The short version
We are a Canadian firm. We collect personal information when you fill in a form, use the diagnostic tool, book a call, or email us.
We run analytics and advertising tracking on this site. Non-essential tracking only fires after you accept it. You can change that at any time through cookie settings.
We do not sell your personal information. We do not add you to a mailing list because you filled in a form.
The diagnostic tool saves your answers as you go, before you press submit. Section 04 explains exactly how that works.
This summary is not the policy. The sections below are.
01 //Who we are
Long Tail Marketing Ltd., an Ontario corporation operating as Long Tail, is the organisation responsible for the personal information described in this policy.
Long Tail Marketing Ltd.
510-872 Sheppard Avenue West
Toronto, Ontario M3H 5V5, Canada
Our Privacy Officer is the person accountable for our compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector as amended by Law 25.
02 //What this policy covers
This policy covers personal information we collect through longtail.marketing, our forms, our diagnostic tool, our email, and our calls.
It does not cover client systems. When we install tracking, automation, or AI agents inside a client’s accounts, the client owns that data and decides what happens to it. In that arrangement we act as a service provider on the client’s instructions. The terms are set out in our Data Processing Agreement, not here.
If you filled in a contractor’s contact form and reached this page by accident, the contractor is the organisation that holds your information. Contact them.
03 //What we collect
Information you give us
| Where | What we collect |
|---|---|
| Consult request form | Name, work email, phone number, business name, website, role, marketing budget range, message text, consent state |
| Design partner form | Name, firm, role, work email, message text |
| Diagnostic tool | Business inputs (trade, ad spend, call volume, booking and close rates, coverage arrangements, job value), plus the contact fields listed above |
| Email and phone | Anything you choose to send us, including attachments |
| Discovery and consult calls | Meeting notes, plus the video recording and transcript of the call |
On call recording. Discovery and consult calls are video calls, and we record them. We use recordings to write up notes, scope the work accurately, and brief our team. You are told at the start of every call. If you would rather not be recorded, say so and we will turn it off. The call still happens.
We do not ask for financial account details, government identifiers, health information, or any other sensitive category. Do not send them to us.
Information we collect automatically
- IP address, approximate location derived from it (city and region level), and time zone
- Device type, operating system, browser, screen size, and language
- Pages viewed, time on page, scroll depth, clicks, and the order you moved through the site
- The page or ad that sent you here, including referrer URL and UTM parameters
- Advertising click identifiers:
gclid(Google),fbclid(Meta),msclkid(Microsoft),ttclid(TikTok) - Session recordings and heatmaps, where you have accepted analytics cookies
On session recording: our analytics tooling records how you move through a page. Form field contents are masked before the recording is stored. We see that a field was filled, not what you typed into it. Password and payment fields are never captured.
Information from advertising platforms
Google, Microsoft, Meta, and TikTok report aggregate campaign performance back to us. Those reports tell us that a campaign produced conversions. They do not tell us who you are.
04 //How the diagnostic tool handles your answers
The diagnostic tool is a multi-step calculator. It is worth being direct about how it works.
Your answers are saved as you go. Each time you complete a step, the tool sends the answers so far to our systems. This happens before you reach the final screen and before you press submit. If you abandon the tool halfway, the answers you already entered have been recorded.
Contact details are collected at a specific step. The tool asks for your name, role, work email, phone, and business name at the report stage. If you leave before that step, we hold your business inputs without your identity attached.
Your inputs are estimates, and so are our outputs. The tool applies published industry coefficients to numbers you supply. The result is a model, not an audit of your business. We use it to prepare for a call. It is not a promise of recoverable revenue.
We use the answers to prepare a written report and a discovery call. We do not sell them, publish them, or share them with your competitors. Where we cite diagnostic data in aggregate, individual businesses are not identifiable.
05 //Why we collect it
| Purpose | What it covers |
|---|---|
| Responding to you | Answering enquiries, booking calls, sending the report you asked for |
| Delivering the work | Scoping an install, preparing proposals, running an engagement |
| Running the site | Serving pages, keeping the site secure, blocking spam and abuse |
| Measuring our own marketing | Understanding which channels bring in enquiries that turn into work |
| Advertising | Measuring ad performance and, where you have accepted it, showing you Long Tail ads on other platforms |
| Legal obligations | Meeting record keeping, tax, and anti-spam requirements |
We collect what we need for the purpose and nothing beyond it. If we ever want to use your information for a new purpose, we will ask first.
06 //Consent, and how to take it back
Site tracking. Non-essential cookies and pixels stay switched off until you accept them. Essential cookies that make the site work do not require consent and cannot be turned off. You can change your choices at any time through cookie settings. Withdrawing consent stops future collection. It does not erase what was already collected, though you can ask us to delete that separately under section 12.
Forms. Consent to receive commercial messages is a separate, unchecked box. We do not pre-tick it. Submitting a form is a request for a reply, not a subscription.
Email. Every commercial message we send carries our identity, our contact details, and a working unsubscribe link, as required by Canada’s Anti-Spam Legislation (CASL). Unsubscribing takes effect within ten business days and usually within minutes.
Withdrawing consent has consequences we will be straight about. If you withdraw consent to be contacted, we cannot send you the report you asked for. If you refuse analytics cookies, the site still works exactly the same.
07 //Cookies, pixels, and tracking technology
We use first-party cookies and a server-side tag container. Third-party tracking cookies are not set on this site.
