Privacy policy

Last updated 28 September 2026

This Privacy Policy sets out how Heartbeat Media Solutions Inc. ("we," "us," or "our") collects, uses, discloses, and retains personal data in connection with hbms.co and the services provided through it, including the Loyalty Club. It outlines the lawful bases on which we rely, our security and retention practices, and the legal rights available to you.

1. Scope & data controller

Data controller: The controller of the personal data described in this policy is Heartbeat Media Solutions Inc., a company incorporated in Ontario, Canada, with its registered office at 71 Noake Crescent, Ajax, Ontario, Canada.

Contact: Enquiries concerning this policy or requests to exercise data rights should be directed to raymond@hbms.co.

Scope limits: This policy applies to personal data processed through hbms.co, the loyalty club, and related services where we act as a data controller. It does not apply to third-party websites linked from our platform, nor to instances where we process data strictly as a processor on behalf of a client under a separate written agreement.

2. Personal data we collect

A. Registration & account data

Account info: Name, email address, registration source page, and referring page.

Marketing consent evidence: Where you consent to receive marketing communications, we record the exact wording of the consent statement presented to you along with a date and time timestamp to satisfy legal evidentiary requirements under Canadian Anti-Spam Legislation (CASL).

B. Authentication data

Single-use codes: Access to the loyalty club is provided via single-use email authentication codes. These codes and their expiry timestamps are held in temporary storage solely for the duration required to complete authentication and are then permanently discarded.

C. Loyalty club, prediction & chat activity data

Game & prediction logs: Identity of prediction games, choices made, game scores, token balances, leaderboard ranks, and date and time of play.

Watch party & community chat logs: Messages, questions, and interactions posted within live chat rooms or watch party lobbies.

Store transactions: Order details and token redemption logs for merchandise items. (Note: we do not process or store payment card details directly on our servers.)

Delivery details: When you order merchandise, the name, phone number, and delivery address (including city, province or state, postal or ZIP code, and country) that you enter at checkout.

D. Correspondence & assistant support

Communications sent via email or submitted to the AI assistant within the loyalty club, including message content, user name, and email address.

E. Usage & technical data

Analytics data collected strictly following your consent via Google Tag Manager (including pages viewed and approximate location derived from IP address).

F. What we do NOT collect

We do not acquire personal data from data brokers, process raw payment card details on-site, or track users across third-party websites.

3. Lawful bases for processing

We process personal data only when a recognized lawful basis applies:

Registration data — Performance of a Contract — to create, administer, and maintain your account and service access.

Authentication data — Performance of a Contract — to verify account access entitlement via single-use email codes.

Loyalty & activity data — Performance of a Contract — to operate games, token balances, prize draws, chat rooms, and leaderboards.

Delivery details — Performance of a Contract — to fulfil and deliver the merchandise you order and to contact you about a delivery.

Marketing communications — Consent — to send news and updates where you explicitly opt in (withdrawing anytime).

Usage & analytics data — Consent — to measure site usage where accepted via cookie preferences.

Correspondence & AI logs — Legitimate Interests — to respond to support queries and maintain customer service records.

Page content delivery — Legitimate Interests — to load the images and wording shown on our pages from our content provider, which is necessary to display the page.

Post-deletion retention — Legal Obligation — to evidence marketing consent (CASL), honor suppression, and meet tax laws.

4. Third-party service providers & sub-processors

We disclose personal data to trusted service providers operating under strict confidentiality and security contracts. They process data solely on our documented instructions:

Netlify: Provides web hosting, form processing, and temporary storage for authentication codes.

Railway: Hosts our application database, which holds accounts, token balances, order records, and delivery details.

Delivery carriers: Where a courier or delivery partner is used, we share your name, delivery address, and phone number with them solely to deliver your order.

Twenty: Serves as our customer record system (CRM) holding accounts, activity logs, enquiries, and order and delivery details.

Slack: Receives internal notifications about unanswered support questions and new merchandise orders. Order notifications include the delivery details needed to fulfil the order.

Sanity: Provides the content management system our team uses to edit the images and wording shown on our pages. It holds the names and email addresses of the team members who sign in to edit. Our pages also load their images and editable wording from Sanity’s servers, so Sanity receives standard technical data, such as your IP address and browser details, when a page loads. We do not send member account data, orders, or delivery details to Sanity.

Resend: Transmits transactional email messages and single-use login codes.

Anthropic: Processes chat text submitted to the assistant in the loyalty club to generate automated replies.

n8n: Operated on our own infrastructure to route registration workflows securely.

Google Tag Manager: Measures site usage (loaded exclusively following your explicit consent).

Sponsor note: We do not sell personal data or share individual user records with commercial sponsors. Information provided to sponsors is strictly aggregated and anonymized.

5. International data transfers

Certain service providers identified above operate outside Canada, including in the United States and the European Union. Where personal data is transferred out of the United Kingdom or the European Economic Area (EEA), transfers are governed by appropriate legal safeguards, such as Standard Contractual Clauses (SCCs).

6. Retention & data erasure timelines

Active accounts: Account and loyalty data are retained while your account is active, and for up to 12 months following a closure request to prevent inadvertent account reinstatement.

Order and delivery records: Retained while your account is active and for up to 12 months following a closure request, except that order records we are required to keep for tax and accounting purposes are retained for as long as the law requires.

Authentication codes: Discarded immediately upon use or expiration.

CASL records: Evidence of marketing consent is retained for 3 years following consent withdrawal, as required by Canadian anti-spam legislation.

Analytics data: Retained for up to 14 months within Google Tag Manager.

Data erasure execution: Active data is erased within 30 days of request. Encrypted system backups overwrite on a 60-day rolling cycle, during which no backed-up data is restored to production.

Suppression records: Unsubscribed email addresses are stored strictly as a one-way cryptographic hash to prevent future accidental mailings.

7. Your legal rights & choices

Subject to local laws (e.g., GDPR, PIPEDA, UK Data Protection Act), you have the right to:

Access and receive a copy of your personal data. Request correction of inaccurate or incomplete information. Request deletion of your personal data (subject to legal retention obligations). Withdraw consent at any time for marketing or analytics cookies. Object to or restrict processing based on legitimate interests. Request data portability in a structured, standard format.

To exercise any right, contact raymond@hbms.co. We respond within 30 days and do not charge a fee for standard requests.

You also have the right to lodge a complaint with a supervisory authority: the Office of the Privacy Commissioner of Canada, the UK Information Commissioner's Office (ICO), or your local EEA Member State Supervisory Authority.

8. Cookies & local storage

Local storage: We use your browser's local storage to record authenticated login sessions and your saved cookie preferences. This data remains on your physical device and is not used for cross-site tracking.

Analytics cookies: Loaded only if explicitly accepted via our cookie banner. Preferences can be updated at any time in the site footer.

9. Security, children & policy amendments

Security practices: We employ transport encryption (TLS/HTTPS), strict least-privilege administrative access, and secure credential managers.

Children's privacy: Our platform is intended for professionals in sports and media and is not directed at children under 16. We do not knowingly collect data from children.

Updates: Material updates to this policy will be published on this page with a revised date stamp. Account holders will be notified by email of major updates.