercial electronic messages. We do not send those without consent. Email about your own request, including an estimate reply, a confirmation link, or a password reset, is a transactional message about that request. It is not a mailing list.

Where the data sits

The service stores data in Canada. Some processors, in particular Google for email, fonts, the map, and optional sign-in, may process it in the United States. The IP lookup sends your IP address to ipinfo.io. The hosting region for the application, files, and logs is AWS ca-central-1.

How we protect it

Passwords are stored as hashes. The production site is served over HTTPS. A quote is visible to that account and to us, not to other clients. Uploaded files are not in a public folder. Downloading one requires a signed-in account that is allowed to see it.

No method of storage is perfect. If you have a security concern, email spencer@neotheos.com.

Deleting your account

Email spencer@neotheos.com from the address on the account and ask us to delete it. We will delete the account and the personal information we are not required to keep for legal or accounting reasons. Files and messages that belong to the account go with that deletion, subject to those obligations.

Changes

We may update this policy by posting a new version on this page. The date below is the effective date of this version.

Effective and updated October 15, 2026.