Privacy Policy

Who we are

This policy explains how Middlesurf Inc. (“Middlesurf”, “we”, “us”) collects, uses, shares and protects personal information through our website, www.middlesurf.com, and our main phone line, which is answered by an AI assistant.

Middlesurf Inc. is an Ontario corporation located at 85 Ben Sinclair Ave, East Gwillimbury, Ontario L9N 0S3, Canada. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, provincial privacy law.

This policy covers our website and calls to our main line. When we provide services to a client — for example, an AI receptionist that answers the client’s own phone lines — the client decides how its customers’ information is handled, and our written agreement with that client applies.

Contact for privacy questions

Our Privacy Officer is responsible for our compliance with this policy.

Privacy Officer: Privacy Officer, Middlesurf Inc.
Email: [email protected]
Mail: Privacy Officer, Middlesurf Inc., 85 Ben Sinclair Ave, East Gwillimbury, Ontario L9N 0S3, Canada
Phone: +1 (647) 276-6200

What we collect

We collect only what we need for the purposes described below.

When you email us or ask for a demo:

Your name, email address, phone number, company name and anything you choose to tell us
The date and time of your request

When you call our main line: the phone number you call from, the date, time and length of the call, any message or request you leave with our AI assistant and, where you hear a recording notice, a recording, transcript and summary of the call.

Please don’t share health, financial or other sensitive personal information when you call.

When you use the chat on our website: the messages you send and the assistant’s replies, the time of each message, your browser type and a scrambled (hashed) version of your IP address that we use to limit abuse. If you leave a message or ask for a demo in the chat, we also keep the details you give, such as your name, email and phone number.

Automatically, when you visit the website:

Basic technical information needed to deliver and secure the site, such as your IP address, browser type and the pages requested. Our hosting and security providers process this information to protect the site from abuse.
Website analytics. We use Cloudflare Web Analytics, which doesn’t use cookies, to understand which pages are useful, in aggregate. We don’t use advertising cookies or sell your information.

Cookies

We aim to use as few cookies as possible. Cookies or similar technologies that are strictly necessary to run and secure the site (for example, to protect the site from automated abuse) are used without asking. If we ever use cookies for analytics or marketing, we will tell you here and, where required, ask for your consent first. You can block or delete cookies in your browser settings, though some features may not work. Our website chat keeps the open conversation in your browser’s session storage so it stays with you as you move between pages; it’s cleared when you close the tab.

Why we use it

We use personal information to:

Respond to your enquiry or demo request
Answer your calls to our main line, and pass your messages and requests to our team
Let our team review requests and calls, so we can follow up and prevent misuse
Send you emails about your request (for example, your meeting details)
Send you marketing emails, only if you have given express consent (see below)
Keep our website, phone line and systems secure, and prevent fraud and abuse
Meet our legal obligations

We don’t use your calls to train a shared or third-party AI model. We don’t sell personal information.

Marketing emails and CASL

We send commercial electronic messages only in line with Canada’s Anti-Spam Legislation (CASL).

Consent to marketing emails is separate and optional. It is never a condition of using the website or calling us.
Transactional messages you ask for — such as your meeting details — are not marketing.
Every marketing email identifies Middlesurf, includes our mailing address and has an unsubscribe link.
You can withdraw your consent at any time by using the unsubscribe link or by emailing our Privacy Officer. We process unsubscribe requests within 10 business days.

We share personal information only with service providers that help us run our website and phone line, and only what they need to do that work. They process it on our behalf and under contract.

Website hosting, security and analytics: Cloudflare, Inc., which hosts our website, protects it from abuse and provides cookieless analytics
AI assistant calls and chats: our AI service providers for speech recognition, voice and language, which process call audio and chat messages and produce transcripts
Email: our own mail server, hosted in Canada, which sends replies and follow-up emails
Phone calls: our telephone carrier, which connects calls to our phone system

We may also disclose personal information where required or permitted by law, or as part of a business transaction such as a sale or merger, subject to confidentiality protections.

Transfers outside Canada

Some of our service providers may store or process personal information outside Canada, including in the United States and other countries. While it is outside Canada, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. Our providers handle it under written agreements that require them to protect it and use it only to provide their services to us.

How long we keep it

We keep personal information only as long as we need it for the purposes above, or as the law requires.

Contact and demo enquiries, including messages and demo requests left with our AI assistant, are kept for 24 months after our last contact, unless you become a client.
Main-line call recordings, transcripts and summaries are kept for 12 months.
Website chat conversations are kept for 90 days.
Marketing consent records are kept as long as we need them to show we had consent, as CASL requires.
Unsubscribe requests are kept so we don’t contact you again.

When we no longer need personal information, we delete or anonymize it.

Call recording notice

Calls to our main line are answered by an AI assistant. If a call is recorded, you hear a notice at the start of the call; if you don’t want your call recorded, please hang up.

How we protect it

We use safeguards appropriate to the sensitivity of the information, including:

Encryption in transit (HTTPS) between your browser and our website
Access limited to Middlesurf staff and service providers who need it, with authentication on internal systems
Protection against automated abuse of the website

No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires.

Your rights

You can ask us:

Whether we hold personal information about you, and for a copy of it
To correct information that is inaccurate or incomplete
To withdraw your consent, subject to legal or contractual limits — for example, to stop marketing emails
How your information has been used and who it has been shared with

To make a request, contact our Privacy Officer. We may need to confirm your identity first. We will respond within 30 days, or tell you if we need more time as the law allows. Access is free in most cases.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

Quebec residents

If you live in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25) also applies. You have the rights described above, and you can also ask how we use any automated decision-making that affects you, and request that your personal information be communicated to you in a structured, commonly used technological format. Our Privacy Officer is the person in charge of the protection of personal information. You may contact the Commission d’accès à l’information du Québec if you have a complaint.

Children

Our website and services are intended for businesses and are not directed to children. We don’t knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this policy as our services or the law change. We will post the new version on this page with a new “last updated” date and, if the changes are significant, tell you by email or on the website before they take effect.

Last updated: November 3, 2026.