Privacy Policy & Personal Information Protection
Effective Date: November 14, 2026 • Last Reviewed: November 2026
Our PIPEDA Privacy Commitment
TorontoMetrix.com is dedicated to upholding the highest standards of digital privacy in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia PIPA, Alberta PIPA, Quebec Law 25, and Canada's Anti-Spam Legislation (CASL). We adhere strictly to the 10 Fair Information Principles governing digital publishing and news aggregation in Canada.
01 Accountability & Privacy Officer
We have appointed a designated Privacy Officer accountable for compliance across our newsroom and multi-source aggregator infrastructure. Inquiries regarding personal data handling, corrections, or PIPEDA access requests may be directed to [email protected].
02 Purposes & Limiting Collection
We collect minimal personal information solely for transparent, legitimate publishing purposes:
- Daily Briefings (CASL): Email addresses voluntarily submitted via newsletter sign-up forms, along with timestamped consent IP metadata and a one-click cryptographic unsubscribe token.
- Zero-Trust Passwordless Staff Access: Authorized editors and administrators authenticate via single-use keyed HMAC-SHA256 email passcodes and cryptographic Magic Links, never reusable passwords.
- Security & Audit Telemetry: Short-lived IP rate-limiting counters and security audit logs to prevent scraping, brute-force authentication attempts, and feed abuse.
- Anonymous Analytics: Where configured by administrators, aggregated traffic metrics (excluding personally identifiable editorial profiles).
03 Meaningful Consent & Anti-Spam (CASL)
In strict compliance with Canada's Anti-Spam Legislation (CASL), TorontoMetrix.com will never send electronic news briefings without express opt-in consent. Every electronic dispatch includes an immediate one-click unsubscribe URL processed automatically upon confirmation. Saved reader bookmarks operate strictly client-side in your browser storage without server-side tracking.
04 Cryptographic Safeguards & Retention
Sessions are HTTP-only, encrypted at rest, SameSite protected, and regenerated upon authentication. One-time verification codes expire automatically within 10 minutes and are stored solely as irreversible HMAC-SHA256 / SHA-256 digests. Outbound feed ingestion follows strict SSRF and XXE isolation policies so external news XML cannot access internal network resources.
05 Individual Access, Accuracy & OPC Escalation
You have the legal right under PIPEDA to access, rectify, or request deletion of your subscriber record at any time. Contact [email protected]. If an issue remains unresolved, Canadian residents may escalate directly to: