Privacy Policy

Last updated: 22 September 2026

MaplePress is a product of Maple Open Tech (“we”, “us”), the partnership between SSP Media and Mika Software. This policy explains what personal information we collect, why, how long we keep it, and what you can require us to do with it.

It is written to meet the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector as amended by Law 25 (tabled as Bill 64), Canada’s Anti-Spam Legislation (CASL), and the General Data Protection Regulation (GDPR) where it applies.

Two different relationships

This policy covers both, and they are not the same thing:

You are reading this website. Almost nothing happens. See the next three sections.
Your organisation runs MaplePress. Then your WordPress content is indexed by our service, and we act as a service provider — a processor, in GDPR terms — for whatever personal information that content happens to contain. See “MaplePress as a service”, below.

Who is responsible

Law 25 requires that one person be accountable for the protection of personal information, and that their title and contact details be published. For Maple Open Tech that is:

Person in charge of the protection of personal information: Rodolfo Martinez, Principal
Contact: hello@mapleopentech.ca
Post: Maple Open Tech, London, Ontario, Canada

Write to that address for any request or complaint described below. We answer within 30 days, which is the deadline PIPEDA, Law 25 and the GDPR all set.

What this website collects

When you visit. Our web server records the request: the page asked for, the time, the browser and operating system, the referring page, and the IP address. This is ordinary server logging, and we cannot switch it off without losing the ability to detect abuse.

When you use the contact form. The fields you filled in, anything you chose to put in the message, and our replies. A hidden field and a timing check are used to detect automated spam; neither identifies you.

When you subscribe to the newsletter. Your email address, the date and time, and the exact consent wording shown to you when you subscribed. CASL requires us to be able to prove what you agreed to, so that record is kept.

When you email us. Whatever you send, and our replies.

We do not take payment on this website, we do not buy personal information from anyone, and there is no account to create.

Cookies, tracking and profiling

This website sets no cookies at all. It runs no analytics, no advertising and no tracking pixels. The only thing it loads from another company is the demo videos on /maplepress-go-overview/ and the home page, which are hosted by SproutVideo and are contacted when the page loads.

Because there is nothing else to consent to, there is no cookie banner. Law 25 requires that any technology which identifies, locates or profiles a person be deactivated by default; we use none.

Automated decision-making

We do not use personal information to make any decision about you by automated means, and we do not profile visitors.

MaplePress as a service

When your organisation runs MaplePress, content from your WordPress sites is sent to our service to be indexed so that it can be searched. That content is yours, not ours:

We use it only to provide the search service you have engaged us for.
We do not mine it, sell it, or use it to train anything.
You remain the organisation accountable to your own users for it; we are the service provider acting on your instructions.
It is returned or destroyed when the engagement ends, and we confirm that in writing.

Where your sites serve people in Quebec or the EEA, the transfer and processing terms sit in your agreement with us rather than in this page, because they depend on what you are running and where.

Who else sees it

We share personal information only with service providers who need it to deliver something on our behalf, and only under contract. Where a provider operates outside Quebec or outside Canada, Law 25 requires us to assess the privacy protection the destination affords before transferring anything, and we do. For transfers out of the EEA we rely on the European Commission’s Standard Contractual Clauses.

Provider	Purpose	Where
Our servers	Serving this site, and storing form and newsletter records	Canada
Email delivery	Sending our reply, and the newsletter confirmation	Outside Canada
Newsletter list	Holding the subscriber list and sending the newsletter	Outside Canada
SproutVideo	Hosting the demo videos on this site	Outside Canada

So you should know: if you use the contact form or subscribe, your email address passes through an email provider outside Canada. Writing to us directly instead keeps it within our own mail.

We do not sell personal information. We have never received a government or law enforcement demand for it; were we to receive one, we would disclose only what the law compelled and would notify you unless prohibited from doing so.

How long we keep it

Server logs: 90 days, then deleted.
What you typed in the contact form: 90 days, after which the content is erased. A record that an enquiry arrived, and when, survives without it.
Messages caught as spam: 14 days, then deleted. They are kept at all only so a false positive can be rescued.
A subscription you never confirmed: 7 days, then the address is deleted. An unconfirmed signup is somebody who did not consent.
Your newsletter subscription: until you unsubscribe.
The CASL consent record: kept for as long as the list exists, because its whole purpose is to prove what you agreed to and when.
Correspondence by email: for as long as the matter is open, then two years.
Customer content indexed by MaplePress: for the life of the engagement, then returned or destroyed.

Nothing is added to the newsletter until you click the link in a confirmation email — double opt-in. If you did not ask for it, ignoring that email is enough and the address is deleted within seven days.

Every newsletter carries a working unsubscribe link, which takes effect at once. You can also write to hello@mapleopentech.ca and we will do it for you.

Where we process personal data of people in the EEA or the UK, we rely on:

Consent — the newsletter, and anything else you explicitly agree to.
Contract — providing the service your organisation has engaged us for.
Legal obligation — tax, accounting and lawful demands.
Legitimate interest — answering your enquiry, keeping the service running, and detecting abuse of it.

You have the rights below in addition to erasure, restriction of processing, and objection to processing based on legitimate interest.

How we protect it

Access is limited to the people who need it. Data is encrypted in transit and at rest. Administrative access to the system holding form and newsletter records is reachable only over a private network, not from the internet.

We keep an internal register of confidentiality incidents, as Law 25 requires. If an incident presents a risk of serious injury we notify the affected people and, where Quebec residents are involved, the Commission d’accès à l’information, without delay.

Your rights

You may ask us to:

Tell you what personal information we hold about you, and why.
Correct anything inaccurate, incomplete or ambiguous.
Delete information we no longer have a reason to keep.
Withdraw consent you have given, at any time.
Give you a copy in a structured, commonly used technology format, or send it directly to another organisation — the portability right that took effect in Quebec in September 2024 and exists under the GDPR.
Stop disseminating information about you, or de-index it, where its distribution contravenes the law or a court order.

There is no charge, and we will not ask you why. If we refuse a request we will say so in writing, explain the reason and the provision we are relying on, and tell you how to challenge it.

If your organisation runs MaplePress and the information is in content we index for you, send the request to your organisation rather than to us — they hold the relationship with the person, and we act on their instructions.

If you are not satisfied

Write to the person named above first. If our answer does not satisfy you, you may complain to:

The Office of the Privacy Commissioner of Canada — priv.gc.ca (opens in a new tab)
The Commission d’accès à l’information du Québec, if you are in Quebec — cai.gouv.qc.ca (opens in a new tab)
The Information and Privacy Commissioner of Alberta or British Columbia, if you are in one of those provinces and the matter falls under their provincial legislation.
Your national data protection authority, if you are in the EEA or the UK.

Children

Our services are not directed at children, and we do not knowingly collect personal information from anyone under 14 — the age below which Law 25 requires a parent’s consent — or under 16 in the EEA. If you believe we have, write to us and we will delete it.

Changes to this policy

We will post any change here and update the date at the top. Where a change materially affects how we handle information already collected, we will ask for your consent again rather than rely on the old one.