Scope
This is the privacy policy for our public website at we-shi.com. It does not cover the applications and systems we build for clients. Those are governed by the privacy policies of the businesses that operate them.
What we collect from website visitors
Two things: anonymized analytics about how the site is used, and the contents of any message you send through the contact form. Detail on each follows.
Analytics
We use Google Analytics 4 (GA4) to understand traffic patterns. It tells us things like which pages get read, what brought you here, and roughly where in the world our visitors are. It does not tell us who you are.
GA4 sets two cookies in your browser:
_ga— a random identifier so the same visitor can be recognized across pages within a session. Lasts up to two years._ga_<container-id>— used by GA4 to maintain session state. Lasts up to two years.
What GA4 records about your visit:
- The pages you view and the order you view them in.
- The site or search engine that referred you.
- Browser, operating system, device type, screen size, and language.
- Approximate location, derived from your IP address (typically city or region, not street).
That data is sent to Google’s servers, primarily in the United States, and processed under Google’s privacy terms. We do not link any of it back to your identity, and we do not pass it to anyone else.
If you would rather we did not measure your visit, you can install the Google Analytics opt-out browser add-on or clear the cookies above in your browser settings. Browsers in do-not-track mode are also respected.
The contact form
When you submit the contact form, the name, email, optional company, and message you provide are POSTed to a small endpoint on our server, then handed to Postmark, our transactional email provider, which delivers the message to our inbox. Submissions sit in that inbox while we work through them and are not used for any purpose other than replying to you. We do not add you to a mailing list, and we do not share what you wrote with anyone outside the firm.
Server infrastructure
We host on Amazon Web Services in Canada and the eastern United States. Contact-form submissions are received on these servers before being passed to Postmark for delivery. Analytics data is sent directly from your browser to Google’s infrastructure and does not pass through our servers.
Client work
Any personal data we touch as part of an engagement with a client is governed by that client’s privacy policy and our contract with them. We act as a service provider, and we follow the data-handling practices the engagement requires.
Sharing
Two service providers process website data on our behalf: Google (analytics, as described above) and Postmark (delivery of contact-form submissions to our inbox). Each acts as a sub-processor under their own published terms. We do not sell visitor data, and we do not share it with anyone beyond what is required to operate the site and reply to you.
Security
We maintain appropriate technical and organizational measures for our own infrastructure and for any client data entrusted to us during an engagement. The detail is on the security page.
Your rights
Analytics data is aggregated and not tied to your identity, so there is nothing personal there to access, correct, or delete. If you would rather not be measured at all, you can opt out as described in the Analytics section above.
If you have written to us through the contact form or by email and want that correspondence removed from our records, write to soc2 (at) we-shi.com and we will delete it.
Changes
We may update this policy as the site or our service providers change. Material changes will be reflected here in plain language.
Contact
Privacy questions go to soc2 (at) we-shi.com. Anything else, hello (at) we-shi.com.