Privacy Policy
How Troy handles personal data. Troy is the controller for its own site visitors, enquirers and client contacts, and a processor for the personal data inside a client’s connected advertising and commerce accounts.
- Who this applies to
- Anyone visiting troy-agency.com
- Anyone who sends a brief or writes to Troy
- The people Troy deals with at a client or prospective client
- Clients, for the data inside the accounts they connect — read with the data processing addendum
- Anyone whose personal data reaches Troy across the systems Troy's group shares
Who this covers, and Troy’s two roles
In plain EnglishTroy decides what happens to data about you as a visitor or a contact. For the data inside your own advertising accounts, you decide and Troy follows your instructions.
This policy is published by the business trading as Troy, which is being incorporated as Troy Agency Inc. federally, under the Canada Business Corporations Act, with its registered office in Ontario. Its office is Unit 6, 10651 Keele Street, Maple, Ontario L6A 3Y9, Canada. The incorporation has not completed and there is no corporation number yet: To be completed: There is no corporation number yet, which means the federal incorporation has not completed. Until it has, Troy Agency Inc. is an intended name rather than a company: it cannot sign a contract, and calling itself “Inc.” in one would be wrong. This is the first thing to finish.. Nothing here should be read as saying that a company by that name exists today or can sign anything. This policy covers the website at troy-agency.com, the brief form at /start, and the marketing services Troy sells today.
Troy operates from Ontario, Canada, so the federal private-sector law that governs how it handles personal information is the Personal Information Protection and Electronic Documents Act — PIPEDA — and the regulator is the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority. Troy’s markets are Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. In the United States, the state privacy laws apply where they catch what Troy does, and California’s is dealt with at clause 12.1. Some clauses below use the GDPR’s vocabulary — “lawful basis”, the Article 6 labels — because it is the clearest shorthand for ideas PIPEDA expresses differently; that is a vocabulary, not a statement that the GDPR applies to Troy. Which law catches a particular piece of data is a question of fact, and nothing in this policy is a statement that Troy has been assessed against any of them or complies with any of them.
Troy does two different jobs with personal data, and the law treats them differently. Which one applies depends on whose data it is, not on which part of Troy is doing the work.
- Troy, we, us
- The business trading as Troy, operating from Ontario, Canada and being incorporated as Troy Agency Inc.. Part of Lunari Group.
- Group company
- Lunari Group and the companies in it, including Louin (https://www.louin.io). Troy shares systems and data with them, which is dealt with at clause 8.2.
- Personal data
- Any information about an identified or identifiable living person. A work email address is personal data. So is a note you write about a colleague.
- Controller
- The party that decides why personal data is used and how. A controller answers for those decisions.
- Processor
- The party that handles personal data on a controller’s written instructions, and for no purpose of its own.
- Client
- A business that has signed an engagement with Troy. A client is the controller of the data in its own accounts.
- Connected account
- An advertising, commerce or email account a client owns and gives Troy access to — for example Meta, Google Ads, Shopify or Klaviyo.
- Brief
- The form at /start: what you want, a few facts about your business, and where to reply.
- Troy Score
- A free, independent read of a business’s marketing, prepared today by a strategist by hand against a published formula.
Where Troy is the controller
In plain EnglishTroy answers for this data itself.
Troy is the controller for personal data about the people it deals with directly:
- People who visit troy-agency.com.
- People who send a brief through /start, or who write to Troy by email.
- The people Troy deals with at a client or a prospective client — the named contacts on an account, the person who approves work, the person who receives an invoice.
- People who have a Troy Score prepared for their business, whether or not they go on to buy anything.
This policy is Troy’s notice to those people, and the whole of it applies to them.
Where Troy is the processor
In plain EnglishThe people inside your ad accounts, your store and your email list are yours, not Troy’s. Troy looks at that data for you and does nothing else with it.
When Troy is given access to a client’s connected account, the personal data inside that account belongs to the client’s own relationship with those people. The client is the controller and Troy is the processor. Troy acts on the client’s instructions and has no purpose of its own for that data.
That arrangement is set out in the data processing addendum, published alongside this policy and intended to form part of a client’s engagement. Like this policy it is a draft and nobody has signed it. Once a client has, and where it and this policy differ on data inside a connected account, the addendum governs.
Troy never imports a customer list, a subscriber list or a contact list into its own systems. What Troy reads, and what it never touches, is set out at clause 5.
The personal data Troy collects
In plain EnglishBusiness contact details, what you tell Troy about your marketing, and the ordinary records a web server keeps.
Troy collects the least it can. It does not ask for a home address, a date of birth, a government identifier or a payment card on the website. It does not build a profile of you from other sources, and it does not buy contact data.
Troy does not ask for special category data — health, race, religion, political opinions, trade union membership, sex life or sexual orientation, genetic or biometric data — and asks that you do not put any in a brief or a note.
If you only visit the site
In plain EnglishAlmost nothing, and no analytics at all today.
Troy has installed no analytics, no advertising pixels and no third-party trackers on troy-agency.com. Nothing measures you across sites, and nothing follows you to another site afterwards.
The site is hosted by Vercel Inc. and runs in Vercel's Washington, D.C. region (iad1), in the United States. Troy is Canadian; its website is not in Canada, and a request from Toronto is served and logged in the United States. clause 9 is the full account of that.
Vercel Inc. keeps request logs in the ordinary way a web server does: your IP address, the page requested, the time, the response, and the browser string your browser sends. Troy uses request logs to keep the site available and to investigate abuse, and for nothing else. They are kept for 90 days (a proposed default, not yet approved).
Your appearance settings — theme, density, accent — are stored in your own browser under the key troy:appearance. They never leave your device, they are not a cookie, and Troy cannot read them. Your motion setting is deliberately not stored at all. This is covered in the cookie policy.
When Troy does want to know how the site is used, it has chosen Vercel Analytics, which is cookieless and does not track anyone across sites (a proposed default, not yet approved). It is not installed. Nothing is measuring anything on the site today, and on the day it is switched on this clause says so first — which product, what it measures, and whether it sets a cookie — rather than afterwards.
If you send a brief or write to Troy
In plain EnglishThe fields on the form, and whatever you choose to write.
The brief form at /start asks for: what you want (a free Troy Score, a conversation with Troy’s team, a place on the Agents invite list, or a place on the Yourself waitlist), your website, your monthly advertising spend as a band, the channels you use, an optional note, your name and your work email. Nothing else on the form is required and there are no hidden fields that collect anything about you.
The form carries one field labelled so that only an automated script would fill it in. If it is filled in, the request is discarded. It collects nothing about a person.
If you write to troy@louin.io instead, Troy holds your message, your address and anything you attached.
There is no careers form on this site. If you write about working at Troy, the same rules apply: Troy holds the message you sent and nothing more, and there is no recruitment system behind it.
If your company becomes a client
In plain EnglishThe details needed to do the work, bill for it and keep a record of who approved what.
For the people Troy deals with at a client, Troy holds:
- Name, job title, work email address and work telephone number.
- The billing contact and the details on an invoice. Troy holds no card numbers. No payment provider has been appointed; whichever one is, it goes on the sub-processor list before it takes a payment.
- Correspondence: emails, meeting notes, and the record of what was discussed and decided.
- Who was granted access to which connected account, and when it was granted or removed.
- Who approved a piece of work, a spend change or a send, and when. This record is permanent by design: it is the point of the approval queue, and it necessarily names a person.
- The spend authority a client sets in writing — the cap, and who may change it.
These records do not sit on systems Troy alone runs. Troy, Louin and Lunari Group share systems and data. Client data is held on systems Lunari Group runs, and the companies in the group can see each other's data. clause 8.2 is the full account, and it is the clause to read before you send Troy anything you would not want another company in the group to see.
Where the data comes from
In plain EnglishFrom you, from your colleagues, or from an account you connected.
- From you directly: the brief form, an email, a call, a contract.
- From your colleagues: a client names the people who should have access or receive a report.
- From your own connected accounts, where a client has granted access. Troy is a processor for that data.
- From your public website, which a strategist reads to prepare a Troy Score.
- From your browser, automatically: the request logs described at clause 2.1.
- From a referral inside Lunari Group or from Louin, where someone has asked for an introduction.
- From the systems Lunari Group runs, which Troy shares with the other companies in the group. Data can reach Troy that way rather than from you, and clause 8.2 says what that means.
Troy does not scrape. Access to a platform comes from that platform’s own sign-in or its official connector, applied for and reviewed by the platform that owns it, never from a scraper or a shared password. Troy does not buy lists and does not enrich what you give it from a third-party data broker.
Why Troy uses personal data, and on what basis
In plain EnglishOne table. For every purpose: what is used, what the basis for it is — or, in one row, is not — and how long it is kept.
Every use of personal information needs a reason the law recognises. PIPEDA reaches Troy first and puts it as knowledge and consent, with a short list of exceptions; the “lawful basis” column below uses the GDPR’s Article 6 labels because they are the clearest shorthand for the same ideas, not because Troy offers its services in the EU or the UK. What PIPEDA requires instead is set out under the table. This table is the complete list of what Troy does as a controller, including the one thing on it that has no basis yet. If Troy wants to use your data for something that is not on it, Troy will tell you first.
| Purpose | Data used | Lawful basis | How long |
|---|---|---|---|
| Replying to a brief or an enquiry | Name, work email, website, spend band, channels, note | Steps taken at your request before a contract (Article 6(1)(b)); or Troy’s legitimate interests in answering a business enquiry (Article 6(1)(f)) | 24 months from your last contact with us, unless you ask us to delete it sooner (a proposed default, not yet approved) |
| Preparing a free Troy Score | Your business contact details, your public website, and read-only access to the accounts you name | Steps taken at your request before a contract (Article 6(1)(b)) | 24 months from your last contact with us, unless you ask us to delete it sooner (a proposed default, not yet approved), and deleted within 30 days of the account being disconnected or the engagement ending, whichever is first (a proposed default, not yet approved) for anything read from an account |
| Running the service for a client | Client contact details, correspondence, approvals, access records | Performance of the contract with the client (Article 6(1)(b)); legitimate interests where the contact is not the contracting party (Article 6(1)(f)) | 7 years after the engagement ends (a proposed default, not yet approved) |
| Keeping the permanent change and approval log | Who approved what, and when | Performance of the contract (Article 6(1)(b)); Troy’s and the client’s legitimate interests in an accurate record of who authorised a change to live spend (Article 6(1)(f)) | 7 years after the engagement ends (a proposed default, not yet approved) |
| Invoicing, accounts and tax | Billing contact, invoice details | Legal obligation (Article 6(1)(c)) | 7 years after the engagement ends (a proposed default, not yet approved), subject to the statutory minimum in Ontario, Canada |
| Keeping the site available and investigating abuse | IP address, request logs, browser string | Legitimate interests in a working, un-abused website (Article 6(1)(f)) | 90 days (a proposed default, not yet approved) |
| Writing to a business about Troy’s services | Work email address, company name | Legitimate interests in business-to-business marketing (Article 6(1)(f)); consent where local law requires it, including CASL for a commercial electronic message sent from or opened in Canada. Every message identifies Troy and carries a one-click unsubscribe | 24 months from your last contact with us, unless you ask us to delete it sooner (a proposed default, not yet approved) |
| Answering a data rights request | Whatever you send, plus enough to find your records | Legal obligation (Article 6(1)(c)) | 7 years after the engagement ends (a proposed default, not yet approved) |
| Establishing, exercising or defending a legal claim | The relevant records only | Legitimate interests (Article 6(1)(f)); legal obligation where a court requires it (Article 6(1)(c)) | 7 years after the engagement ends (a proposed default, not yet approved) |
| Holding Troy’s records on systems Lunari Group runs, where the other companies in the group can see them | Everything at clause 2.3, the briefs at clause 4, and anything read from a connected account | Not established. Under PIPEDA, using someone’s personal information for a purpose they were not told about needs their meaningful consent, and no group data-sharing agreement, notice or consent record exists: To be completed: What makes the sharing lawful, and how is it disclosed? Under PIPEDA, using someone's personal information for a purpose they were not told about needs meaningful consent, and a Louin customer has not agreed to their data being used for Troy's marketing. This needs, at minimum: a written agreement inside Lunari Group, notice to the customers whose data moves, a way for them to say no, and a record of consent. This is the most serious open item on this page — the site now discloses the sharing, but disclosure alone is not a lawful basis. | 7 years after the engagement ends (a proposed default, not yet approved) |
| Cross-client benchmarks — planned, not built | Aggregate account metrics only | Consent (Article 6(1)(a)), given separately by the client and never tied to a discount | deleted within 30 days of the account being disconnected or the engagement ending, whichever is first (a proposed default, not yet approved) |
Where Troy relies on legitimate interests, the law requires that interest to be weighed against yours. The table names the interest in each case, and Troy’s view is that each of those uses is one a business contact would expect. That is Troy’s own view, not a finding, and you can challenge it: you can object at any time, and clause 12 says how. Where Troy relies on consent, you can withdraw it at any time without giving a reason, and withdrawing it does not undo what was lawfully done before.
PIPEDA is built differently, and it is the law that reaches Troy first. Rather than a list of bases it requires Troy to identify the purpose before or at the time of collection, to limit collection to what those purposes need, and to collect, use or disclose personal information with your knowledge and consent unless one of the Act’s exceptions applies. Consent can be implied where the information is not sensitive and the purpose would be obvious to you. The purposes above are the identified purposes, and Troy does not use personal information for a new one without going back for it.
That is the standard the row about Lunari Group does not meet. Troy’s records sit on systems the group runs and the other companies in the group can see them, which is a purpose nobody was told about when they sent a brief or signed an engagement. Meaningful consent under PIPEDA means the person understands what will be done and agrees to it, and there is no agreement, no notice and no consent record for this: To be completed: What makes the sharing lawful, and how is it disclosed? Under PIPEDA, using someone's personal information for a purpose they were not told about needs meaningful consent, and a Louin customer has not agreed to their data being used for Troy's marketing. This needs, at minimum: a written agreement inside Lunari Group, notice to the customers whose data moves, a way for them to say no, and a record of consent. This is the most serious open item on this page — the site now discloses the sharing, but disclosure alone is not a lawful basis.. The sharing is disclosed here because disclosure is owed either way. Disclosure is not a basis, and this policy does not claim one.
PIPEDA also carves out business contact information — a name, position, work address, work email and work telephone number — where it is collected, used or disclosed solely to communicate with someone in relation to their work. Most of what Troy holds about a client contact is exactly that. Whether a particular record falls inside the carve-out is a question of fact, so Troy does not treat it as licence to hold more, and applies the rest of this policy to that data anyway.
Marketing email is its own regime again. Canada’s Anti-Spam Legislation applies to a commercial electronic message sent from or opened in Canada: it requires consent, express or implied, it requires the sender to identify itself and give a mailing address, and it requires an unsubscribe mechanism that stays working for at least sixty days and is acted on promptly. Troy sends from Ontario, Canada, so that is the standard its own outbound messages are written to, and the address they carry is Unit 6, 10651 Keele Street, Maple, Ontario L6A 3Y9, Canada. Whether a given message is caught, and whether implied consent exists for a given address, depends on the facts. Where Troy drafts email or messages for a client, the client is the sender: the list, the consent and the record of it are the client’s, Troy does not send without the client’s written approval, and the service terms and the acceptable use policy set out who carries that.
The brief form at /start
In plain EnglishA person reads every brief. It is used to reply to you, and for nothing else.
A brief is read by a Troy strategist, not by an automated qualification system. There is no scoring of you as a lead, no routing rule that decides your worth, and no automated rejection. If Troy is the wrong fit, a person says so.
- Your brief is used to reply to you and, if you asked for one, to prepare a Troy Score.
- It is not sold, rented, licensed or passed to a data broker. It is not used to build an audience or a lookalike audience anywhere.
- It is not added to a marketing list without a further step, and every message Troy sends carries a one-click unsubscribe.
- The spend band and the channels are used to know where to look. They are not used to price you: the prices are published.
- Asking for a place on the Agents invite list or the Yourself waitlist means Troy will write to you when that thing opens. Nothing on either list is for sale today.
The endpoint that receives a brief does not write it to a server log. The body of a brief is personal data and is treated as such.
Where a brief is held once it arrives is dealt with at clause 8.2: on systems Lunari Group runs, which the other companies in the group can see. It is worth knowing before you write the note field.
What Troy reads from a connected account
In plain EnglishRead-only, on accounts you own, and you can take the access back the same day.
A Troy Score needs read-only access and nothing more. Read-only is the lowest access tier on every platform Troy connects to. Troy never asks for edit access to prepare a score, and nothing in your accounts is changed to produce one.
Today there is no built connection. A strategist is added as a viewer on the accounts you name, using each platform’s own sign-in, and that read-only seat is the only access Troy has. The accounts and the tokens are yours: revoking access is something you do in your own platform settings, not a request you file with Troy. When it is revoked, the work stops the same day.
What a strategist reads is account data — campaigns, ad sets, spend, results, product and stock records, list size and engagement. Most of it is not personal data at all. Where it is, or where it can be linked to a person, Troy is the processor and the data processing addendum governs it.
Troy never exports your customer list, your subscriber list or your order records as a list of people. Troy reads what a list looks like — how large it is, how much of it is still engaged — and the people behind it stay in your tools.
Where Troy drafts an email or a message that will go to that list, the client sends it. The consent behind each address, and the record of it, are the client’s: that is what CASL requires of a sender in Canada and what the equivalent rules require elsewhere. Troy does not send on a client’s behalf without written approval, and does not import a list in order to send one.
Data read from a connected account is kept for deleted within 30 days of the account being disconnected or the engagement ending, whichever is first (a proposed default, not yet approved), on the systems described at clause 8.2. Deletion on disconnection is dealt with in the data processing addendum as well as at clause 10.
Automated decision-making and the Troy Score
In plain EnglishNo computer decides anything about you on its own. The Score grades a business, not a person, and it is prepared by hand.
Troy does not make decisions about people by automated means alone. There is no automated decision that produces a legal effect for you, or that affects you in a similarly significant way.
Where a Quebec resident’s personal information is involved, Quebec’s Law 25 requires an organisation to tell the person when a decision about them is based exclusively on automated processing, and to let them make representations to a member of staff. Troy makes no such decision today. If it ever does, this clause changes before the decision is made, not after.
The Troy Score is a grade for a business’s marketing, not a judgement about a person. It works like this:
- The formula is published on /score, with each dimension and its weight, and it is versioned. When it changes, the change and the reason are published.
- Today a strategist prepares each score by hand from read-only access, against that formula.
- Every point deducted comes with the evidence behind it. No evidence, no deduction.
- A finding you dismiss with a reason stops costing you points. You know things about your business that an audit does not.
- It grades the state of your marketing. It does not predict results, and it will never say it does.
When the platform does the reading rather than a person, the formula stays published, the evidence requirement stays, and a person still reviews the report before it is sent. If that ever changes, this clause changes first.
The same holds for agent work. An agent may draft, build and propose. A named person approves anything that ships or spends. There is no unattended decision about a person anywhere in the design.
AI tools and personal data
In plain EnglishTroy uses AI to draft marketing work. Briefs and customer lists do not go into it, and Troy will not buy a tier that trains on what is sent.
Troy’s strategists use third-party AI tools to draft copy, produce creative and summarise account data. The vendors are OpenAI and Anthropic. Troy does not build or train its own models. The AI disclosure document sets out where AI is used, how AI work is labelled, and what Troy will not do with AI at all.
- A person reviews everything an AI tool produces before it reaches a client or an audience. The human approval step is not a formality; it is the control.
- Troy does not put a brief, a customer list or a contact list into an AI tool.
- Both OpenAI and Anthropic are United States companies. Unless a regional processing option is chosen and confirmed, what Troy sends them is processed in the United States: clause 9.
- Troy will not use an AI vendor, or a vendor’s tier, that reserves the right to train on what is sent to it. Which plan each vendor is used under has not been confirmed, so today that is a rule Troy is buying to rather than a contract you could inspect: To be completed: Which plan is each of OpenAI and Anthropic used under, and does that plan allow the provider to train on what Troy sends? Both say their business and API terms exclude training by default, but the answer depends on the plan and has to be confirmed rather than assumed — a client will ask, and the sub-processor list has to state it..
- Troy does not create photoreal AI people or AI voices, and does not run consumer-facing chat agents.
- The approval queue is not built yet. When it is, AI labels are shown in it before a client approves the work, so a client sees what is labelled and why.
- The record of which work was AI-assisted, and who approved it, is kept for as long as the client record, so a question about a piece of work can always be answered (a proposed default, not yet approved).
- Troy has not committed to any content-provenance or machine-readable marking standard for AI-made creative, and claims none: Troy makes no commitment to any content-provenance or watermarking standard today. It labels AI-made work in the approval queue and tells the client what was AI-made.
Who Troy shares personal data with
In plain EnglishSuppliers that help Troy run, the other companies in Troy’s group, and nobody else — unless the law makes Troy hand something over.
Troy does not sell personal data, and does not disclose it to anyone outside Lunari Group for that organisation’s own marketing. What the companies inside Lunari Group can see is a different matter, it is not a sale, and it is set out at clause 8.2 rather than counted out here.
Suppliers and sub-processors
In plain EnglishThe companies that touch your data. The list is public, and the group is on it.
Running a company means using suppliers: to host the site, to send and receive email, to hold documents, and in time to take payment. Any supplier that handles personal data for Troy is a processor, acts on Troy’s instructions under a written contract, and is named on the sub-processor list, which is published as its own document alongside this one.
Three entries on it are settled. Vercel Inc. hosts the site, in Vercel's Washington, D.C. region (iad1), in the United States. Lunari Group runs the systems Troy’s client data sits on, which makes it a processor of that data and not merely a parent — clause 8.2 is why. OpenAI and Anthropic are the AI vendors, on a plan that has not been confirmed: To be completed: Which plan is each of OpenAI and Anthropic used under, and does that plan allow the provider to train on what Troy sends? Both say their business and API terms exclude training by default, but the answer depends on the plan and has to be confirmed rather than assumed — a client will ask, and the sub-processor list has to state it..
Two are still open: the destination for the brief form (Google (Gmail). Forms on this site are sent as email to a Lunari Group mailbox, and are not stored in a database) and a payment provider, neither of which has been appointed. The sub-processor list is the authoritative one and says what a written contract with each supplier does and does not cover today. This policy does not name suppliers in prose beyond the ones above, because a name in two places goes stale in one of them.
Where Troy is a processor for a client, the data processing addendum sets how much warning a client gets before a new sub-processor starts and how to object: 30 days' notice before a new sub-processor starts, with a right to object in that period (a proposed default, not yet approved).
A client’s own tools are not Troy’s sub-processors. Meta, Google, Shopify and Klaviyo are the client’s relationships, under the client’s own contracts, and Troy is a visitor in them.
Group companies
In plain EnglishTroy shares systems and data with the other companies in its group, and they can see each other’s data. The basis for that is not in place yet.
Troy is part of Lunari Group, alongside Louin (https://www.louin.io). Some of Troy’s first conversations come from that network, as introductions.
The group is not only a shareholding. Troy, Louin and Lunari Group share systems and data. Client data is held on systems Lunari Group runs, and the companies in the group can see each other's data. That is a description of how the group works today, not a plan for later: the systems are shared, so what is on them is shared too. It applies to what you send Troy through this site, to a brief, to correspondence, to client records, and to anything read from a connected account.
Two consequences follow, and both are stated here rather than buried. Lunari Group is a processor of the personal data Troy holds for a client, because it runs the systems that data sits on, and it is named on the sub-processor list for that reason. And where another company in the group can see Troy’s data, it sees it as itself and not as Troy’s processor — which makes it a disclosure to a separate organisation, not an internal filing arrangement.
Under PIPEDA, using someone’s personal information for a purpose they were not told about needs their meaningful consent. Reading a Louin customer’s orders, margins or invoices for Troy’s marketing is such a purpose, and the reverse is too. What would make the sharing lawful — a written data-sharing agreement inside Lunari Group, notice to the people whose data moves, a way for them to say no, and a record of what they agreed to — is not in place: To be completed: What makes the sharing lawful, and how is it disclosed? Under PIPEDA, using someone's personal information for a purpose they were not told about needs meaningful consent, and a Louin customer has not agreed to their data being used for Troy's marketing. This needs, at minimum: a written agreement inside Lunari Group, notice to the customers whose data moves, a way for them to say no, and a record of consent. This is the most serious open item on this page — the site now discloses the sharing, but disclosure alone is not a lawful basis.. This clause says what happens. It does not say the sharing is lawful, consented to or covered by an agreement, and no other clause in this policy says so either.
An introduction is a smaller thing than any of this: if someone in the group suggests you speak to Troy, what Troy is handed is a name and a way to reach you. What Troy and the rest of the group can already see on the shared systems is the separate question, and it is the one this clause is about.
Courts, regulators and a change of ownership
In plain EnglishRare, and Troy tells you unless it is forbidden from doing so.
Troy will disclose personal data where the law requires it: a court order, a binding request from a regulator or law enforcement, or a legal obligation in Ontario, Canada. Because the site and its data run in Vercel's Washington, D.C. region (iad1), in the United States, a lawful request may also come from a United States authority to the host rather than to Troy, and Troy may not be told about it. Troy checks that a request it receives is valid and specific, gives the minimum that answers it, and tells the person affected unless it is legally prohibited from doing so.
Troy will also share data with its professional advisers — lawyers and accountants — where it needs advice or has to make a claim, and with an insurer if it ever has cover. Troy holds no professional indemnity and no cyber insurance, so there is no insurer to name and none standing behind a claim. Records kept against a possible claim are kept with Ontario’s Limitations Act, 2002 in mind: it sets a basic two-year period running from the day a claim is discovered, with a fifteen-year long-stop.
If Troy is ever sold, merged or reorganised, personal data may transfer with the business. It would remain subject to this policy or to one at least as protective, and Troy would say so before the transfer takes effect.
Where the data goes
In plain EnglishTroy is Canadian. Its website, and what the website stores, run in the United States.
Troy operates from Ontario, Canada and its markets are Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. Its website does not run in Canada. The site is hosted by Vercel Inc. in Vercel's Washington, D.C. region (iad1), in the United States, so from the moment you load a page — before you have typed anything — the request, the logs and anything you go on to send are handled in the United States.
Personal data Troy holds as a controller is stored and processed in Vercel's Washington, D.C. region (iad1), in the United States. The AI tools Troy’s strategists use (OpenAI and Anthropic) are United States companies as well. Troy’s own records sit on systems Lunari Group runs, which is dealt with at clause 8.2; where those systems are hosted is not settled and this policy does not guess at it.
Canada does not generally prohibit sending personal information abroad, but PIPEDA treats a transfer to a supplier as a use rather than a disclosure: the organisation that transfers it stays accountable for it, has to use contractual or other means to give it a comparable level of protection, and has to be open with people about the practice. Being open includes saying that information may be processed in another country and may be accessible to that country’s courts, law enforcement and national security authorities. This clause is that notice.
For the contractual part, Troy relies on the Standard Contractual Clauses, with the UK Addendum where the United Kingdom is involved, entered into through each supplier's own data processing agreement (a proposed default, not yet approved). A safeguard on its own is not the end of the matter: the law of the destination country has to be weighed against it. Troy has not made that assessment and no such assessment exists.
You can ask Troy for a copy of the safeguard used for a particular transfer. Write to privacy@louin.io and Troy will send it, with commercial terms removed.
How long Troy keeps things
In plain EnglishOnly as long as there is a reason, and the reasons are listed.
Troy keeps personal data for as long as it needs it for the purpose it was collected for, plus any period the law requires. When a period ends, the data is deleted or irreversibly anonymised. Each period below is marked as a proposed default, which is what it is: a conventional number chosen so this policy can be read end to end, not a decision anybody has approved.
