Privacy Policy

1. Introduction

Green Turtle Cloud Accounting Inc., operating as RostyCFO ("we," "us," or "our"), is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation in British Columbia.

By using our website (rostycfo.com) or engaging our services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

2. Information We Collect

2.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us when you:

• Request a structural diagnostic: Name, company name, revenue range, email address, and whatever you choose to write in the context field
• Contact us by email: Your email address and the content of your message
• Engage our services: Business financial data, banking information, tax records, and other information necessary to provide fractional CFO services

2.2 Automatically Collected Information

This website runs no analytics and sets no cookies. We do not track page views, session duration, referral sources, or your activity across other websites, and we use no advertising or tracking technologies of any kind.

Cloudflare, which hosts and protects the site, processes technical request data such as IP address, user agent, and requested URL in order to deliver pages and defend against attack. We do not use that data to build a profile of you, and we do not combine it with the information in section 2.1.

If we introduce analytics in future, this policy will be updated before that happens.

3. How We Use Your Information

We use your personal information for the following purposes:

• Service delivery: To provide fractional CFO services, financial analysis, and strategic guidance
• Communication: To respond to diagnostic requests and other inquiries, to confirm that a request was received, and to provide client support
• Legal compliance: To comply with applicable laws, regulations, and professional standards

We do not send marketing or promotional email. We do not operate a mailing list, and there is no subscription form on this website.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

• Service providers: We may share information with the third-party service providers named in section 5, who assist us in operating our website, conducting our business, or servicing you. These providers are contractually obligated to protect your information and use it only for the purposes we specify.
• Professional advisors: We may share information with accountants, lawyers, and other professional advisors when necessary to provide our services or comply with legal obligations.
• Legal requirements: We may disclose information if required by law, court order, or government regulation, or to protect our rights, property, or safety.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.

5. Third-Party Services

Our website and services rely on two third-party platforms:

• Cloudflare: Hosts and protects the website. Diagnostic requests submitted through the form are stored in a Cloudflare D1 database, with access restricted to us.
• Resend: Delivers the notification and confirmation emails sent when a diagnostic request is submitted.

These third parties have their own privacy policies. We encourage you to review their policies before providing information through this website.

5.1 Processing Outside Canada

Cloudflare and Resend are United States companies. Information you submit through this website is therefore processed and stored on infrastructure that may be located outside Canada, including in the United States, and while it is there it may be accessible to foreign courts, law enforcement, and regulatory authorities under the laws of that jurisdiction. We use these providers under their standard data protection terms. If you would prefer not to submit information through the website for this reason, you may contact us directly by email instead.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Client financial data: Retained for 7 years after the end of the engagement, in accordance with Canadian tax and accounting standards
• Diagnostic requests and contact inquiries: Retained for 2 years unless a business relationship is established

When information is no longer needed, we securely delete or anonymize it in accordance with industry best practices.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Employee training on data protection and confidentiality

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights Under PIPEDA

Under PIPEDA and applicable provincial privacy laws, you have the following rights:

• Access: You have the right to request access to the personal information we hold about you
• Correction: You have the right to request correction of inaccurate or incomplete personal information
• Withdrawal of consent: You have the right to withdraw your consent to the collection, use, or disclosure of your personal information at any time (subject to legal or contractual restrictions)
• Deletion: You have the right to request deletion of your personal information, subject to legal retention requirements
• Complaint: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated

To exercise any of these rights, please contact our Privacy Officer at the contact information provided below.

9. Children's Privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child, we will delete it promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. We will notify you of material changes by posting the updated policy on our website with a new "Last Updated" date. Your continued use of our website or services after such changes constitutes your acceptance of the updated Privacy Policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:

12. Office of the Privacy Commissioner of Canada

If you are not satisfied with our response to your privacy concern, you have the right to file a complaint with: