Who we are
eapmedia.org is run by EAP Media, the business name of Peter Zhang, who runs it on his own in Ontario, Canada. Peter is responsible for how we look after personal information. Ethan Chiang answers privacy questions day to day. Reach us at ethan.chiang@eapmedia.org.
What we collect, and why
When you visit the site
Vercel Web Analytics counts page views across eapmedia.org. It doesn't set a cookie or build a profile of you. It keeps the page you viewed, the page you came from, your country and region, and your device and browser type. It tells visitors apart with a short-lived code that is thrown away after 24 hours. Like any web host, our hosting company keeps standard server logs (your IP address, the time and the page requested) for security and reliability. We don't use them for marketing. See our cookie policy for the one cookie the site sets.
The free website test
When you paste a web address into the free Lighthouse test, we send that address to Google's PageSpeed Insights service so Google can test it. We keep a copy of a finished report for about a minute so the same address isn't tested twice in a row. Opening the tool sets one session cookie so we can slow down repeated tests from the same visit.
We also keep a record of each site that's been tested: its address, the scores Google gave it, when it was first and last tested, and how many times. It's a record of the site, not of you: it doesn't include who ran the test or your IP address. We delete it 12 months after the last test, on the schedule in “How long we keep it” below. And we count, per day, how many tests are started, finished and failed, and how often the buttons on the report are used. Those are totals only.
When you email us
You can reach us at ethan.chiang@eapmedia.org to start a project or ask a question, and existing clients use support@eapmedia.org for requests. Your email address, what you tell us about your business, and anything you send afterwards are used only to build and look after your website and to talk with you about it.
Leaving your email to ask for a link
While onboarding is in beta, our request page lets you leave your email address so we can send you a private link. We collect only the email address, plus when it was sent and roughly how often, so we can stop abuse. We don't record your IP address or device details there, beyond what our host's standard server logs hold (see “When you visit the site” above); we do keep a scrambled version of your network address for about two days, so one person can't flood the form. We use the address for one thing: to send you that private link. Peter and Ethan can see the list, no one else, and we never share or sell it. We delete the address 90 days after you leave it, on the schedule in “How long we keep it” below.
When you start your website with us (the onboarding)
To design your site we ask you a series of questions, one screen at a time. Here is what that collects:
- Your first name and your email address, so we can save your progress and know whose answers they are.
- Your business name, phone number, address, hours and the kind of business. For now you type these yourself, or confirm what we typed in for you.
- Your answers about your business, in your own words, and the looks, colours and example sites you pick.
- Photos and your logo. We rebuild every photo from its pixels before it leaves your browser. That strips out hidden details, like where it was taken and which camera took it.
- What your customers say about you, in your own words. We don't copy reviews from Google.
- Links to your current website and to sites you like. We may run our free speed test on your current site (see above).
- When you last worked on your answers, and which screen you reached, so we can see how far you got. Nothing is sent automatically. If we check in, a person writes to you.
We use all of this for one thing: to design, build and run your website, and to write to you about it. For now every email comes from a person; no emails are sent automatically. A person on our team reads every answer. AI helpers also read your answers, to sort them and to draft notes for us. They are services we choose and may change from time to time, and they may handle your answers outside Canada, for example in the United States. They see what you typed, including your business name, phone number, address and email. They never see your private link. Where a service lets us, we switch off the use of your answers to train it, and we check those settings from time to time. Ask us and we'll tell you which services we use today.
Where your answers and photos live. Your answers, photos and logo are stored together in a database run by Neon. The site itself, including the screens where you answer, runs on Vercel. Both companies are in the United States (more in “Who helps us” below). To plan your site, we may copy your answers into our own planning tool, on our own computer in Canada, which only Ethan and Peter can open. That computer is backed up every night, and anything we delete is gone from those backups within 14 days. We keep your answers and photos for as long as you're a client, because they shape your site. You can change them later; we keep the earlier version too, and changes to your live site are made by us. Our rules for the rest: an onboarding you never sent goes 6 months after you last touched it; if a project doesn't go ahead, the answers go 6 months after we mark it so (when you tell us, or we hear nothing back); after we stop working together, everything goes 12 months later, or at once if you ask us to. We clear out old records by hand, regularly and whenever you ask. The full schedule is in “How long we keep it” below. To see, change or delete any of it, email ethan.chiang@eapmedia.org.
Your private link
For now there is no login and no password. We give you a private link to your pages, and your browser remembers it so you can come back. Anyone who has the link can open your pages, so keep it to yourself and tell us if you think someone else has it. We can switch a link off and send you a new one. A real login is coming, and we'll update this page when it ships.
Notes we keep about your business
Ethan and Peter, along with the AI assistants that help us, keep notes about your business and what you ask us for, so we always have the full picture and never make you repeat yourself. We only write down things you ask for or choose to tell us: a change you requested, a new location, a seasonal sale, a milestone you mentioned. Some of these notes are drafted by an AI assistant from your messages, and the AI helpers listed under “Who helps us” below process that text to do it. Only the two of us see the notes. We keep them while you're a client and delete them when you ask, or on the schedule in the table below. Email ethan.chiang@eapmedia.org any time to see or delete your notes.
