Privacy policy

This website and the services offered through it are operated by Mighty Metals Ltd., a company incorporated in British Columbia, Canada, operating under the Mighty Systems brand ("we", "us", "our"). We build AI automation and business operating systems for small and mid-sized businesses.

We are the party responsible for the personal information described here. For any privacy question, request, or complaint, contact sean@seanfeng.com. That address reaches the person accountable for privacy at this business.

It covers mightysystems.io and its subpages, email and scheduling with us, payments you make to us, and personal information we handle while delivering client work. It does not cover third-party sites we link to, which have their own policies.

We collect only what a specific purpose requires. In practice that includes the following.

• Information you send us. Your name, email address, company, and whatever you write when you email us, book a call through our Cal.com scheduling widget, or reply to us. Booking a call also records the time slot you chose and any answers you type into the booking form.
• Historical chat records. The personal-site chat feature has been retired and is not available on Mighty Systems. Previously collected questions, answers, quality signals, and hashed IP addresses remain subject to the retention period below. We do not collect new chat submissions through this website.
• Technical logs. Our hosting and security provider records standard request data, including IP address, browser and device type, referring page, requested URL, and timestamp. This is used to keep the site up and to block attacks and abuse.
• Payment information. Payments are processed by Stripe. Stripe collects your card details directly. We never see or store your full card number. We receive and keep the transaction record: name, billing email, country, amount, currency, status, and the last four digits and card brand.

We do not run advertising pixels, behavioural ad networks, session recording, or third-party analytics on this site.

Building automations means we are often given access to a client's systems: email, CRM, spreadsheets, project tools, and the credentials or API keys needed to connect them. That access can expose personal information about the client's own staff and customers.

• We request the narrowest access that will do the job, and we ask for scoped or revocable credentials wherever the system supports them.
• We handle that data only to build, run, fix, and support what the client asked us to build.
• We do not sell it, share it with anyone outside the engagement, or use it to train publicly available AI models.
• When an engagement ends, the client can ask us to return or delete their data and to have our access revoked. Clients should also revoke our credentials on their side.

Where we handle personal information on a client's behalf, the client remains responsible for that information under privacy law and we act on their instructions.

• To answer your questions, schedule and hold calls, and send you proposals.
• To deliver, support, and maintain the services you hire us for.
• To take payment, issue invoices and receipts, and meet tax and accounting obligations.
• To keep the site secure, prevent abuse, and diagnose problems.
• To improve the services we deliver.

We rely on your consent, on the need to perform a contract with you, and on legitimate business purposes permitted by Canadian privacy law. You can withdraw consent at any time, subject to legal and contractual limits, by emailing us.

This site sets no advertising or analytics cookies. Some third-party features we embed or link to may set their own cookies when you interact with them, specifically the Cal.com booking widget and Stripe's hosted payment pages. Those are governed by their privacy policies. Your browser can block or clear cookies at any time; the site will still work.

We do not sell, rent, or trade personal information. We share it only with the service providers that make this business run, and only to the extent they need it:

• Cloudflare — website hosting, content delivery, security, and storage of historical chat records.
• Stripe — payment processing, invoicing, and fraud prevention.
• Cal.com — call scheduling through the booking widget on this site.
• Google — business email and document storage, and Google Fonts, which serves the fonts on this site and receives your IP address as part of that request.
• Professional advisors and authorities — our accountant, and law enforcement or regulators where we are legally required to disclose.

If this business is ever sold or merged, personal information may transfer as part of that transaction, subject to this policy.

Our providers operate globally and store and process data on servers outside Canada, including in the United States. While information is in another country it is subject to that country's laws, including lawful access by courts and government authorities there. We choose providers that offer a comparable level of protection to what Canadian law requires.

• Inquiries and correspondence: for as long as we are talking, and up to two years after the last contact.
• Client records and project files: for the engagement plus seven years, to cover contractual and tax obligations.
• Financial and tax records: at least six years, as required by the Canada Revenue Agency.
• Historical chat records from the retired personal site: up to 24 months from collection, then deleted.
• Security and request logs: short-term, per our hosting provider’s standard retention.

When information is no longer needed for these purposes, we delete it.

The site is served over HTTPS with strict transport security and a content security policy. Credentials are stored in secret managers, never in code repositories or documents. Access is limited to the people who need it, which today is a very short list. Payment card data never touches our systems.

No system is perfectly secure. If a breach ever creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires.

Under Canadian federal and British Columbia privacy law, you can:

• Ask what personal information we hold about you and get a copy.
• Ask us to correct anything inaccurate or incomplete.
• Ask us to delete it, where no legal or contractual obligation requires us to keep it.
• Withdraw your consent to a use you previously agreed to.
• Ask a question about this policy and get a real answer from a person.

Email sean@seanfeng.com and we will respond within 30 days. We may need to verify who you are first. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.

This is a business-to-business service. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it.

We update this policy when what we do changes. The date at the top of the page is the current version. If a change materially affects how we handle information we already hold about you, we will tell you directly.