1. Who we are
The Site is operated by Makably Ltd ("Makably", "we", "us"), a corporation incorporated in Canada with its head office in Ontario.
Mailing address: 376 Cundles Rd W, Barrie, Ontario L4N 7C7, Canada.
Makably is a two-person consulting and software firm. We provide learning design, operations support, AI systems implementation, and web development to business clients. We do not sell products to consumers through the Site, and the Site has no user accounts, logins, or payment functions.
2. Who is accountable
Under the Personal Information Protection and Electronic Documents Act (PIPEDA), Makably is responsible for personal information under its control and has designated a person accountable for its privacy practices:
Lisa Ross, Co-Principal — responsible for information security and privacy
Email: lisa@makably.com
Mail: the address in section 1
Lisa Ross is a former privacy officer and set the firm's security standards. Questions, access requests, corrections, and complaints all go to them at the address above.
3. What we collect, why, and on what basis
We collect very little. The table lists everything we collect through the Site and in the ordinary course of business with clients.
| What | When | Why | Consent basis |
|---|---|---|---|
| Website usage data — the page you viewed and roughly when, your browser type, and a privacy-preserving daily visit count. We do not collect a persistent visitor identifier, and no analytics record we hold stores your IP address. Our hosting provider processes your IP address to deliver and protect the Site (see section 6). | Automatically when you load any page of the Site, via Cloudflare Web Analytics (details in the Cookie Notice) | To understand how the Site is used and improve it. We do not use this data to serve advertising, and we do not combine it with your name or email. | Implied consent; the data cannot identify you. Notice is given in this policy and the Cookie Notice. |
| Contact form submissions — your name, email address, company, and the message you write | When you submit the contact form | To respond to your enquiry | Implied by your submission, for the purpose of replying to you |
| Newsletter — the Site links out to Lisa's newsletter on Substack; we do not collect your email address on makably.com for this purpose | When you subscribe on Substack | N/A — Substack, not Makably, collects and processes this | N/A |
| Business contact information — name, job title, employer, work email, work phone, and the contents of our correspondence | When you or your organisation engages Makably, asks for a proposal, or corresponds with us | Contract administration, proposals, delivery coordination, invoicing, and keeping business records | Implied by the business relationship; express where we ask for it |
| Meeting notes and transcripts — what is said in meetings with clients and prospects, which may include the names and comments of attendees | When a meeting is recorded or transcribed using Granola, our meeting transcription tool | To keep an accurate record of decisions and actions | Attendees are told at the start of recorded meetings |
We do not collect, and the Site does not ask for, government identifiers, financial account details, payment card numbers, health information, or any other sensitive category of personal information.
The Site is not directed at children, and we do not knowingly collect personal information from anyone under 13.
4. Client data we do not hold
Most of Makably's work is done with our clients' information, not our own. Across our engagements we deliberately avoid taking custody of our clients' end-user, learner, customer, or financial data:
- We work inside the client's own environment, often on a client-issued device, so client data stays on the client's systems.
- Where we build or run systems for a client, they run on the client's own infrastructure or the client's own accounts.
- Where we build a system that will process sensitive information, we build and test it with synthetic data.
In these engagements Makably acts as a service provider under the client's instructions and the client's contract. Where a client's contract requires it, we use that information only for the engagement, keep it confidential, and return or delete it when the engagement ends. If you are a client's employee, learner, or customer and want to exercise privacy rights over information the client holds, contact that organisation — it decides how that information is used, and Makably does not have your records.
5. How we use AI tools
Makably uses AI tools in its work. Our written AI Acceptable Use Policy (effective March 26, 2026) classifies information into three tiers. Client personal information, customer financial records, confidential business intelligence, and credentials are never processed through any AI tool. Where AI tools assist our own operations, we use only paid or API tiers whose contracts prohibit the vendor from training on our inputs, and every client-facing deliverable produced with AI assistance is reviewed by a Makably principal before release.
Business contact information — names, work emails, and meeting notes — is processed through AI tools as part of our operations, including through MakablyOS agents and Granola, our meeting transcription tool.
We do not use AI to make automated decisions that have a legal or similarly significant effect on you.
6. Who we share personal information with
We do not sell personal information. We do not share it with third parties for their own marketing. We share it only with the service providers below, who process it on our behalf under their published commercial terms, and only for the purposes in section 3.
| Provider | What they do for us | What they may receive | Where they process it |
|---|---|---|---|
| Cloudflare, Inc. | Hosts and delivers the Site; protects it from bots and attacks; cookieless Web Analytics | IP address, request logs, aggregate page statistics | United States and Cloudflare's global network |
| Resend, Inc. | Delivers email from the contact form | Name, email address, message content | United States |
| Google LLC (Google Workspace) | Email, documents, calendar, contacts | Business contact information and correspondence | United States |
| GitHub, Inc. | Private code and project repositories | Contract and project records that may name client contacts | United States |
| Convex, Inc. | Backend for MakablyOS, our internal operations tool | Business contact information | United States |
| Granola | Meeting notes and transcription | Names and statements of meeting attendees | United States |
| AI vendors on our approved list (Anthropic, Perplexity, Google Gemini, GitHub Copilot, CodeRabbit, OpenAI, Gamma, ElevenLabs) | Drafting, research, code, and content assistance | No client personal information; see section 5 | United States, on API or paid tiers with no-training terms |
We may also disclose personal information where the law requires it — for example to comply with a court order, or to a regulator — and, if Makably is ever sold or merged, to the acquiring organisation as part of that transaction, subject to this policy.
7. Cross-border processing
Makably is based in Ontario. Most of the service providers in section 6 are based in the United States, so personal information we hold may be stored or processed there. About one in five of Makably's client relationships is with a US-based business, so we also hold the business contact information of people in the United States.
While personal information is outside Canada it is subject to the laws of that country, and government agencies, courts, or law enforcement there may be able to access it under those laws. PIPEDA does not prohibit these transfers; it makes Makably responsible for protecting the information wherever it is. We use providers on paid commercial terms with published security and data-processing commitments, we review their terms at least quarterly, and we keep the information to the minimum described in section 3.
We do not currently offer services in the European Union or to California consumers, and the GDPR and CCPA do not apply to the Site as it stands today.
8. Your choices and rights
Analytics. The Site's only analytics is Cloudflare Web Analytics, which is cookieless, stores nothing in your browser, and cannot identify you individually. No opt-out toggle is needed.
Withdrawing consent. You can withdraw consent to any collection or use that is not necessary to fulfil a contract with you, by contacting us (section 2). We will tell you what the consequences are, if any.
Access and correction. You can ask what personal information we hold about you, how it has been used, and who it has been disclosed to. You can ask us to correct it. We will respond within 30 days of receiving a request, or tell you if we need up to 30 more days and why. We may ask you to verify your identity before releasing information. If we refuse a request in whole or in part, we will tell you why and how to challenge the decision.
Complaints. Raise any concern with Lisa Ross first (section 2). If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.
9. How long we keep personal information
| Information | Retention |
|---|---|
| Website analytics data | No visitor-level data retained; Cloudflare Web Analytics reports only aggregate statistics |
| Contact form messages | 2 years, then deleted |
| Business contact information and correspondence | For the duration of the business relationship, then 7 years to meet Canadian tax, legal, and accounting obligations |
| Meeting notes and transcripts | 2 years |
10. How we protect it
Makably keeps its security posture deliberately simple and honest. The controls we actually have in place:
- Multi-factor authentication is enforced on every service that handles client or confidential information, including Google Workspace, GitHub, and Cloudflare.
- All company devices use full-disk encryption.
- Credentials and API keys are held in a dedicated secrets manager, never in code, and automated checks block them from being committed.
- All code repositories are private.
- Self-managed machines are reachable only over a private, device-authenticated network with no public access.
- Only the two principals have access to Makably's systems, on a need-to-know basis.
- A written incident response procedure sets out how we contain, assess, and notify if something goes wrong. Where a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA.
We do not claim certifications we do not hold. Makably has no ISO 27001, SOC 2, or Cyber Secure Canada certification, and does not commission third-party security audits or penetration tests.
11. Cookies and similar technologies
The Cookie Notice describes exactly which cookies and browser storage the Site uses, who sets them, and for how long.
12. Changes to this policy
When we change this policy we will update the effective date at the top of the page. If a change materially expands what we collect or how we use it, we will give notice on the Site before it takes effect and, where the law requires, ask for your consent again.
13. Contact
Lisa Ross, Co-Principal, Makably Ltd
lisa@makably.com
376 Cundles Rd W, Barrie, Ontario L4N 7C7, Canada