When you pay us
Payments go through Stripe. When you pay, Stripe collects your name, email address, billing address and card details. We never see your full card number. Stripe is in the United States and handles that information under its own privacy policy at stripe.com/privacy, which means your billing details are held outside Canada. We keep only a summary: your plan, the amount, the next payment date, and whether an invoice is paid.
Emails we send
Emails about your onboarding and your site (your private link, a check-in if you stop part-way, “your preview is ready”, “your site is live”, replies to your requests) are part of the service you asked for. For now every one of them is written by a person. Each one says it's from EAP Media and gives a way to reach us. If you ask us to stop checking in, we stop within 10 business days, and usually right away. Marketing email, if we ever send any, goes only to people who asked for it, and every one has a link to stop.
Who helps us (and where they are)
We don't run our own servers. These companies process information for us. Each works under its own terms, and we stay responsible for your information while it's with them.
| Who | What they do for us | Where |
|---|---|---|
| Vercel | Hosts eapmedia.org, runs the site's code, keeps server logs, and counts page views | United States |
| Neon (part of Databricks) | The database that holds the free test's records, the beta list, and your onboarding answers, photos and logo | United States |
| Stripe | Takes payments, keeps invoices and your card details | United States |
| Tests a site's speed when you or we run the free test | United States | |
| AI helpers | Read your answers to sort them and draft notes for us. Services we choose and may change over time; ask us and we'll tell you which ones we use today | Outside Canada, for example the United States |
| Our own computer | Runs our planning tool, which may hold a copy of your answers and photos while we plan your site. Backed up nightly, and deleted data leaves those backups within 14 days. Only Ethan and Peter can reach it | Canada |
When we start sending automatic emails, we'll add the email service here first. Most of these companies are outside Canada. While your information is with them, the laws of their country apply to it, and courts or authorities there could ask for it.
How long we keep it
| What | How long |
|---|---|
| Your email from the request page | Deleted 90 days after you leave it |
| An onboarding you started but never sent | Deleted 6 months after you last touched it, photos included |
| Answers you sent us, but the project didn't go ahead | Deleted 6 months after we mark the project as not going ahead, which we do when you tell us or when we hear nothing back. Photos and logo included |
| While you're a client | Kept for as long as we work together. Nothing is deleted on a schedule, and when you change your answers we keep the earlier version too |
| Notes we keep about your business | Kept while you're a client, deleted when you ask, otherwise with the main records below |
| After you leave | Your answers, messages, photos and files are deleted 12 months after we stop working together. Ask as you leave and we delete them the same day |
| Emails between us | Kept while you're a client, then deleted with the main records, 12 months after we stop working together |
| Any copy in our planning tool, and its backups | Deleted with the main records, and gone from the backups within 14 days after that |
| After we delete you | We keep one thing: a one-way scrambled code of your email address, so we don't contact you again. Never your name, your answers or your address in readable form |
| Billing records | Kept for as long as tax and accounting rules require, with Stripe and in our books |
| The free test's record of a site | Deleted 12 months after that site was last tested. The daily totals have no personal information in them and are kept |
The dates above are our rules, not a timer. We delete by hand: we review and clear out old records regularly, so an item can outlive its date until the next clear-out. When you ask us to delete, we act within 30 days, and the same day if you're ending your plan.
Your choices
Email ethan.chiang@eapmedia.org and you can:
- See what we hold. We'll send you a copy of everything we have about you, within 30 days, and tell you what we've done with it. Where your account lets you, you can also download your own answers and photos yourself.
- Fix it. If something is wrong or out of date, we'll correct it.
- Delete it. We'll delete your answers, photos, messages and files from our systems and from the companies above, within 30 days, or the same day if you're ending your plan, and we'll tell you when it's done. Billing records stay for as long as the law needs them. After that we keep only a one-way scrambled code of your email address, so we don't contact you again by mistake: never your name, your answers or your address in readable form.
- Stop emails. Use the link in any email, or just reply and say so.
We answer within 30 days. These choices are yours wherever you live, in Canada or the United States. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Keeping it safe
Your answers and photos sit in a database that needs a secret key to open. Only our website and the two of us have that key, and Neon, as the host, can open its own database. Every photo is rebuilt from its pixels, so nothing hidden rides along. Your private link is long and hard to guess, we store only a scrambled version of it, and we can switch it off the moment you ask. Your card details stay with Stripe. Our own planning tool sits on a private network with no public door. No system is perfect, so if something goes wrong we follow the steps below.
If something goes wrong
If your information is lost, stolen or exposed, and that could seriously hurt you (for example fraud or identity theft), we'll tell you as soon as we can, explain what happened and what you can do, and report it to the Privacy Commissioner of Canada. We keep a record of every security slip, even small ones, for two years.
Children
Our services are for business owners. We don't knowingly collect information from anyone under 13. If you think a child has given us information, email us and we'll delete it.
Changes to this policy
When we change this page we'll update the date at the top. If a change affects clients, we'll email them 30 days before it takes effect.
Questions
Email ethan.chiang@eapmedia.org with any privacy question, and a founder will answer directly.