Privacy Policy

1. Who We Are

SMMS Digital ("we", "us", "our") is a digital consulting firm based in Canada. We provide AI strategy, transformation, and education services to businesses. This policy explains how we collect, use, and protect your personal information when you visit smmsdigital.com or use our services, including our AI Readiness Assessment.

2. What We Collect

We collect the following personal information:

• Email address (required when you complete our AI Readiness Assessment)
• Company name, company size, and industry (optional, provided voluntarily)
• Quiz answers and your resulting AI readiness score
• Usage data: pages visited, browser type, device type, IP address, and referring URL
• Essential cookies for site functionality

3. Why We Collect It

We use your information to:

• Deliver your personalized AI Readiness Assessment report (the service you requested)
• Send follow-up marketing communications — only if you separately opt in; you can unsubscribe at any time
• Improve our website and services through anonymous, aggregated analytics

Legal basis (GDPR Article 6): We process your email under Article 6(1)(b) — performance of a contract — because delivering your requested personalized assessment requires contact information. For any marketing communications, we rely on your explicit, separately-obtained consent under Article 6(1)(a), which you can withdraw at any time. For analytics, we rely on legitimate interest under Article 6(1)(f) with appropriate safeguards and opt-out controls. We do not use your quiz responses for automated decision-making that produces legal or similarly significant effects (GDPR Article 22).

AI & Data Processing Disclosure

Your quiz responses and personal data are NOT used to train third-party AI models (OpenAI, Anthropic, Google, etc.). When we use AI tools internally to analyze aggregate trends, we do so only on anonymized, aggregated data. Your individual responses stay in our controlled Supabase instance and are never submitted to public AI services.

4. How We Store & Protect Your Data

Your data is stored in Supabase (hosted on AWS infrastructure with SOC 2 Type II compliance). We use encryption in transit (TLS 1.2+) and at rest. Access to your data is restricted to authorized personnel only through row-level security policies.

5. Who We Share It With

We share your data only with service providers who help us operate:

• Supabase Inc. — database hosting (North America, SOC 2 Type II, signed DPA with Standard Contractual Clauses for EU transfers)
• Cloudflare — site hosting and bot protection (Turnstile captcha)
• Vercel Inc. — website hosting and delivery

We do not sell, rent, or share your personal information for cross-context behavioral advertising (as defined under CCPA/CPRA). We do not trade your information. Ever.

6. Data Retention

We retain your assessment data for 24 months from the date of collection, after which it is automatically deleted or anonymized via scheduled database jobs. You can request immediate deletion at any time by contacting us — we will honor verified requests within 30 days.

7. Your Rights

Depending on your location, you have specific rights regarding your personal data:

European Union (GDPR)

• Right to access — request a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to restrict processing
• Right to data portability — receive your data in a machine-readable format
• Right to object — opt out of processing based on legitimate interest

United States (CCPA/CPRA — California Residents)

• Right to know what personal information we collect and how it is used
• Right to delete your personal information
• Right to non-discrimination for exercising your rights

Canada (PIPEDA / Quebec Law 25)

• Right to access your personal information held by us
• Right to request correction of inaccurate information
• Right to withdraw consent for data collection at any time

8. Cookies

We use essential cookies for site functionality only. We do not use third-party analytics or tracking cookies. You can manage cookie preferences through your browser settings.

9. International Transfers

Your data may be processed in Canada and the United States (where our hosting providers operate). For EU residents, these transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission. For Canadian residents, data remains within jurisdictions with adequate privacy protections.

10. Children's Privacy

Our services are designed for business professionals and are not directed at individuals under 16 years of age. We do not knowingly collect information from children.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via a notice on our website. The "last updated" date at the top of this page reflects the most recent revision.

12. Contact Us & Privacy Officer

To exercise any of your rights, ask a question, or file a complaint, contact our designated Privacy Officer. Under Quebec Law 25, our Privacy Officer is Stavros Pachoundakis. We respond to verified requests within 30 days.