Privacy policy
Effective 5 September 2026 · Version 1.0
Duly Qualified is a product of Intelligent Metrics Inc., a corporation registered in Ontario, Canada, which is the organization accountable for personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA). This policy says what we collect, why, where it goes, how long it stays, and what you can ask of us. It is written to be read in one sitting.
It covers:
- visitors to dulyqualified.com;
- people who request a gap report or subscribe to the weekly digest;
- clients, and the people they authorise to use the portal at app.dulyqualified.com;
- people named in documents a client gives us, such as the individuals on a résumé or a security form; and
- firms named in the public procurement record, which we use as published.
1. What we collect, and why
When you read the site. Our analytics provider, PostHog, records the pages you open, how far you scroll, the site you came from, your browser, an approximate location from your IP address and - on the public site only - a replay of your session with every typed character masked. This tells us which pages earn attention and which do not. It is not used for advertising, and there is no advertising here. If you arrive through a link we tagged (in the digest, say), your browser keeps the tag in its own storage so that, if you later fill in a form, we can tell which channel brought you.
When you ask for a gap report. Your work email, your firm’s name, your name if you give it, and the vehicle you are asking about; with them, the page you were on, the tags described above, and your IP address, which our bot check (Cloudflare Turnstile) sees. We use these to build the report, send it, and follow up if you ask us to. Once you have submitted a form we connect your earlier anonymous visits to you, so that we know what you read before you wrote.
When you subscribe to the digest. Your email address and language, plus a consent record - the time, the IP address, your browser and the form - that Canada’s anti-spam legislation expects us to be able to produce. We record whether an issue bounced, whether it was opened or a link in it clicked, and when you unsubscribe.
We score leads. From the above - what you read, how you arrived, whether you opened an issue, and whether the public record shows a gap between the work your firm wins and the vehicle that gates it - we compute a number that decides whom we contact first. The number is an ordering, not a judgment about you, and it is not shared.
When you are a client. The email addresses and names of the people you authorise; their password (stored as a hash) and second-factor secret (never displayed again); sign-in and activity logs; your firm’s profile - capabilities, certifications, security clearance level, regions, contract value band, the work you will not bid on; the documents you upload; every verdict we give you and what happened after it; and your billing address and subscription state. We use all of this to decide which opportunities are worth your attention, to tell you, to prepare submissions, and to bill you. That is the whole list.
Payment. Stripe takes your payment. We never see or hold your card or bank details. We hold your billing address, because tax is charged by it.
People named in client documents. A résumé or a security form names an individual and describes their employment. The client that uploads it is responsible for having the right to give it to us; we hold it only to prepare that client’s submission, and this policy is our notice to the person named. We do not contact those individuals, and we do not use their information for any other purpose.
Firms in the public record. Gap reports and prospecting use published federal procurement data - CanadaBuys notices, contract history, the PSPC holder list - exactly as published. It is business information, not personal information, and we use it to say what the record says.
Email you send us is kept, with anything in it, as a record of the conversation.
We do not collect government identifiers, financial account credentials, health information or biometrics, and we ask you not to upload them. The services are not directed at anyone under eighteen.
2. Consent
Where the law requires consent we ask for it where the information is collected: a form that says what happens next, and, for the digest, a confirmation link that has to be clicked before anything else is sent. For business contact information used to reach you about the service you asked about, PIPEDA lets us rely on the request itself. You can withdraw consent at any time (section 7), subject to what we must keep.
3. Who else sees it
We do not sell personal information, and we do not share it for anyone else’s marketing. It goes to the service providers that make the product work, each receiving only what its job needs.
| Provider | Job | Where it processes |
|---|---|---|
| A Canadian hosting provider | Runs the server that holds the database, the subscriber list and the working copy of client documents | Canada |
| Cloudflare | Delivers the site and the portal, filters attacks, runs the bot check on the forms, and stores encrypted client documents and backups | Its global network; what reaches it at rest is encrypted before it leaves Canada |
| PostHog | Site analytics, as described above | United States |
| SendGrid (Twilio) | Delivers the digest and transactional email | United States |
| Stripe | Subscriptions, invoices and payment | United States and Ireland |
Cloudflare, PostHog, SendGrid and Stripe are subject to the laws of the countries where they process, which means information held there can be reached by those countries’ authorities. Each is bound to us by data-processing terms. The database, the subscriber list and the decrypted form of any document stay in Canada.
We would disclose information if a Canadian court or a lawful authority ordered it, and would tell you unless the order forbade it. If the business were sold, the information would go with it to a buyer bound by this policy, and you would be told.
4. Where it lives, and how it is protected
The database and the working copy of client documents are on infrastructure in Canada with no public network ports; traffic reaches it only through an outbound tunnel. Client documents are encrypted before storage with a key kept separately from the storage itself, served only to the account that owns them, and every access is logged. Everything travels over TLS. Nightly backups are encrypted before they leave the server. Portal accounts require a second factor. The administration area sits behind an identity check at the network edge. The audit trail and the verdict ledger cannot be edited, by anyone.
No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner, as PIPEDA requires.
5. Cookies and browser storage
The public site sets no cookies of its own. PostHog uses cookies and browser storage to recognise a returning browser. Our attribution tag is kept in your browser’s local storage, is never sent to anyone but us, and only with a form you submit. Cloudflare may set a short-lived cookie for bot filtering. The portal uses a session cookie that is required to sign in. There are no advertising cookies and no third-party trackers.
You can clear or block any of these in your browser. The portal will not work without its session cookie; everything else will.
6. How long we keep it
| What | How long |
|---|---|
| Analytics events and session recordings | On PostHog’s retention: recordings for one month, events for one year |
| Gap-report requests and lead records | Twenty-four months after the last contact, then deleted |
| Digest subscription | Until you unsubscribe; the address then stays on a suppression list so it cannot be mailed again |
| Consent records | Permanently, as the proof that consent was given |
| Résumés and security forms | Two years after upload |
| Corporate records | Seven years after upload |
| Other client documents | One year after upload |
| Client profile and account | For the life of the engagement, then closed |
| Verdicts, outcomes, audit trail, deletion records | Permanently, and unalterably |
| Billing records | Seven years, as tax law requires |
Document deletion is automatic: a nightly job removes documents whose clock has run out and writes a record that it did - which file, when and why, never the contents.
7. What you can ask for
- A copy of what we hold about you, normally within thirty days, free.
- A correction. Change your profile in the portal, or ask us.
- Deletion. Remove a document yourself from the portal and it goes at once; ask us to erase one and it goes the same day. Ask us to delete your lead record and we will, keeping only what section 6 says we must.
- Closing your account. Ask from your account page in the portal. A person verifies who is asking and closes it, usually within two working days; section 6 says what is deleted then and what is kept.
- Withdrawal of consent. Unsubscribe from the digest with the link in any issue, effective immediately; or write to us.
- An explanation of how any of this works, in either language.
If you live in Quebec, the Act respecting the protection of personal information in the private sector also gives you the right to have personal information de-indexed and to receive it in a structured, portable format; ask and we will.
To exercise any of these, write to contact@dulyqualified.com with the subject line Privacy, or to the postal address below. We may ask you to confirm who you are before releasing anything.
8. Complaints
If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Quebec residents may also contact the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.
9. Changes
Changes are posted here with a new effective date. Portal users are emailed thirty days before a material change takes effect.
10. Who is accountable
Privacy officer: Edison Sinani, Intelligent Metrics Inc. contact@dulyqualified.com 895 Don Mills Rd, Two Morneau Shepell Centre, Suite 900 Toronto, Ontario M3C 1W3, Canada