Last Updated: October 16, 2026

This policy works together with our Terms of Service (romanellosystems.com/terms-conditions).

1. Who we are

Romanello Systems is operated by Blake Romanello, a sole proprietor based in Vancouver, British Columbia, Canada ("we," "us," "our"). We build websites and automated lead, messaging and review-request systems for local businesses.

Two different roles:

• Our own information. For information about our clients, prospects and visitors to romanellosystems.com, we decide how it's used, and this policy explains how.
• Our clients' customers' information. For information about our clients' customers and leads that runs through the systems we provide, the client business is responsible, and we act only as its service provider (see section 7).

In short: we collect what we need to find and serve clients, build and run your website and systems, bill you and talk to you. We don't sell personal information. Our main providers store data in the United States. Your customers' data belongs to your business: we only handle it to provide our services, and we delete it 30 days after you cancel. You can ask to see or correct your information at any time by emailing our privacy officer.

2. What we collect

From you (clients and prospects):

• Contact and business details: name, business name, email, phone, address, website, industry.
• Business registration details needed to register your business phone number for text messaging, including your Canadian Business Number.
• Content you send us: text, photos, logos, reviews and business information for your website and Google Business Profile.
• Login access you choose to give us, such as domain registrar access for DNS setup.
• Our messages with you: emails, texts, calls and call notes.
• Billing details: payments are processed by our payment processor (Stripe). We see limited details such as your name, the card type and its last four digits, but we do not store full card numbers.

From visitors to our website: what you enter in our forms or chat widget, and technical information such as IP address, browser, device and pages visited (see section 5).

From public sources: business contact information that businesses publish in public listings, such as Google Business Profiles and online directories (business name, phone number, address, website, and the name of the owner or contact if listed). We use it only to contact those businesses about our services. If you ask us not to contact you again, we'll add you to our do-not-contact list and stop.

From other sources: information from your Google Business Profile when you authorize us, and message delivery and opt-out records from our messaging providers.

3. How we use it

We use personal information to:

• find and contact businesses that may be interested in our services;
• provide, set up and support our services (building and hosting websites, configuring domains, running automations and chat, registering your business for text messaging, and making updates);
• bill you and keep business and tax records;
• communicate with you about your account and services;
• market our own services to you, only with your consent or as Canada's Anti-Spam Legislation allows, with an unsubscribe option in every electronic message;
• understand how our website is used and measure our advertising (see section 5);
• keep our systems and accounts secure and prevent fraud or misuse; and
• meet our legal obligations and enforce our agreements.

We rely on your consent, which may be express or implied (for example, when you give us information to provide a service you asked for). You can withdraw consent at any time on reasonable notice, unless the law or a contract requires us to keep using it; we'll tell you what that would mean for your services.

4. AI tools

• What we use AI for: AI tools (including AI writing, image and design tools, assistants and agents) help us create website copy, images, message templates and automations, and operate and support our services.
• Who processes the data: information you give us, and client customer data, may be processed by the providers of those tools on our behalf, subject to their own terms and policies.
• Review and decisions: we review AI-assisted work before it goes live. We do not use AI to make decisions about individuals that have legal or similarly significant effects on them.

5. Cookies, analytics and advertising

Our website runs on GoHighLevel (LeadConnector), which uses cookies and similar technologies needed to run the site, its forms and the chat widget. Our forms use Google reCAPTCHA to block spam, which sends some device and usage information to Google. The site also loads fonts from Google.

We may also use analytics and advertising tools, such as Google Analytics and the Meta (Facebook) Pixel. These tools use cookies and similar technologies to collect information such as pages visited, device and browser details, and actions taken on our site. We use that information to understand how our site is used, to measure our ads, and to show our ads to people who may be interested. Google and Meta process this information under their own privacy policies.

Your choices:

• Browser settings: you can block or delete cookies, but some features (like forms and chat) may not work.
• Google Analytics: you can opt out with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout).
• Meta ads: you can control ads on Facebook and Instagram in your Meta ad preferences (facebook.com/adpreferences).

6. Who we share it with

We share personal information only as needed with service providers that help us run our business and deliver our services. These include:

• GoHighLevel/LeadConnector and its hosting providers;
• phone and messaging providers (such as LC Phone/Twilio) and telecom carriers;
• email delivery providers;
• our payment processor (Stripe);
• Google (Business Profile, reCAPTCHA and analytics);
• Meta (advertising);
• domain registrars; and
• AI tool providers.

