Privacy Policy

Prolific Software ("Prolific Software," "we," "us," or "our") respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit prolificsoftware.ca (the "Website"), subscribe to updates, join a product waitlist, use the Contact page to compose an email, contact us by email, or otherwise interact with the Website.

This Privacy Policy applies to the Prolific Software corporate website. Individual Prolific Software products, including CreditKO, MortgageIQ, FreelanceKit, and future products, may have their own privacy policies when those services become available. Where a product-specific privacy policy applies, that policy will govern the handling of personal information within that product.

1. Information We Collect

The information we collect depends on how you interact with the Website.

Information Submitted Through Website Forms

The Website currently contains four subscription forms:

• homepage newsletter;
• CreditKO waitlist;
• MortgageIQ waitlist; and
• FreelanceKit waitlist.

The only information you are intended to enter into these forms is your email address.

When a form is submitted, the Website records the email address, the subscription list associated with that form (newsletter, CreditKO, MortgageIQ, or FreelanceKit), the originating Website route, subscription status, creation and update timestamps, consent timestamp, consent source/type, and the server-controlled consent disclosure version. If a subscriber later unsubscribes, the Website may also record an unsubscribe timestamp and applicable suppression information. A hidden anti-bot field may also be submitted as part of the form and is normally empty.

The Website also stores cryptographic unsubscribe-link verification material, including a nonce and cryptographic hash. This information is generated by the application for security and unsubscribe processing; it is not information entered by the visitor. The application does not store the raw unsubscribe token.

Please do not submit sensitive financial, credit, banking, identification, health, or other confidential information through these subscription forms.

Information You Send Through the Contact Page or by Email

The Website provides a Contact page that collects the information you enter into its fields—such as your name, email address, optional company or organization, subject or reason for contact, and message—only to compose an email in your own email application addressed to hello@prolificsoftware.ca. The Website does not transmit or store those Contact page fields in Prolific Software's Website database. If you send the resulting email, or otherwise contact us by email, we may receive your email address and any information you voluntarily include in your message. Email communications are separate from the Website subscription forms.

Information Collected Automatically

The Website uses limited first party analytics and security controls. The application currently records:

• the allowlisted Website page path viewed;
• the referring hostname, where available, rather than the complete referring URL;
• the page view timestamp; and
• limited rate-limiting data used to protect forms and Website infrastructure.

For rate limiting, the application derives a daily salted hash from an IP address. The application does not store the raw IP address in its own database as part of this process. It also stores the applicable rate-limit count, window start, and update timestamp.

The Website application does not currently store browser or device type, operating system, approximate geolocation, exit pages, detailed interaction histories, user-agent strings, performance measurements, or device fingerprints as part of its first party analytics implementation.

Infrastructure providers may process additional request or operational information in connection with hosting, security, logging, or service delivery. Their practices are addressed further below.

2. How We Use Personal Information

We may use personal information to:

• manage newsletter and product waitlist subscriptions;
• provide requested announcements or product updates when communications are operational;
• respond to emails and other communications you initiate through the Contact page or by email;
• understand aggregate interest in Website pages and Prolific Software products;
• operate, secure, troubleshoot, and improve the Website;
• prevent abuse, automated submissions, security incidents, and technical problems;
• comply with applicable legal and regulatory requirements; and
• establish, exercise, or defend legal rights.

We will not use personal information for materially different purposes without appropriate notice or consent where required.

3. Electronic Communications

If you subscribe to updates or join a product waitlist, your email address and associated subscription list are stored so that Prolific Software may provide the communications you requested when those communications are operational.

Where required by applicable Canadian law, including Canada's anti-spam legislation, we will obtain any required consent before sending commercial electronic messages.

At the time of this policy's preparation, the Website does not itself send automated newsletter or waitlist emails. The Website provides an application-managed unsubscribe process that allows a subscriber to unsubscribe from a particular subscription list or from all Prolific Software marketing communications. Viewing an unsubscribe confirmation page does not change a subscription; the selected unsubscribe action is processed when the confirmation form is submitted.

An ordinary repeat subscription submission does not override an existing unsubscribe or global marketing suppression. Resubscription requires a separate affirmative confirmation through the Website.

You may also contact us using the privacy contact information below regarding a subscription or communication request.

4. Cookie-Free First Party Analytics

The Website's current first party analytics implementation is cookie-free. The application does not currently use local storage, session storage, IndexedDB, advertising tags, tag managers, third-party analytics SDKs, or remote fonts for visitor tracking.

First party analytics are limited to the Website page path, referring hostname where available, and page view timestamp.

The Website disables its first party analytics collection when a browser indicates Do Not Track (DNT) or Global Privacy Control (GPC).

If the Website's use of cookies, analytics, or similar technologies materially changes in the future, this Privacy Policy will be updated as appropriate.

