Your information
What we collect, why, where it goes, how long we keep it, and how to ask us about any of it.
Last updated: September 15, 2026
Onxtra Consulting is an Ontario, Canada company based in Toronto. We help organizations handle data carefully, so this page tries to do the same with yours. It covers this website and, in general terms, our consulting work. Canada's federal privacy law, PIPEDA, applies to us.
What we collect, and why
When you use the contact form: your name, email, company, phone number if you give it, which service you're interested in, and your message. We use it to reply to you and, if you ask, to write a proposal. That's the only form on the site, and there are no accounts.
When you visit any page: our server notes your IP address, browser, the page you asked for and when. We use this to keep the site running and to block abuse. We don't run analytics or advertising trackers, so nobody is building a profile of you from this site.
When we work for you: we may see personal information inside your systems, documents or data. How we handle it is set out in the written agreement for that engagement, and that agreement wins if it and this page differ.
What we don't do
- We don't sell your information, to anyone, ever.
- We don't use it for advertising.
- We don't put you on a mailing list unless you ask to be on one.
Who else sees it
Three companies help us run this site, and each sees only what it needs to:
- Amazon Web Services hosts the site and its database, in the United States.
- Cloudflare runs the "are you human?" check on the contact form, and sees your IP address and browser details to do it (their privacy policy).
- Google delivers our email, including the notification when you send us a message.
Beyond that, we'd only share your information if the law required it, or with our own lawyers or accountants, who are bound to keep it confidential.
Where it lives
Because our hosting and email providers are in the United States, anything you send through this site is stored there and is subject to US law while it is. We say this plainly because it's the kind of thing we'd flag for a client. Data we handle during an engagement is stored wherever your agreement with us says it should be.
How long we keep it
Contact-form messages: up to two years, so we can follow up, unless you've become a client, in which case they're part of that relationship. Server logs: a short period, then they're automatically overwritten. Engagement records: as long as our agreement with you and the law require.
How we protect it
The site only works over HTTPS. The database isn't reachable from the internet. Only named people can get into our production systems, and they do it with keys rather than passwords. Secrets are stored encrypted. We hold ourselves to what we recommend to clients, but no system is perfect and we won't pretend otherwise.
Cookies
One. It exists only to stop someone else submitting the contact form as you, it doesn't identify or track you, and it disappears when you close your browser. Cloudflare may set its own briefly while checking you're human.
Your rights
You can ask us what we have about you, ask us to fix it, ask us to delete it, or tell us to stop contacting you. Email info@onxtra.com and we'll answer within 30 days.
If you're not happy with our answer, you can take it to the Office of the Privacy Commissioner of Canada.
Children
This site is for organizations. We don't knowingly collect anything from anyone under 18.
If we change this page
We'll post the new version here and update the date at the top. If a change affects information we already have about you, and we have a way to reach you, we'll tell you.
Questions
Onxtra Consulting, Toronto, Ontario, Canada
info@onxtra.com