Privacy Policy

Northway Discovery Inc. (“we”, “our”, or “us”) operates a digital discovery platform that helps users explore places and information using a clean, accessible interface. This Privacy Policy explains how we collect, use, and protect personal data when you visit our website, contact us, or interact with our features. It also explains your choices, including how to control cookies and advertising preferences. We are a Canadian business and strive to align with Canadian privacy principles and international standards such as the General Data Protection Regulation (GDPR) where applicable.

Business name: Northway Discovery Inc. Address: 250 Yonge Street, Toronto, ON M5B 2L7, Canada. Phone: +1 (416) 702-2892. Email: [email protected]. This policy applies to the website pages available through our main navigation and footer: Home, About, Features, FAQ, Contact, Privacy, Terms, and Legal. It does not cover third-party websites you may visit via external references. We do not sell travel packages and do not request sensitive financial or medical information.

We use cookies and similar technologies to operate our website, understand performance, and support advertising. You can manage preferences at any time using the “Manage cookie preferences” control in the footer or the button at the top of this page. Cookies are grouped into exactly three categories:

1) Essential Cookies

Purpose: core site functionality, security, and session management. Examples: session_id, csrf_token, cookie_consent_status. Consent required: no — these activate automatically to provide services you request, such as page navigation and security protections. Retention: session duration or up to 12 months for preference storage.

2) Analytics Cookies

Purpose: measuring traffic, user behavior, and site performance. Tools: Google Analytics 4. Examples: _ga, _ga_XXXXXXX, _gid, _gat. Consent required: yes — activated only after you accept. Retention: up to 14 months.

3) Marketing / Advertising Cookies

Purpose: remarketing, personalized ad delivery, and conversion tracking. Consent required: yes — activated only after you accept. Retention: up to 540 days (Google Ads default).

• Third-party ad serving: “Third-party vendors, including Google, use cookies to serve ads based on a user's previous visits to this website and other sites on the internet.”
• Advertising partners: “We may work with advertising partners such as Google and Meta to deliver advertisements tailored to your interests across various websites and platforms.”
• Remarketing: “We may use remarketing services to advertise to previous visitors of our website. After visiting our site, you may see our ads on other websites, apps, or platforms you visit.”
• YouTube and Display Network: “Advertisements may appear across Google services including YouTube, Gmail, and the Google Display Network.”
• Tracking technologies — list ALL that apply: “We use the following tracking technologies on this website: - Cookies (first-party and third-party) - Tracking pixels (Google Ads tag / gtag.js, Meta Pixel) - Device identifiers (browser fingerprint, IP address) - Conversion event tags”
• Advertising measurement: “We use conversion tracking to understand which advertisements lead to actions on our website — such as form submissions, calls, or purchases. This allows us to measure campaign effectiveness and allocate budget appropriately. Conversion data may be shared with Google Ads and Meta.”
• Technologies in use — list explicitly: “Advertising and analytics technologies active on this site: - Google Ads (gtag.js / Google Tag Manager) - Google Analytics 4 - Google Remarketing Tag - Meta Pixel (Facebook / Instagram)”
• Opt-out from personalized advertising: “You may opt out of personalized advertising at any time: - Google Ads Settings: https://adssettings.google.com - Your Online Choices (EU): https://www.youronlinechoices.eu - Network Advertising Initiative: https://optout.networkadvertising.org - Digital Advertising Alliance: https://optout.aboutads.info Opting out does not remove ads entirely — you will continue to see non-personalized advertisements.”
• Cookie preference management: Use the “Manage cookie preferences” control below or in the footer to accept or reject Analytics and Marketing cookies independently.

Our consent banner offers three options: “Accept All”, “Reject Non-Essential”, and “Manage Preferences”. Analytics and Marketing cookies are not activated until you accept. Your choice is stored in localStorage for up to 12 months and can be withdrawn at any time via the cookie preferences panel without affecting the lawfulness of processing that occurred before withdrawal. A link to this Privacy Policy is present in the banner and in our site footer.

Consent statement: “By clicking 'Accept All Cookies', you consent to the storing of cookies on your device for analytics and advertising purposes, including personalized advertising delivered by Google and Meta. You may withdraw consent at any time through the cookie preferences panel without affecting the lawfulness of processing that occurred before withdrawal.”

EEA / UK users: “Users in the European Economic Area and the United Kingdom receive this consent notice in compliance with the General Data Protection Regulation (GDPR) and UK GDPR. Marketing and analytics cookies are activated solely after explicit, informed, freely given consent under GDPR Article 6(1)(a). Consent is recorded with a timestamp and may be audited upon request.”

Withdrawal of consent: “You may withdraw consent at any time by clicking 'Manage cookie preferences' in the website footer, or by clearing cookies via your browser settings. Withdrawal does not affect processing that occurred while consent was valid.”

We share certain data with advertising partners for campaign delivery and measurement. Recipients and the data categories shared include:

• Google LLC: cookie identifiers, conversion events, anonymized behavioral data, remarketing lists. Governed by Google's Privacy Policy: https://policies.google.com/privacy
• Meta Platforms, Inc.: pixel events, conversion data, custom audiences. Governed by Meta's Data Policy: https://www.facebook.com/privacy/policy

We do not sell personal data. All transfers to Google and Meta operate under Standard Contractual Clauses where applicable. Data is processed for ad targeting and campaign measurement only, and not resold to unaffiliated third parties. Google and Meta may use this data across their own platforms in accordance with their respective policies. We encourage users to review those policies directly.