Server-side tagging means the tracking code runs on infrastructure we control rather than in your browser. It gives us cleaner measurement. It does not hide anything from you, and it does not change what the platforms below receive.
| Category | What it does | Tools | Consent |
|---|---|---|---|
| Essential | Serves pages, balances load, blocks spam, remembers your cookie choices | Vercel, our consent tool | Not required |
| Analytics | Tells us which pages are read, where visitors drop off, how the diagnostic tool performs | Google Analytics 4, Microsoft Clarity | Required |
| Advertising | Measures which ads produce enquiries, and builds audiences for Long Tail ads | Google Ads, Microsoft Advertising (UET), Meta Pixel and Conversions API, TikTok Pixel and Events API | Required |
On advanced matching. When you submit a form and have accepted advertising cookies, we may send a one-way encrypted (hashed) version of your email address or phone number to Google, Meta, Microsoft, or TikTok. The platform compares that hash against its own records to confirm the ad worked. We do not send the platform your name, your business details, your diagnostic answers, or your message. This only happens with advertising consent in place.
Global Privacy Control. We honour the GPC signal. If your browser sends one, non-essential tracking stays off and you will not be asked again.
Do Not Track. There is no agreed standard for how sites should respond to DNT headers, so we do not act on them. Use the consent banner or GPC instead. Both work.
08 //Who we share it with
We do not sell personal information. We do not trade it, rent it, or hand it to data brokers.
We share it with service providers who need it to do a job for us, under contracts that limit them to that job:
| Provider | Role | Processing location |
|---|---|---|
| Vercel | Site hosting and delivery | United States |
| Zapier | Form submission routing and workflow automation | Canada and United States |
| Analytics, advertising, business email and calendar | United States | |
| Microsoft | Analytics and advertising | United States |
| Meta | Advertising | United States |
| TikTok | Advertising | United States |
We also disclose personal information when the law requires it: a court order, a warrant, a regulator’s demand, or a legal proceeding. If we are ever compelled to hand over information about you, we will tell you unless we are legally prohibited from doing so.
If Long Tail is acquired or merges with another firm, personal information may transfer as part of that transaction. The receiving organisation stays bound by this policy until you are told otherwise and given a chance to object.
09 //Where your data lives
Long Tail is a Canadian firm. Several of the providers listed above store and process data in the United States.
This matters for one reason: while your information is in another country, it is subject to that country’s laws, including lawful access by that country’s courts and government agencies. Canadian privacy law cannot override that.
Before we send personal information outside Quebec, we assess whether it will receive adequate protection, as Law 25 requires, and we put contractual protections in place with the provider. Our current assessments are available on request.
10 //How long we keep it
| Data | Retention |
|---|---|
| Enquiries and form submissions that do not become clients | 24 months from last contact |
| Diagnostic tool submissions | 36 months from submission |
| Abandoned diagnostic sessions with no contact details | 12 months |
| Client records and engagement files | Duration of the engagement plus 7 years |
| Call recordings and transcripts | 12 months, or the duration of the engagement plus 12 months for clients |
| Records we are required by law to keep | As long as the law requires |
| Analytics data in Google Analytics 4 | 14 months |
| Session recordings in Microsoft Clarity | 30 days. Aggregate metrics are kept for 13 months |
When a retention period ends, we delete the record or anonymise it so it can no longer be linked back to you.
11 //How we protect it
- Data in transit is encrypted with TLS. Data at rest is encrypted by our infrastructure providers.
- Access is granted by role and reviewed quarterly. Not everyone at Long Tail can see everything.
- Multi-factor authentication is mandatory on every account that touches personal information.
- Credentials live in a password manager. They are not shared over email or chat.
- We keep a register of confidentiality incidents, as Law 25 requires.
If a breach creates a real risk of serious harm to you, we will notify you and the relevant regulators, promptly and in plain language. We will tell you what happened, what was exposed, and what to do about it.
No system is perfectly secure, and any firm that tells you otherwise is selling something.
12 //Your rights
You can ask us to:
- Tell you what we hold. A copy of your personal information, and an account of who we have disclosed it to.
- Correct it. Fix anything inaccurate, incomplete, or out of date.
- Delete it. Remove your information where we have no legal reason to keep it.
- Stop using it. Withdraw consent, unsubscribe, or ask us to stop a specific use.
- Hand it over. Receive computerised personal information you gave us in a structured, commonly used technical format, or have it sent to another organisation.
- De-index it. Where information about you is being disseminated in a way that causes serious harm to your reputation or privacy, ask us to stop the dissemination or de-index the link.
Send requests to contact@longtail.marketing. We respond within 30 days. If we need longer, we will tell you why before the 30 days are up. There is no charge, and we will not ask you to justify the request.
We may ask you to confirm your identity before we act. This protects you, not us.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Quebec residents can complain to the Commission d’accès à l’information du Québec at cai.gouv.qc.ca. You do not need to go through us first.
13 //Automated processing
Our diagnostic tool calculates estimates from the numbers you enter. It does not make a decision about you, and no outcome is applied to you based on it. A person reads every enquiry we receive. Nobody is contacted or declined by software alone.
If an automated process is ever used to make a decision about you based only on your personal information, we will tell you at the time, explain the main factors behind the decision, and give you the chance to make your case to a person. You can ask us for that explanation at contact@longtail.marketing.
14 //Children
This site sells business infrastructure to business owners. It is not intended for anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has given us information, contact us and we will delete it.
15 //Changes to this policy
We update this policy when what we do changes. The effective date at the top tells you which version you are reading.
For material changes, such as a new category of data, a new purpose, or a new tracking platform, we will post a notice on the site for 30 days and, where the change requires it, ask for consent again. Continuing to use the site after a change means the updated policy applies to you.
Previous versions are available on request at contact@longtail.marketing.