5. Subscription Processing and Storage

Valid subscription submissions are normalized and validated before storage. Current validation includes checks relating to email format, the permitted subscription list and source route, request size, same-origin submission, anti-bot controls, and rate limits.

Subscription records are stored using Cloudflare D1 and currently include the email address, subscription list, originating route, subscription status, creation and update timestamps, consent timestamp, consent type, server-controlled consent disclosure version, unsubscribe timestamp where applicable, unsubscribe-link nonce, and cryptographic token hash. An all-marketing unsubscribe is also recorded in a global marketing suppression record.

A repeat submission for an address that is currently subscribed may refresh the applicable subscription and consent record. A repeat submission does not by itself reactivate a list-level unsubscribe or override an all-marketing suppression. Reactivation requires the Website's separate resubscription confirmation step and records fresh consent evidence.

The Website stores a server-controlled consent disclosure version, consent timestamp and type, and an unsubscribe timestamp when applicable. An all-marketing unsubscribe is also recorded in a global suppression record. The Website does not store a checkbox state, a separate Privacy Policy acceptance record, or the visitor's raw IP address as part of the subscription record.

The application stores a cryptographic hash and nonce used to verify unsubscribe links. It does not store the raw unsubscribe token.

6. How We Share Information

We do not sell personal information.

The Website currently relies on Cloudflare-managed infrastructure, including Cloudflare Workers, Cloudflare D1, and related hosting and image-processing services, to operate and secure the Website.

We may disclose personal information in limited circumstances, including to:

• infrastructure and service providers that process information on our behalf to operate, host, secure, or maintain the Website;
• professional advisers where reasonably necessary;
• government, regulatory, law-enforcement, or judicial authorities where required or permitted by law;
• parties involved in a potential or completed business transaction, reorganization, financing, acquisition, sale, or transfer, subject to applicable safeguards; or
• another party with your consent or at your direction.

No third-party advertising network or third-party analytics SDK is currently integrated into the Website application.

7. Processing and Storage Outside Canada

Prolific Software uses Cloudflare-managed infrastructure and does not currently represent that all Website information is stored or processed exclusively in Canada.

Information processed through service providers may be handled in jurisdictions outside Canada and may be subject to the laws of those jurisdictions, including lawful access by courts, law-enforcement agencies, or governmental authorities.

We will review our service provider arrangements and privacy practices as the Website and its supporting services evolve.

8. Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate operational, security, legal, accounting, or regulatory requirements.

Detailed first party page view records are retained for up to 13 months. The application removes records older than that period during subsequent valid analytics processing. Because cleanup is activity-dependent rather than scheduled, older records may remain until qualifying activity triggers cleanup; the operator also performs periodic retention checks.

Rate-limiting records are targeted for retention for no more than 48 hours. The application periodically removes older rate-limiting records as part of subsequent valid subscription processing; because this cleanup is activity-dependent rather than scheduled, older records may remain until a qualifying request triggers cleanup.

Active subscription records are retained while the individual remains subscribed and while the applicable communications program remains active. Unsubscribed and suppressed records are retained only as needed to honour the withdrawal, prevent accidental resubscription, reconcile future email provider records, address complaints, and meet applicable legal requirements. Suppressed records are initially reviewed three years after the later of the unsubscribe date or the last commercial message.

9. Security

We use reasonable administrative, technical, and organizational measures intended to protect personal information against unauthorized access, use, disclosure, alteration, loss, or destruction.

However, no Internet transmission, electronic storage system, or security measure can be guaranteed to be completely secure.

10. Your Privacy Rights

Depending on applicable law and the circumstances, you may have rights relating to your personal information, including the ability to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• withdraw consent where processing is based on consent, subject to legal or contractual restrictions;
• ask questions about how your information is handled; and
• raise a concern or complaint about our privacy practices.

We may need to verify your identity before responding to certain requests. Withdrawal of consent does not affect processing that occurred before consent was withdrawn and may affect our ability to provide requested communications.

11. Children's Privacy

The corporate Website is not directed to children, and we do not knowingly seek to collect personal information from children through its subscription forms.

If we learn that personal information was collected from a child in circumstances requiring parental or guardian consent, we will take appropriate steps in accordance with applicable law.

12. Third Party Websites

The Website may contain links to third-party websites or services.

We are not responsible for the privacy, security, content, or practices of third parties. We encourage you to review their privacy policies before providing personal information.

13. Product-Specific Privacy Practices

Prolific Software develops products that may eventually process information substantially different from the information handled by this corporate Website.

CreditKO, MortgageIQ, FreelanceKit, and other Prolific Software products may therefore be governed by separate privacy notices, terms, consent mechanisms, and security requirements.

This Privacy Policy should not be interpreted as describing the complete future data practices of those products.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to the Website, our practices, applicable law, or our service providers.

When we make changes, we will update the "Last Updated" date. Material changes may also be communicated through additional notice where appropriate or required.

15. Contact Us

Questions, requests, or concerns about this Privacy Policy or our privacy practices may be directed to: