Privacy Policy
The Privacy Policy of Scarborough Hood Cleaning is the plain statement of what this website collects about you, where that information travels, how long it stays, and how to see, correct or remove it. It is written under the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal privacy law for Canadian businesses that collect personal information while trading. This site collects personal information in one place only: the quote form. Reading the rest of the site asks nothing of you beyond the standard access log every website keeps. Effective date: September 2026.
What the quote form collects
The five fields you fill in. A name, a phone number, an email address, the business or kitchen name, and a short message describing the job. All five are required, because a request missing any of them cannot be quoted. The identical form sits on the homepage and on the contact page.
Four attribution fields the page attaches. At the moment you press send, the page adds the full address of the page you are on, the path of that address, the title of the page, and a short form identifier that says whether the homepage form or the contact form was used. They exist so the business can tell which page produced a request, and they serve no other purpose.
The timing token. The page also sends a number that records when the page finished loading. The server compares that number with the moment the form arrived. A submission that lands within a few seconds of the page loading, or from a page opened many hours earlier, is the pattern of an automated script rather than a person, and it is discarded. The token does not identify you and is not passed on to the CRM.
The hidden trap field. The form includes one field that a visitor never sees and never fills in. A submission with that field completed is treated as automated and dropped, while the script receives an ordinary success response and moves on. A real visitor leaves nothing in it, so nothing about a real visitor is recorded through it.
Added by the server. Before forwarding, the server stamps the submission with the time it arrived, a random submission id so a double-tap or a retry shows as a duplicate rather than a second lead, the name of the form, and a source label naming this website.
Never requested. Payment card numbers, bank details, government identification and health information are not asked for on any page of this site.
Where a submission goes
First stop: a serverless function on this hostname. Your browser sends the form to a small program run by Netlify under the address of this site. That program refuses submissions posted from any other website, checks the trap field and the timing token, confirms all five fields are present and within a sensible length, and checks that the phone number contains ten digits. Nothing is stored at this step.
Second stop: the GoHighLevel CRM. A submission that passes those checks is forwarded, server to server, to an inbound webhook belonging to a GoHighLevel customer relationship system. Scarborough Hood Cleaning and its operating crew, Power Hoods Systems, run that system. There the submission becomes a contact record and triggers a notification, and a member of the crew may call, text or email you about the kitchen. Answering the request is the only purpose the record has.
Not sold, not shared for marketing. The record is not sold, rented, traded or placed on a list for any other business. No advertising network receives it. Any message you receive from it is a reply to your request or a step in arranging the visit you asked for.
Storage location. Netlify and GoHighLevel run infrastructure that may sit outside Canada. PIPEDA allows a business to use a provider outside the country provided the information is protected by contract, and each provider publishes its own privacy and security terms.
Retention, access, correction and deletion
How long a record lasts. A request that never turns into a booking is held for as long as it takes to answer it and to recognise the same kitchen if it calls back. A completed visit is different. The signed certificate and its before-and-after photographs are safety records that a kitchen may need to show Toronto Fire Services, an insurer, a landlord or a buyer of the business, so those are kept, along with the contact details needed to reissue them.
Seeing your record. PIPEDA gives you the right to ask what personal information a business holds about you. Call 647-370-3454 or send a note through the contact page and ask for a copy.
Correcting it. A wrong digit in the phone number, an old email address or a misspelled kitchen name is fixed on request.
Deleting it. Contact details are removed on request. The one exception is the certificate and photographs for work already performed. Those are business and safety records and are retained, and the reason is explained rather than used to refuse the rest of the request.
If the answer does not satisfy you. Say so on the phone first. Anyone in Canada who believes a business has mishandled their personal information may also complain to the Office of the Privacy Commissioner of Canada.
Cookies, the chat widget, server logs and outbound links
Cookies. This website sets no cookies and no local storage of its own. There is no analytics script, no advertising pixel and no cross-site tracker on any page.
The chat widget. A chat widget supplied by GoHighLevel is loaded lazily, which means it is not fetched when the page opens and only arrives after your first interaction with the page. After loading, the widget stores its own cookie or local-storage token so a conversation survives moving between pages, and whatever is typed into it reaches the same CRM the form feeds. The widget is optional.
Server logs. The site is served by Netlify and mirrored on the Bunny CDN. Both keep standard access logs: the IP address of the request, the browser type, the page requested and the time. The hosting providers create and hold those logs for security and reliability. They are not used to build a profile of any visitor.
Outbound links. Pages on this site link to each other, for example the services hub and the NFPA 96 guide, and occasionally to an outside body such as a fire service or a public health unit. After you leave this domain, that site's privacy practices apply and this policy does not.
Changes. If the handling of information changes, this policy is updated and the effective date at the top is moved. The conditions a visit runs under are set out separately in the terms and conditions, and the about page describes the operating crew.
Privacy: frequently asked questions
Why does the form send the page address and title along with my details?
Page attribution is the only way the business can learn which page produced a request. The homepage and the contact page carry the same form, and the four attribution fields (address, path, title and form id) tell them apart. The fields sit on the contact record and are used for nothing beyond that.
Does the timing token identify me or my device?
The timing token is a number built from the moment the page loaded and nothing else. The server uses it to drop submissions that arrive quicker than anyone could read the form, and ones sent from a page that was opened hours before. It holds no name, no device detail and no location, and it is not forwarded to the CRM.
Can a crew member text me after the form goes through?
A text is possible. The contact record lets the crew call, text or email about the request, and a text is often the quickest way to confirm an overnight window. Reply stop to any text, or say so on the phone, and the messages end. No marketing sequence runs from this website.
Does the chat widget follow me to other websites?
The GoHighLevel widget writes storage on this domain alone, and only so a single conversation follows you from page to page on this site. It does not load until you first interact with the page, its provider publishes its own privacy terms, and you can ignore it entirely.
Who do I ask to have my details deleted?
Deletion requests go to 647-370-3454 or through the contact page. Contact details are removed. If work was performed, the certificate and photographs for that visit stay on file as a safety record, and that single exception is explained at the time rather than used to refuse the request.