Privacy

Privacy Policy

What we collect, why, how long we keep it, and your rights under PIPEDA.

Position Clarity is a Canadian crypto education and organization business, operated by Shawn McCormick. We are not an investment, tax, legal, or financial adviser, and nothing in this policy changes that. This policy explains what personal information we collect, why we collect it, how long we keep it, who can access it, and your rights under the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

This policy covers two groups of customers:

  • Retail customers: individual crypto holders who buy the Estate & Access Kit, a Position Clarity Review, or a guide.
  • Fiduciary customers: financial advisers, estate lawyers, and wealth managers who use Position Clarity on behalf of their own clients, including under the white-label model.

We handle the two groups differently. Where a rule applies to only one group, it says so.

1. What we collect

1.1 From retail customers

  • Contact details. Your name and email address, so we can deliver your purchase and reply to you.
  • Payment confirmation. Stripe processes your payment. We receive a confirmation that the payment succeeded and a transaction reference. We do not receive or store your full card number.
  • Holdings data. The information you give us about your crypto setup so we can produce your assessment. This can include the types of assets you hold, where they are held (for example an exchange, a hardware wallet, or a custodian), how access and recovery are arranged, and how concentrated the holdings are. You decide how much detail to share.
  • Anything you write to us. Messages you send by email or in a form, and any documents you choose to attach.

1.2 From fiduciary customers

  • Your professional contact details. Your name, firm, role, and work email, so we can run the engagement and bill you.
  • Anonymized client holdings. When you submit a client's setup for a Review or Report, you upload it anonymized. Position Clarity does not ask for, and you should not send, the end client's name, account numbers, wallet addresses, login details, or any other information that identifies the individual. We process the structure of the holdings, not the identity of the holder.
  • Payment confirmation. As above, handled through Stripe.

1.3 From everyone, automatically

  • Basic website data. Our site runs on Cloudflare Pages. Standard server and security logs (such as IP address, browser type, and pages requested) may be recorded by Cloudflare to operate and protect the site. We use this to keep the site running and secure, not to build profiles of you.
  • If you download a free guide, we ask for your email address first, so we can send the occasional new guide. That address is stored to fulfil the download and any follow-up you have not opted out of; see section 3.3.

We collect only what we need to deliver the product and run the business. We do not ask for information we do not use.

2. Why we collect it

We use your personal information only for these purposes:

  • To deliver what you bought. Producing your assessment, Review, Report, or Kit, and sending it to you.
  • To communicate with you about your order. Confirmations, delivery, and answering your questions.
  • To take payment. Through Stripe, and to keep the records we are required to keep for tax and accounting.
  • To run and secure the website.
  • Follow-up communications, only if you opt in. We will send you further updates or offers only if you have clearly chosen to receive them, for example by giving your email address to download a free guide. You can withdraw that consent at any time (see section 5).

We do not use your information for any purpose you would not reasonably expect from the list above without asking you first.

What we never do

  • No third-party sharing for marketing. We do not share your personal information with third parties for their own marketing.
  • No sale of data. We do not sell your personal information. Ever.
  • No training on customer data. We do not use your holdings data, your documents, or your messages to train any artificial intelligence or machine learning model, ours or anyone else's.

The only outside parties that touch your information are the service providers we need to operate, described in section 4.

3. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, then we delete it.

3.1 Retail holdings data

We process your holdings data to generate your assessment. We delete your holdings data within 7 days of delivering your report, unless you have opted into follow-up communications, in which case we retain only what is needed for that purpose and you can ask us to delete it at any time. The deletion of holdings data does not depend on you asking; it is our default.

3.2 Fiduciary holdings data

We delete the anonymized client holdings you upload within 30 days of delivering the report, unless you specifically request that we archive a file, for example to support an ongoing engagement or your own record-keeping. If you request archival, we keep only that file, only for as long as you ask, and you can have it deleted on request.

3.3 Contact details, order records, and free-guide emails

  • If you opt into follow-up communications, including by giving your email for a free guide, we keep your contact details until you unsubscribe or ask us to delete them.
  • If you do not opt in, we keep your contact details only as long as needed to complete and support your order.
  • We keep payment and transaction records for as long as Canadian tax and accounting law requires.

3.4 Website logs

Cloudflare's standard logs are retained according to Cloudflare's own retention periods. We do not keep our own long-term copy.

4. Who can access it

Inside Position Clarity

Fulfilment is handled personally by Shawn McCormick. Access to your information is limited to what is needed to deliver your product and run the business. Files containing holdings data are stored in access-controlled locations and are deleted on the schedule in section 3.

Service providers we rely on

We use a small set of trusted providers to operate. They may process your information only to provide their service to us, and not for their own purposes:

  • Stripe processes payments.
  • Cloudflare hosts the website, stores free-guide email addresses, and provides security.
  • Our email provider (email is forwarded through [email protected]) handles correspondence.
  • WeasyPrint and our document tooling generate the PDF you receive; this runs on our own systems.

Some of these providers may process or store data outside Canada, including in the United States. Where that happens, your information is subject to the laws of those countries, and lawful authorities there may be able to access it under their own laws. We choose providers that offer appropriate protection.

No one else

We do not give your personal information to anyone else except where we are legally required to (for example, a valid court order), and we will limit any such disclosure to what is required.

5. Your rights under PIPEDA

Under PIPEDA, you have the right to:

  • Access your information. You can ask what personal information we hold about you and get a copy.
  • Correct your information. You can ask us to fix information that is wrong or incomplete.
  • Withdraw consent. You can opt out of follow-up communications at any time, and withdraw consent to other optional uses. Some consequences may follow (for example, we cannot deliver a product without the information needed to produce it), and we will tell you if that is the case.
  • Ask for deletion. You can ask us to delete your personal information. We will delete it unless we are legally required to keep it (for example, tax records).
  • Ask how we handle your information. You can ask us to explain our practices, and who we have shared information with.

How to exercise these rights. Email us at [email protected]. We will confirm your identity before acting on a request, and we will respond within the time PIPEDA requires (generally 30 days). There is no charge for a reasonable request.

If you are not satisfied. If you think we have mishandled your information, contact us first so we can try to fix it. You also have the right to complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

6. How we protect your information

  • We limit who can access holdings data to those who need it.
  • We delete holdings data on the schedules in section 3 so it does not sit around.
  • We use reputable providers (Stripe, Cloudflare) for payments and hosting.
  • We ask fiduciary customers to anonymize client data before uploading, so the most sensitive identifying information never reaches us.

No system is perfectly secure, but we take reasonable steps appropriate to the sensitivity of the information.

7. If something goes wrong (incident response)

If we discover unauthorized access to personal information, we will:

  1. Contain it. Stop the access and secure the affected systems.
  2. Notify affected customers within 48 hours of discovering the unauthorized access. We will tell you what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.
  3. Notify regulators where required. Where PIPEDA's breach rules require it, we will report to the Office of the Privacy Commissioner of Canada and keep records of the breach as the law requires.

The 48-hour notice to affected customers is our own commitment and is shorter than the legal minimum in some cases; it does not replace any longer or additional obligation the law imposes.

8. Changes to this policy

If we change this policy, we will post the updated version on our website with a new date. If a change materially affects how we handle information you have already given us, we will take reasonable steps to tell you.

9. Contact

Questions, requests, or complaints about privacy:

Position Clarity (Shawn McCormick, sole proprietor)
Email: [email protected]

Last updated: 2026-07-06