Privacy Policy
Effective 21 October 2026
This Privacy Policy explains how Futurist IP, a corporation incorporated in Ontario, Canada, operating as CRA On Call ("we", "us", "our"), collects, uses, discloses and protects personal information when you visit craoncall.tech (the "Site"), use our free tools, or contact us. It applies to visitors, prospective customers and their representatives. Personal information we process on behalf of customers under a services agreement is governed by that agreement.
1. Who is responsible
Futurist IP is the controller of the personal information described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and is accountable for it under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). You can reach us about privacy matters through our contact form.
2. Information we collect
Information you give us
- Contact and enquiry forms: your work email address and, if you choose to provide them, your name, company, website, role, whether you sell connected products in the EU, your timeline and your message.
- Runbook request form: your work email address and the optional details on that form.
- Correspondence: anything you include when you reply to us or talk to us.
Information processed when you use the free tools
- Scanner: the domain name you enter. We use it only to fetch public web pages on that domain and return the result to you. We do not store the domain or the result.
- Paste-in checker and generator: text you paste or type is processed entirely in your browser and is never sent to us.
Information collected automatically
- Server logs: our hosting provider records technical data about requests to the Site, such as IP address, date and time, page requested, browser type and referring page, for security, abuse prevention and troubleshooting.
- Analytics: we use Vercel Web Analytics, which does not use cookies and reports aggregated data (pages viewed, button clicks, referring site, country, device and browser type). It does not identify you or track you across other websites.
We do not use advertising or tracking cookies, and we do not knowingly collect special categories of personal data.
3. How we use it and our legal bases
| Purpose | Information | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Replying to enquiries and providing what you ask for, such as the runbook | Form and correspondence data | Steps at your request before entering a contract; our legitimate interest in responding to business enquiries |
| Discussing, agreeing and providing our services | Form and correspondence data | Performance of a contract or steps before one |
| Following up on your enquiry about CRA reporting | Email and enquiry details | Our legitimate interest in developing business relationships. We don't send newsletters, and you can ask us to stop at any time. |
| Running the scanner you requested | Domain entered | Our legitimate interest in providing the tool you asked to use |
| Security, preventing abuse and keeping the Site working | Server logs | Our legitimate interest in protecting the Site and its users |
| Understanding how the Site is used | Aggregated analytics | Our legitimate interest in improving the Site |
| Meeting legal obligations and defending legal claims | Any of the above, as needed | Legal obligation; legitimate interest |
Under PIPEDA, we rely on your consent, which you give by submitting a form or using a tool for the purposes described here. You may withdraw consent at any time, subject to legal or contractual restrictions. We do not use your information for automated decision-making that has legal or similarly significant effects on you.
4. Who we share it with
We do not sell or rent personal information. We share it only with service providers that process it on our behalf and under our instructions:
- Vercel Inc. (United States): website hosting, serverless functions, server logs and analytics.
- Resend (United States): delivering form submissions to our inbox.
- Our email provider: storing our correspondence with you.
We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of our business, in which case the recipient will be bound by this policy or one offering equivalent protection.
5. International transfers
We are based in Canada, which the European Commission recognises as providing adequate protection for personal data processed by organisations subject to PIPEDA. Our service providers may process information in the United States and other countries. Where we transfer personal information from the EU or UK to countries without an adequacy decision, we rely on appropriate safeguards such as the EU–US Data Privacy Framework (and its UK extension) where the provider is certified, or standard contractual clauses. Information processed outside your country may be accessible to authorities there under local law.
6. How long we keep it
- Enquiries and correspondence: up to 24 months after our last contact with you, unless you ask us to delete it sooner or we need it for a contract.
- Customer records: for the duration of our agreement and as long afterwards as required for legal, tax and accounting purposes.
- Server logs: for the limited period set by our hosting provider, typically days to weeks.
- Scanner input: not stored.
7. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy;
- correct inaccurate or incomplete information;
- have your information deleted;
- restrict or object to our processing, including processing based on legitimate interests;
- receive your information in a portable format;
- withdraw consent where we rely on it, without affecting earlier processing.
To exercise these rights, use our contact form. We may need to verify your identity, and we will respond within the time required by applicable law, normally within one month. If you are not satisfied, you can complain to your data protection authority: in the EU, the supervisory authority where you live or work; in the UK, the Information Commissioner's Office; in Canada, the Office of the Privacy Commissioner of Canada.
8. Security
We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS), access controls, keeping submitted data out of public website code, and limiting what we collect. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Children
The Site is intended for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16.
10. Third-party websites
The Site links to other websites, such as ENISA and EUR-Lex. Their privacy practices are their own, and this policy does not apply to them.
11. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a new effective date and, where the changes are significant, take reasonable steps to let you know.
12. Contact
For questions or requests about this policy or your personal information, use our contact form and choose "A general question".