A current list of our service providers is available on request.

Other disclosures:

• We may also disclose information where the law requires or allows it (for example, a court order or regulator request), to protect our rights or prevent fraud, or to a buyer of our business, who must protect it in the same way.
• We do not sell personal information.
• We never sell or share mobile phone numbers or SMS opt-in/consent information with third parties for their marketing. We share them only with carriers and messaging providers as needed to deliver messages, or where the law requires.

7. When we act for our clients

For our clients' customers' data (leads, messages, call logs, form submissions, review requests), the client business decides how it's used and is responsible for it, including getting proper consent under CASL and having its own privacy policy. We act only as the client's service provider:

• We use that data only to provide our services and on the client's instructions.
• We never sell it or use it to market to the client's customers.
• We protect it as described here and delete it when the service ends (section 8).

If you're a customer of one of our clients, please contact that business first. If you contact us, we'll pass your request on to them.

Domains, ownership and cancellation:

• Your domain, your content, your business phone number and your customer/lead data belong to your business. The website design, code and automations are owned by Romanello Systems (see our Terms of Service).
• When you cancel, we'll send your contacts and leads as a CSV file within 30 days of your request (ask by email before cancellation takes effect or within 30 days after), then delete them as described in section 8.
• If you give us domain registrar access, we use it only to set up DNS, store it securely, and delete it once setup is done or when you ask.

8. How long we keep it

We keep personal information only as long as we need it, then delete it or make it anonymous:

• Website inquiries, chat and form submissions that don't lead to you becoming a client: deleted within about 60 days of our last contact.
• Prospect information from public listings: deleted within about 60 days of our last contact, unless we're still talking. Our do-not-contact list is kept so we can keep honouring those requests.
• Client customer and lead data: deleted 30 days after your cancellation takes effect, or 30 days after we deliver your CSV export if that is later.
• Former-client account and contact information: deleted within about 60 days after the end of our relationship, except what we must keep in our billing records.
• Billing, payment and tax records: 6 years from the end of the tax year they relate to, as Canadian tax law requires.
• Text-message opt-in and opt-out records: while we provide messaging and for 3 years after, so we can show consent was honoured. Other text-message logs are kept for 12 months.
• Domain registrar credentials: deleted once DNS setup is done.

Where we use personal information to make a decision that directly affects someone (for example, declining or ending service), we keep that information for at least 1 year after the decision, as BC law requires, so the person can ask about it. We may keep information longer where the law requires or a dispute is ongoing. Copies in routine backups remain until they're overwritten.

9. How we protect it, and data outside Canada

We protect personal information with reasonable safeguards for its sensitivity, such as encrypted connections, two-factor authentication on key accounts where available, access limited to people who need it, and reputable providers with their own security programs. No system is perfectly secure.

Our main providers, including GoHighLevel and its sub-processors, store and process data in the United States, and some may access it from other countries for support. While it is there, it is protected by our contracts with those providers but may be accessed by courts, law enforcement or national-security authorities under the laws of those countries.

Breaches: If a breach of our safeguards affects personal information, we will act quickly to contain it and assess the risk. Where there is a real risk of significant harm, we will notify affected individuals and report to the Privacy Commissioner of Canada as required by law, and we will notify affected clients without undue delay. We keep a record of every breach.

10. Your rights

You can ask us:

• for access to the personal information we hold about you;
• how we have used it and who we have disclosed it to;
• to correct it if it's wrong; and
• to withdraw your consent or delete information we no longer need to keep.

Email our privacy officer (section 12). We may need to confirm your identity. We'll reply within 30 days, which the law lets us extend in limited cases. If we can't fully meet a request, we'll explain why.

You can unsubscribe from our marketing emails at any time, reply STOP to any text message, or ask us not to call you again.

Complaints: if you're not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca). For information handled across provincial or national borders, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you are in Quebec, Quebec privacy law may give you additional rights. Contact our privacy officer and we will help.

11. Children

Our services are for businesses. We don't knowingly collect personal information from children, and if we learn we have, we'll delete it.

12. Privacy officer and contact

Privacy Officer: Blake Romanello

Business: Romanello Systems, Vancouver, British Columbia

Email: [email protected]

Phone: (807) 697-7190

13. Changes to this policy

We may update this policy. We'll post the new version with a new "Last Updated" date and, for significant changes, we'll also try to email our clients. If a change means we'd use your information for a new purpose, we'll ask for your consent where the law requires it.