Privacy Policy

1. Who we are & our commitment

I am a privacy and AI governance professional based in Toronto, Canada. This site supports thought leadership, professional profile information, and inquiries about consulting and advisory work.

Personal information is handled in line with thePersonal Information Protection and Electronic Documents Act (PIPEDA)and applicable provincial private-sector privacy laws where they apply. Practices also reflect core principles of accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.

Privacy contact:Mohammad@movahedi.ca

2. Scope

This policy applies to:

• Visitors and users of the website at movahedi.ca (and any staging or preview hostnames I control for the same property).
• Individuals who submit contact, discovery-call, newsletter, or similar inquiry forms.
• Limited technical data generated when the site is loaded (e.g., security logs, optional privacy-respecting analytics).

This policy does not cover personal information processed in my capacity as an employee of a third-party organization (for example, employment duties at an employer). Those activities are governed by that organization’s policies and applicable employment law.

Separate written engagement letters or statements of work may set additional confidentiality and data-handling terms for paid consulting. Where those terms are more specific, they govern that engagement.

3. Personal information we collect

We collect only what is reasonably needed for the purposes described below (data minimization).

3.1 Information you provide

• Contact & lead details: name, email address, organization/company, role (if provided), service interest, message content, and preferred meeting times.
• Optional fields:phone number, LinkedIn URL, project context, or attachments you choose to send.
• Newsletter or resource downloads (if offered):email address and related preferences.

3.2 Information collected automatically

• Technical & security data:IP address (or truncated equivalent), user agent, referrer, request path, timestamps, and similar log data needed to operate, secure, and troubleshoot the site and form endpoints.
• Optional analytics (if enabled):aggregated or privacy-oriented usage metrics such as page views, approximate geography, device/browser category, and referrers. Prefer privacy-respecting tools (e.g., Cloudflare Web Analytics) that avoid invasive cross-site tracking. SeeAnalytics.

3.3 Information we do not intentionally collect

We do not seek sensitive personal information (e.g., health, biometrics, government ID numbers, precise financial account data) through website forms. Please do not submit such data via public forms or email unless we have expressly arranged a secure channel for an engagement.

4. Why we use personal information

We use personal information for these identified purposes:

• Responding to inquiries and scheduling discovery or consulting conversations.
• Understanding your needs so we can propose appropriate services (privacy, AI governance, process excellence, advisory, etc.).
• Administering the website, preventing abuse/spam, and maintaining security and availability.
• Improving content and user experience using aggregated analytics (when analytics are enabled).
• Sending follow-up messages you request (e.g., proposals, resource links, or newsletter content you opt into).
• Meeting legal, regulatory, or professional obligations, and establishing, exercising, or defending legal claims.

We do not sell personal information.We do not rent or trade lead lists. We do not use contact-form data for unrelated third-party marketing.

5. Consent

By submitting a form or emailing us, you consent to our collection and use of the information you provide for the purposes stated on the form and in this policy. Where optional analytics or non-essential cookies are used, we will obtain consent as required by applicable law and present a clear choice (essential/security functions remain available without optional tracking).

You may withdraw consent subject to legal or contractual restrictions and reasonable notice. Withdrawal may limit our ability to respond to an inquiry or provide certain services. ContactMohammad@movahedi.ca to withdraw consent or update preferences.

6. Disclosure & service providers

We may share personal information with service providers who process it on our instructions, for example:

• Website hosting, CDN, DNS, and security providers (e.g., Cloudflare or similar infrastructure).
• Form delivery, serverless/API workers, and transactional email used to receive or acknowledge inquiries.
• Calendar or scheduling tools if you book a meeting through a shared link.
• Optional analytics providers configured in a privacy-respecting manner.

Providers are expected to protect information with appropriate safeguards and use it only to perform services for us. We may also disclose information if required by law, court order, or to protect rights, safety, and security.

7. Cross-border storage & processing

Infrastructure and vendors may process data in Canada, the United States, or other jurisdictions. When personal information is processed outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by foreign authorities. We take reasonable contractual and organizational steps to protect information consistent with this policy and PIPEDA’s accountability principle.

8. Retention

• Lead / inquiry data:retained only as long as needed to respond, follow up on an active opportunity, and meet record-keeping needs—typically up to24 months after last meaningful contact, unless a longer period is required for a live engagement, legal hold, or accounting obligation.
• Security logs:retained for a short operational period (often 30–90 days) unless needed to investigate abuse or security incidents.
• Engagement records:governed by the written agreement and professional record-keeping needs for that project.

When retention ends, we delete or irreversibly anonymize information where feasible.

9. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including HTTPS/TLS in transit, access controls on administrative and form backends, least-privilege practices, and vendor selection that considers security posture. No method of transmission or storage is perfectly secure; absolute security cannot be guaranteed.

10. Your rights

Subject to exceptions under applicable law, you may request to:

• Access the personal information we hold about you.
• Correctinaccurate or incomplete information.
• Delete information where we no longer have a legitimate need or legal obligation to keep it.
• Withdraw consentfor optional processing (e.g., marketing emails, non-essential analytics), where consent is the basis for processing.
• Challenge compliancewith this policy or applicable privacy law.

To exercise these rights, emailMohammad@movahedi.cawith enough detail to verify your identity and locate your records. We will respond within a reasonable time and in any event within timelines required by applicable law.

If you are unsatisfied with our response, you may contact theOffice of the Privacy Commissioner of Canadaor your provincial privacy regulator, as applicable.

11. Cookies, local storage & analytics

Essential technologies may be used for security, load balancing, preference storage (e.g., light/dark theme), and basic site function. These are not used to build advertising profiles.

Optional analytics:If enabled, we prefer privacy-forward measurement such asCloudflare Web Analytics(or a similarly privacy-respecting alternative). Such tools are configured to minimize personal data, avoid invasive cross-site tracking where possible, and support aggregated insight into traffic and content performance.

We do not currently intend to deploy advertising pixels or sell data to ad networks. If non-essential cookies or similar technologies are introduced that require consent under applicable law, a consent mechanism will be provided and this policy will be updated.

12. Children

This site is directed to professionals and organizations. It is not intended for children under 13 (or the age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will take appropriate steps to delete it.

13. Changes to this policy

We may update this policy to reflect operational, legal, or technical changes. The “last updated” date at the top will change when we do. Material changes will be highlighted on this page or by other reasonable notice where required.

14. Contact

Questions, access requests, corrections, deletion requests, or complaints about privacy practices: