Effective Aug 7, 2026 · Last updated Aug 20, 2026
MTRX Studio builds websites and software for growing businesses in Southern Ontario. We collect as little personal information as we can, we do not sell it, and we do not use hidden trackers to follow you around the web.
This policy explains, in plain language, what we collect when you visit our website, why we collect it, who we share it with, and what you can ask us to do about it. It is written to meet our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
MTRX Studio (“MTRX Studio”, “we”, “us”, “our”) is a web design and development studio operating in Southern Ontario, Canada. We are the organization accountable for the personal information described in this policy.
Questions, access requests, and complaints go to our privacy contact at team@mtrxstudio.ca.
This policy applies to our public marketing website at mtrxstudio.ca, including our former address mtrx-studio.com, to the contact form on that website, to the signup form at mtrxstudio.ca/start, and to our client portal at internal.mtrxstudio.ca.
In other words, it covers you whether you are a visitor who never contacts us, someone who fills in the contact form, or a client with a portal account. The rules for using the site and the portal are separate, and live in our terms of use.
If we have also signed a written agreement with you for a project, that agreement governs the commercial relationship. It does not reduce any of the privacy rights described here.
It also does not cover the websites we build and host for our clients. Each of those sites is operated by the client, who is responsible for its own privacy practices.
When you submit our contact form, we collect the information you type into it:
We use this only to reply to you and to follow up about the work you asked about. There are no hidden fields, and we do not enrich or append data about you from other sources.
If you create a portal account through our signup form, we collect what the form asks for:
We record that last item because an agreement you cannot evidence is not much of an agreement. It is proof of consent, and nothing more.
Working on a project generates records, and we hold them in the portal so that you can see them too:
Payments and invoices run through Stripe. If you choose to keep a card on file for invoices or a monthly retainer, the card is stored by Stripe, not by us. We never receive or hold your full card number, expiry, or security code. What we keep is a Stripe reference that lets us bill you, the fact that a payment method is on file, and the last four digits and card brand as Stripe reports them.
We run our own analytics rather than a third-party service, because it lets us keep the data minimal. When you load a page, our system records only:
This measurement uses no cookies. We do not store your IP address, we do not create a device fingerprint or visitor ID, and we cannot link these page views to you or follow you across other websites. The result is a count of visits, not a profile.
We advertise through Google Ads. Our site loads a Google conversion tracking tag, which sets cookies in your browser and allows Google to measure whether an ad led to a visit or an inquiry. This tag is operated by Google, and information collected through it is handled under Google's own privacy policy. Unlike our own measurement above, this technology can recognize your browser across Google services.
We use it to understand which ads are working. We do not use it to build audience lists of individuals, and we do not sell or share it for anyone else's advertising.
Our website is delivered by Vercel, which automatically keeps short-lived server logs for reliability, abuse prevention, and security. These logs can include your IP address, browser and device type, the pages requested, and timestamps. We do not use these logs for marketing or analytics.
Our contact form is also rate limited to prevent spam and abuse, which involves briefly counting requests from a network address.
Our pages load typefaces from Google Fonts. As with any content loaded from another server, this means your IP address is visible to Google when the fonts are fetched.
We use the information described above to:
We will not use your information for a new, unrelated purpose without asking you first. We do not sell, rent, or trade personal information, and we do not send marketing newsletters to people who simply filled out the contact form.
We do not make automated decisions about you that have legal or similarly significant effects.
When you fill out and submit our contact form, you are expressly consenting to us using that information to reply to you.
When you create a portal account, you are asked to tick a box confirming that you accept our terms of use and this privacy policy. That tick is your express consent to the handling described here, and we record when you gave it.
For the anonymous page-view counting, security logging, and advertising measurement described above, we rely on implied consent — the standard basis for ordinary website operation under PIPEDA — together with the browser-level controls and opt-outs listed in the cookies section.
You can withdraw your consent at any time by emailing us, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent for us to hold your inquiry, we will delete it, which also means we will no longer be able to follow up with you.
You can ask us to delete your inquiry sooner — see your rights below.
The entire site is served over HTTPS. Contact-form submissions are validated and length-limited on our server, and are transmitted to our email provider over encrypted connections. Access to the systems holding inquiries is limited to the people at MTRX Studio who need it, and is protected by individual accounts.
No method of transmitting or storing information is completely secure. We work to protect your information using safeguards appropriate to how sensitive it is, but we cannot guarantee absolute security. If a breach ever created a real risk of significant harm to you, we would notify you and the Office of the Privacy Commissioner of Canada as the law requires.
Under PIPEDA, you have the right to:
To make a request, email team@mtrxstudio.ca. We will respond within 30 days. There is no fee for a normal request; if a request would be unusually costly, we will tell you the estimated cost before doing the work so you can decide whether to proceed. We may need to confirm your identity before releasing information.
Our site links to other websites, including our clients' sites, our social media profiles, and our client portal. We are not responsible for the privacy practices or content of sites we do not operate. We encourage you to read the privacy policy of any site you visit.
Our website and services are aimed at businesses, not children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us and we will delete it.
We may update this policy as our services or the law change. The current version is always posted on this page with the effective date shown at the top. If we ever make a change that materially affects how we handle information already collected from you, we will take reasonable steps to notify you directly.
If you have a question about this policy, want to exercise a right, or are unhappy with how we have handled your information, contact us first — most concerns are resolved quickly:
We will acknowledge your complaint, investigate it, and tell you the outcome in writing.
If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or by phone at 1-800-282-1376.