Privacy Policy
Effective: 28 August 2026 Last updated: 28 August 2026
Shortlist aio Ltd. ("we", "us"), formerly Glass House Gardens Inc., is a Manitoba, Canada corporation. This policy explains what personal information we handle, why, and what you can do about it. We are subject to Canada's PIPEDA; where we handle information about people in other jurisdictions, additional rights may apply and are described below.
Contact: privacy@shortlistaio.com · 40 Essex Drive, Steinbach, MB R5G 2Y6, Canada
1. Information we handle
People who contact us or become clients. Name, business email, phone, company, role, and the contents of our correspondence. Billing details are processed by our payment provider; we do not store full card numbers.
People we contact for business development. Business contact information — name, role, business email, employer — collected from publicly available business sources, such as company websites, public professional profiles, and business directories. We also hold our record of where and when we obtained it, and the lawful basis we relied on to contact you.
Website visitors. [Server logs including IP address, user agent, pages
requested. We do / do not use analytics cookies.]
Client business data. Material a client gives us to perform services — which may incidentally contain personal information, and which we handle under our contract with that client and only on their instructions.
We do not knowingly collect information from anyone under 18, special categories of personal data, or consumer (non-business) contact information for marketing.
2. Why we handle it, and on what basis
| Purpose | Basis |
|---|---|
| Responding to enquiries, providing services, billing | Contract performance |
| Business-to-business outreach to relevant decision-makers | Legitimate interests (UK/EU); publicly available business information and the foreign-state exemption to CASL (Canada); CAN-SPAM compliance (US) |
| Security, fraud prevention, service operation | Legitimate interests |
| Meeting tax, accounting, and anti-spam record-keeping obligations | Legal obligation |
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
3. Marketing measurement
Our outreach emails do not contain open-tracking pixels or click-tracking redirects. We do not record whether you opened a message or which links you followed. We measure whether our outreach is working by whether people reply.
We do keep a record of which messages were sent to which address and when, because anti-spam law requires us to be able to show the basis on which we contacted you, and because we must be able to honour an opt-out reliably.
4. Answer-engine measurement data
Our core service queries third-party AI answer engines about companies and products. That process is directed at organisations, not individuals. Responses occasionally name individuals — a founder or an executive quoted in public coverage. We do not seek out such information, do not build profiles of individuals from it, and do not use it for any purpose other than reporting to the client the measurement concerns.
Aggregated, anonymised measurement data may be used in published research. It does not identify individuals.
5. Who we share it with
Service providers, under contract and only as needed to operate: cloud hosting, email delivery and sequencing, payment processing, accounting, customer records. AI providers process content we submit; we do not submit client confidential information to consumer-tier AI services.
We may also disclose where required by law, or to a successor in a merger or sale of substantially all our business, on notice.
Cross-border. We are in Canada and use providers in Canada, the United
States, and the EU. Information may be processed outside your country and be
accessible to courts and authorities there under local law. For UK/EU
transfers we rely on [Standard Contractual Clauses / adequacy].
6. How long we keep it
| Category | Retention |
|---|---|
| Prospect records and outreach logs | [3] years from last contact — retained because anti-spam law requires us to be able to prove our basis for contacting you |
| Client records and contracts | [7] years after the engagement ends, for tax and limitation purposes |
| Website logs | [90] days |
| Opt-out / suppression records | Indefinitely — we must keep these to ensure we do not contact you again |
7. Your rights
You may ask us to access, correct, delete, or port your
personal information, to withdraw consent, or to object to or
restrict our handling of it. To stop marketing, use the unsubscribe link
in any email or write to privacy@shortlistaio.com — we act on this within 10
business days and normally at once.
If you ask us to delete your information, we will keep the minimum record needed to honour your opt-out and to meet legal record-keeping obligations, and nothing more.
We respond within 30 days. We do not discriminate against anyone for exercising these rights.
Complaints. Canada — the Office of the Privacy Commissioner of Canada. UK/EU — your local supervisory authority. We would appreciate the chance to resolve it first.
8. Security
Access on a least-privilege basis, encryption in transit, multi-factor authentication on business-critical accounts, and client credentials provisioned individually and revoked when an engagement ends. No system is perfectly secure, and we do not claim otherwise. We will notify affected individuals and regulators of a breach as required by law.
9. Changes
We will post any change here and update the date above. Material changes will be notified to clients directly.