The Data Protocol.

We are MediaWiz.ai — an AI-powered creative agency operating out of Toronto, Canada. This Privacy Policy ("Policy") governs every interaction you have with our website mediawiz.ai, our client portals, our campaigns, and any service we deliver under the MediaWiz brand (collectively, the "Services").

For the purposes of applicable privacy law (GDPR, CCPA, PIPEDA), MediaWiz.ai is the data controller of the personal information you give us directly, and a data processor for any information you hand us on behalf of your customers (e.g. realtor client lists, ad audience data).

This Policy covers every visitor, lead, client, vendor, applicant and reader. If you disagree with any part of it, the ethical move is to stop using our Services — we can't bind you to terms you don't accept.

Entity

MediaWiz.ai

Registered

Toronto, Ontario, Canada

Controller Email

privacy@mediawiz.ai

Scope

Website, portals, campaigns, deliverables

We collect only what's necessary to run, improve, and protect the Services. In practice, that's four buckets:

• Information you give us directly. Name, email, phone, company, project brief, billing details, and anything you type into a contact form, strategy call intake, or client portal.
• Information we collect automatically. IP address, device type, browser, OS, referral URL, pages viewed, time-on-page, clickstream, and cookie identifiers — standard web analytics.
• Information from third parties. Data that comes from advertising platforms, social networks or enrichment tools you've authorized (e.g. we connect your Meta Business Account so we can run your ads).
• Project data you upload. Creative assets, brand guidelines, customer lists, audience seeds, and any material you hand us to build your campaign or AI deliverable. This data is treated as your property, full stop.

We do not knowingly collect biometric data, precise GPS, government ID numbers, health records, or payment card numbers (payments are handled by PCI-DSS-certified processors — see File 005).

Every use case maps to a lawful basis under GDPR (contract, consent, legitimate interest, or legal obligation). Specifically, we use your information to:

• Deliver the Services you asked for — fulfill proposals, run campaigns, produce creative, invoice for work.
• Communicate with you — reply to inquiries, send project updates, confirm bookings, issue receipts.
• Send marketing (only if you opted in) — newsletters, case studies, product updates. Every email contains a one-click unsubscribe.
• Improve the Services — analyze aggregated usage patterns to fix bugs, sharpen UX, benchmark campaign performance.
• Protect the Services — detect fraud, prevent abuse, enforce our terms, defend legal claims.
• Comply with the law — respond to court orders, tax audits, and lawful regulator requests where we're obligated to.

We do not use your personal information to train our public AI models, to build audience profiles for resale, or for any purpose you haven't been clearly informed of.

Like every modern website, we use cookies and similar tech. We split them into three tiers so you can make informed choices via our cookie banner:

• Strictly Necessary. Session management, form security, load balancing. These cannot be disabled — the site won't function without them.
• Analytics. Aggregated, de-identified data on how visitors use the site (e.g. Google Analytics 4 with IP anonymization). Helps us ship better content.
• Marketing & Retargeting. Pixels from Meta, LinkedIn, X and Google that power our ad campaigns. Off by default in EU/UK/California; opt-in elsewhere.

You can review, change or withdraw consent at any time via the "Cookie Settings" link in the footer, through your browser's Do-Not-Track signal, or by emailing privacy@mediawiz.ai. We honour Global Privacy Control (GPC) signals automatically.

We share personal information only with vetted, contract-bound third parties who help us run the Services. We don't sell, rent, or trade your data. Period.

• Infrastructure providers — hosting (SiteGround, Cloudflare), databases, CDNs, backup services.
• Payment processors — Stripe and/or PayPal handle card data; we never see or store card numbers.
• Communication tools — email (e.g. Google Workspace), transactional messaging, client portals.
• Analytics & advertising — Google Analytics, Meta Pixel, LinkedIn Insight, etc. — where consented.
• AI & creative processors — image/video generation, transcription, editing platforms used to produce deliverables. These tools process data only as needed and never retain it beyond the job.
• Professional advisors — lawyers, accountants, and auditors, bound by professional duties of confidence.
• Legal & safety — authorities, where legally compelled or to prevent imminent harm.

Every processor is bound by a Data Processing Agreement (DPA) that restricts them to our instructions, requires appropriate safeguards, and forbids secondary use. The current list of subprocessors is available on request.

We build AI-powered deliverables (AI characters, generated imagery, video, audio, copy). Because our business involves AI, we owe you extra transparency here:

• We do not train public foundation models on your data. Any model we fine-tune for you is private to your engagement and deleted/returned on request.
• Third-party AI tools are chosen for their privacy posture. We prefer vendors who contractually guarantee zero-retention and zero-training on submitted content (e.g. API-tier offerings from major providers).
• Generated content of real people — we only produce likenesses of real individuals with documented consent. AI characters are fictional unless explicitly commissioned otherwise.
• You always get the final cut. You can request full deletion of any AI-generated asset, along with the prompts, seeds and reference inputs used to create it.

If any AI processing meaningfully affects your legal rights (e.g. automated decision-making), you have the right to human review and to contest the decision. Email privacy@mediawiz.ai.

No system is unhackable. But these are the measures we take to make sure we're a much harder target than the next agency:

• Encryption in transit — TLS 1.2+ across all endpoints, HSTS on the main domain.
• Encryption at rest — AES-256 on production databases and backups.
• Access control — role-based access, least-privilege, MFA enforced on every admin account.
• Audit logging — administrative actions are logged and retained for incident review.
• Vendor due diligence — security posture is assessed before onboarding any subprocessor.
• Incident response — if a breach occurs and it poses a real risk to your rights, we will notify affected users and relevant regulators within 72 hours, in line with GDPR Article 33.

On your end: use a strong, unique password, enable MFA where offered, and tell us immediately if you suspect your account has been compromised.

We keep personal information only as long as we need it for the purpose it was collected, plus any legally required retention window. Specifically:

• Contact form submissions — 24 months from last interaction, then auto-purged.
• Active client records — duration of the engagement plus 12 months for handoff and reference.
• Financial records (invoices, receipts) — 7 years, as required by Canadian tax law.
• Analytics data — 14 months at most in raw form; aggregated reports kept indefinitely in de-identified form.
• Marketing subscribers — until you unsubscribe (one click, any email).
• Backups — rolling 90-day retention, then overwritten.

When the clock runs out, data is securely deleted or fully anonymized so it can no longer be tied back to you.

MediaWiz.ai operates from Canada and may store or process data in Canada, the United States, and the European Economic Area, depending on the provider. Where personal data is transferred out of its origin jurisdiction, we rely on one or more of:

• Adequacy decisions — where the destination country is recognized by the European Commission as offering equivalent protection (Canada is partially adequate).
• Standard Contractual Clauses (SCCs) — EU Commission-approved contract language appended to every processor agreement.
• UK IDTA / EU-US Data Privacy Framework — where applicable and when the processor is certified.

You can request a copy of our transfer safeguards at any time.

The Services are built for business customers and are not directed to children under 16. We do not knowingly collect personal information from anyone under that age.

If you believe a minor has submitted personal information to us, contact privacy@mediawiz.ai and we will delete it within 30 days.

Privacy law evolves. Our stack evolves. This Policy will too. When we make material changes, we will:

• Update the "Effective Date" at the top of this page.
• Post a banner on the site for 30 days highlighting what changed.
• Email active clients and subscribers directly for any change affecting consent or rights.

Prior versions are archived and available on request so you can see exactly what's been amended.