Legal
Privacy Policy
Effective date: April 10, 2026
This policy explains how DataLug Inc. (“DataLug”, “we”, “us”) collects, uses, discloses and protects personal information when you visit datalug.io, register for an event, contact us, or use the DataLug platform (together, the “Services”).
1. Who we are and how to reach us
DataLug is based in Ottawa, Ontario, Canada. We are responsible for the personal information described in this policy.
Our Privacy Officer is accountable for our compliance with this policy and with applicable privacy law. You can reach the Privacy Officer at:
- Email: inquiry@datalug.io
- Mail: Privacy Officer, DataLug Inc., 2-2148 Carling Avenue, Ottawa, Ontario, Canada K2A 1H1
2. Scope: our information and your data
This policy covers personal information that DataLug decides how to use, such as your account details, messages you send us, and how you use our website.
When you use the platform, you may connect your own systems and move data through workflows that you design (“Customer Data”). We process Customer Data only on your instructions and to provide the Services. For Customer Data, your organization decides what is collected and why, and your own privacy policy applies. Our obligations for Customer Data are set out in section 10 of our Terms of Service.
3. What we collect
| When | What we collect | How |
|---|---|---|
| You visit datalug.io | IP address, browser and device type, pages viewed, referring page, approximate location derived from IP, and timestamps | Server logs kept by our website host, and Google Analytics cookies (section 6) |
| You contact us | Name, work email, company (optional), topic and message | Contact form |
| You request a connector | Name, work email, the system you need, how you would use it, your use case and timeline | Request a connector form |
| You register for DataLug Live | Name, work email, company, job title (optional), role, the systems you want to connect (optional) and your email choices | Event registration form |
| You create an account | Name, work email, company, chosen plan and billing period, hosting region, and your email choices | Sign-up form and the platform |
| You subscribe to a paid plan | Billing name and address, tax location and payment card details | Collected and held by Stripe, our payment processor. We receive only a payment reference, card brand, last four digits and expiry, never the full card number |
| You use the platform | Sign-in records, account settings, workflow designs, run logs and metrics, audit logs of changes, support requests, and Milo prompts and usage | The platform |
| You attend DataLug Live | Questions or comments you post in the live chat or Q&A | The streaming platform you join through (section 8) |
We do not knowingly collect sensitive information, such as health or financial account information, about you as an individual. Do not include passwords, API keys or customer data in forms or support messages.
4. How we use personal information
We use personal information to:
- provide, secure and support the Services, including creating and running your account and runtime;
- process payments, calculate tax and keep business and tax records;
- respond to messages, connector requests and event registrations, and send the event join link, reminders and replay you asked for;
- send service messages about your account, billing, security and material changes to our terms;
- send product news, only if you opted in (section 7);
- understand how the website is used, in aggregate, so we can improve it;
- prevent fraud, abuse and security incidents; and
- meet legal obligations and enforce our agreements.
We do not sell personal information, and we do not use it for third-party advertising.
5. Consent
We collect, use and disclose personal information with your consent, which may be express (for example, ticking a box) or implied by the circumstances (for example, sending us a message so we can reply), except where the law allows otherwise. You can withdraw consent at any time, subject to legal or contractual restrictions, by contacting the Privacy Officer. If you withdraw consent, we may not be able to provide some or all of the Services.
6. Cookies and analytics
The website uses Google Analytics 4, a service from Google, to measure visits in aggregate. It sets first-party cookies that let Google distinguish browsers and sessions. Google receives your IP address and browser details. We do not send names, email addresses or form contents to Google Analytics.
WordPress may set cookies needed for the site to work, such as for logged-in administrators. We do not use advertising or cross-site tracking cookies.
You can block or delete cookies in your browser settings, or install Google’s opt-out browser add-on. The site works without analytics cookies.
We protect our forms from spam and automated abuse using Cloudflare Turnstile. Turnstile checks that a submission comes from a person by analysing technical signals such as your IP address and browser behaviour. It does not set tracking cookies and we do not use it to profile you.
7. Marketing emails
We send product news only if you ticked the optional box to receive it. Every marketing email identifies DataLug, includes our mailing address and has an unsubscribe link. We action unsubscribe requests within 10 business days. Service messages about your account, billing or security are not marketing and are sent even if you unsubscribe from news.
We use Brevo (operated by Sendinblue) to send and manage these emails. Brevo stores your email address and name for this purpose and processes them in the European Union. If you confirm a double opt-in subscription, Brevo records that confirmation.
If you reserve a referral link, we process your email address through Brevo so we can send you that link when the program opens, and send product news if you opted in. We do not share it for any other purpose.
8. Who we share it with
We share personal information only with the service providers below, who process it on our behalf under written agreements and only for the purposes we set, and as described in this section.
| Provider | What they do for us | Where they process data |
|---|---|---|
| GoDaddy | Hosts the datalug.io website, its database (including form submissions) and server logs | Canada |
| Vultr | Hosts the DataLug platform, accounts and runtimes | Canada (Toronto) |
| Stripe | Payment processing, subscription billing and tax calculation | United States and Canada |
| Anthropic | Generates Milo drafts and explanations from your prompts and the workflow context you work on | United States |
| Website analytics (Google Analytics 4) | United States | |
| GoDaddy | Sends and stores our email | Canada |
| Brevo (Sendinblue) | Sends and manages our newsletter and marketing emails and subscriber lists | European Union |
| Cloudflare | Delivers and protects the website (CDN), and protects our forms from spam and abuse with Turnstile | United States and globally |
When you join DataLug Live through a third-party platform (for example YouTube), that platform collects information under its own privacy policy. We see questions you post in the live chat and may show them during the session or in the replay.
We may also disclose personal information:
- if required or permitted by law, for example in response to a valid court order;
- to protect the rights, property or safety of DataLug, our customers or others; or
- to a buyer or successor as part of a merger, financing or sale of all or part of our business, under confidentiality obligations and subject to this policy.
9. Processing outside Canada
Some of our service providers process personal information in the United States. While it is there, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. We use contractual safeguards with each provider to protect it.
10. Milo and AI features
Milo uses a large language model provided by Anthropic. When you use Milo, the text you write and the workflow context needed to answer (for example workflow structure, node settings and field names) are sent to Anthropic to generate a response. Milo does not send Customer Data rows or field values. Under Anthropic’s commercial terms, this content is not used to train its models. Milo proposes changes for you to review; it does not make decisions about you that have legal or similarly significant effects.
11. How long we keep it
We keep personal information only as long as needed for the purposes above, then delete or anonymize it.
| Information | How long |
|---|---|
| Contact and connector request submissions | Up to 7 years after our last exchange with you |
| DataLug Live registrations | Up to 7 years after the event, longer if you opted in to news |
| Free trial accounts that do not upgrade | Locked at the end of the trial and deleted 30 days later. We keep your email address so the one-trial-per-email rule can be applied |
| Paid accounts after cancellation | Deleted within 30 days after the paid period ends |
| Kept after a paid account closes | Only the billing and tax records below are kept; nothing else |
| Billing and tax records | Six years from the end of the tax year they relate to, as Canadian tax law requires |
| Server logs | 90 days |
| Records of privacy breaches | At least two years, as Canadian privacy law requires |
| Marketing preferences and unsubscribe records | As long as needed to honour your choice |
12. How we protect it
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (TLS), encryption of stored connection credentials, access limited to people who need it, a dedicated and physically isolated runtime for each paid account, and logical tenant isolation for accounts on the shared trial runtime. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires, and keep a record of every breach.
13. Your rights
You can ask to:
- access the personal information we hold about you and learn how it has been used and disclosed;
- correct information that is inaccurate or incomplete;
- withdraw consent (section 5); and
- where applicable law provides it, receive your information in a structured, commonly used format, or have it deleted.
Send requests to inquiry@datalug.io. We will reply within 30 days, or tell you if we need more time and why, as the law allows. We may need to verify your identity before acting. If a request concerns Customer Data, we will refer you to the organization that controls it.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
14. Children
The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact the Privacy Officer and we will delete it.
15. Changes to this policy
We will post any update here with a new effective date. If a change materially affects how we use personal information you have already given us, we will notify account holders by email at least 30 days before it takes effect and, where required, ask for your consent.
16. Contact
Privacy questions and requests: inquiry@datalug.io Security reports: inquiry@datalug.io General enquiries: inquiry@datalug.io Mail: Privacy Officer, DataLug Inc., 2-2148 Carling Avenue, Ottawa, Ontario, Canada K2A 1H1