When you submit a contact form or request information, we collect the information you provide. This typically includes: full name, email address, phone number, and your message. Legal basis: consent (GDPR Art. 6.1.a) and, where a service relationship exists, performance of a contract (GDPR Art. 6.1.b). Retention: form submission data is retained for up to 2 years from the date of submission, unless a longer period is required by applicable law. You may request deletion of your data at any time by contacting us at the email address in this policy. A link to this Privacy Policy appears adjacent to every submission button on this site. Submitting a form constitutes acknowledgment of this policy.

This website uses the following Google services: Google Analytics 4 collects anonymized usage data, device information, and behavioral signals. IP anonymization is enabled and retention is set to 14 months. Users may opt out via the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout. Google Ads Conversion Tracking records when a user completes a defined action (such as a form submission) after clicking one of our ads; this is used solely to measure ad performance. Google Remarketing allows us to show ads to previous visitors across Google's network and is not based on sensitive data categories. Google Tag Manager deploys tracking tags; it does not collect personal data itself. Google’s advertising products are governed by: https://policies.google.com/technologies/ads.

We use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram. The pixel may record page views, time on site, specific conversion events (such as form submissions), and custom audience membership for retargeting. We do not use the Meta Pixel to collect sensitive personal data, nor to target users based on health status, financial situation, religion, political views, sexual orientation, or other special-category attributes. Meta acts as an independent data controller for data collected via its Pixel and processed within its own platform. Refer to Meta's Data Policy: https://www.facebook.com/privacy/policy. To manage your ad preferences on Meta platforms, visit: https://www.facebook.com/adpreferences/.

This website does not promote, sell, or facilitate access to prohibited product or service categories including but not limited to: weapons, controlled substances, counterfeit goods, gambling services (unlicensed), adult content, or services that make misleading health or financial claims. All advertising conducted through Google Ads and Meta Ads complies fully with the respective platform policies.

The content of this website accurately represents the features and services advertised. No bait-and-switch practices are employed. The experience delivered to users arriving from paid advertisements is identical to the experience for all other visitors. Cloaking, automatic redirects, and content variation by traffic source are not used on this website.

This website is not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If we discover that data has been collected from a person under 16 without verifiable parental consent, we will delete it promptly. Contact us at the address in this policy if you believe we have received data from a minor.

Personal data collected through this website may be transferred to and processed in countries outside Canada and the European Economic Area, including the United States, where Google LLC and Meta Platforms, Inc. are based. These transfers are conducted under Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards for personal data. A copy of the applicable SCCs can be requested by contacting us directly.

If you are located in the EEA or UK, you have the following rights: Access (Art. 15) — request a copy of data we hold about you. Rectification (Art. 16) — correct inaccurate or incomplete data. Erasure (Art. 17) — request deletion (“right to be forgotten”). Restriction (Art. 18) — limit how we process your data. Portability (Art. 20) — receive your data in a structured, machine-readable format. Objection (Art. 21) — object to processing based on legitimate interest. Withdraw consent (Art. 7.3) — revoke consent at any time without penalty. To exercise any right, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority: EU users: https://edpb.europa.eu • UK users: https://ico.org.uk.

• Full name (if provided through a contact form)
• Email address
• Phone number (if provided)
• IP address
• Browser type and version
• Device type and operating system
• Cookies and tracking identifiers
• Usage data (pages visited, time on site, click paths)
• Form submission content
• Conversion events (form submits, calls, purchases)

• Contact form data: consent (Art. 6.1.a) and performance of a contract (Art. 6.1.b) when applicable.
• Analytics data: consent (Art. 6.1.a).
• Marketing/remarketing data: consent (Art. 6.1.a).
• Security and fraud prevention: legitimate interest (Art. 6.1.f).

• Contact form submissions: 2 years
• Analytics data (GA4): 14 months
• Marketing cookies (Google Ads): up to 540 days
• Email communications: duration of relationship + 1 year
• Server logs: 90 days
• Cookie consent records: 3 years (audit requirement)

We implement administrative, technical, and organizational safeguards to protect personal data. These include encryption in transit (HTTPS), access controls, and regular review of our data-handling practices. While no online service can guarantee absolute security, we work to reduce risks and notify users and relevant authorities of any notifiable data incidents in line with applicable regulations.

You can control cookies via the preferences panel and your browser settings. You can also choose not to submit optional information in forms. If you have previously granted consent to Analytics or Marketing cookies, you can withdraw consent using the “Manage cookie preferences” control at any time. For platform-specific ad settings, consider the resources listed earlier in this policy.

If we make material changes to this Privacy Policy, we will post the updated version here and display a notice on the homepage at least 14 days before the changes take effect. The “Last Updated” and “Effective Date” shown at the top of this page indicate the current policy timeline.

For questions about this Privacy Policy or our data practices, contact Northway Discovery Inc., 250 Yonge Street, Toronto, ON M5B 2L7, Canada. Phone: +1 (416) 702-2892. Email: [email protected]. We aim to respond to privacy inquiries within 30 days.