| What | How long | Why |
|---|---|---|
| A brief or enquiry that does not become a client | 24 months from your last contact with us, unless you ask us to delete it sooner (a proposed default, not yet approved) | So a later conversation starts where the last one ended, and so Troy can show what it was asked and what it answered |
| Client records, contracts and correspondence | 7 years after the engagement ends (a proposed default, not yet approved) | The engagement itself, then the record-keeping periods Canadian tax law expects and the limitation periods in Ontario, Canada — Ontario’s Limitations Act, 2002 sets a basic two-year period running from the day a claim is discovered, with a fifteen-year long-stop |
| Data read from a connected account | deleted within 30 days of the account being disconnected or the engagement ending, whichever is first (a proposed default, not yet approved) | To prepare and explain a score or a report. Deleted after disconnection, on the timetable in the data processing addendum |
| The approval and change log | 7 years after the engagement ends (a proposed default, not yet approved) | It is the record of who authorised a change to live spend. It is permanent for the life of the engagement by design |
| Server and access logs | 90 days (a proposed default, not yet approved) | Availability and abuse investigation |
| A record that you asked Troy to delete or stop contacting you | For as long as the request has to be honoured | Deleting the record would undo the request. It holds your email address and the date, and nothing else |
A backup is not deleted the moment a live record is. Deleted data can persist in a backup until that backup expires on its ordinary cycle, during which it is not used for anything.
These periods are about Troy’s own records, and the records are on systems Lunari Group runs (clause 8.2). Deleting on time therefore depends on the group’s systems and backups as well as on Troy’s intentions, and Troy has no written arrangement with the group about either.
Security
In plain EnglishThis is what Troy intends. Troy has no certification and no audit, and says so rather than implying otherwise.
The design Troy is working to:
- Least privilege. Read-only access wherever read-only is enough, which is everywhere today.
- Access to a client’s accounts is granted to a named person, recorded, and removed when it is no longer needed.
- Spend caps enforced at the ad platform as well as inside Troy, so a fault in Troy’s code cannot spend past them.
- A permanent, append-only change log, so who did what is answerable after the fact.
- Nothing built on scraping, and no credential sharing: every connection uses the platform’s own sign-in.
- Suppliers chosen with their security terms read, and named publicly on the sub-processor list.
Two things that belong here rather than in a footnote. Troy holds no professional indemnity and no cyber insurance, so nothing stands behind an incident except Troy itself. And Troy’s records sit on systems Lunari Group runs (clause 8.2), so the security of your data depends on the group’s controls as much as on the list above, and Troy has no audit, report or written commitment from the group to show you.
No system is perfectly secure, and Troy will not pretend otherwise. PIPEDA requires an organisation to report a breach of security safeguards that creates a real risk of significant harm to the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority, to notify the people affected, and to keep a record of every breach whether or not it is reportable. That is the standard Troy is working to. Where Troy is a processor for a client, the client is the one who reports, and the data processing addendum sets how quickly Troy has to tell them: without undue delay and in any event within 48 hours of becoming aware of it (a proposed default, not yet approved).
Report a vulnerability to troy@louin.io. Troy will not take legal action over a report made in good faith that does not damage data or disrupt the service. Troy does not commit to a response time, a disclosure window or a reward, has no published vulnerability disclosure policy, and says so rather than implying a programme exists. The security statement is where that is tracked.
Your rights over your data
In plain EnglishYou can see it, correct it, delete it, take it elsewhere, or tell Troy to stop. Which rights you get depends on where you live.
Which rights you have depends on where you are. Under PIPEDA you can ask what Troy holds about you and how it is used, get a copy, have it corrected, withdraw consent, and challenge Troy’s handling of it — first with Troy, then with the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority. The table below is the wider list, written in the GDPR’s vocabulary because it is the most complete one and the easiest to ask against; Troy applies each entry where the law where you live gives it to you, and you do not have to be in the EU or the UK to ask. clause 12.1 and clause 12.2 say what applies where. Troy will not charge you for exercising a right, and will not treat you worse for it.
| Right | What you can ask for | Limits worth knowing |
|---|---|---|
| Access | A copy of the personal data Troy holds about you, and an explanation of what it is used for | Troy will remove other people’s data from the copy |
| Correction | Anything wrong or incomplete put right | Troy will tell anyone it shared the data with, where that is possible |
| Erasure | Your data deleted | Not absolute. Troy may keep what it needs for accounts and tax, for a legal claim, or for the approval log described at clause 2.3 |
| Restriction | Troy holds the data but stops using it, while a dispute about it is resolved | Often the right answer where erasure is not available |
| Portability | The data you gave Troy, in a structured, machine-readable file | Applies to data you provided, held on consent or contract |
| Objection | That Troy stops using your data where it relies on legitimate interests | Troy stops unless it has compelling grounds that override yours. For direct marketing there is no override: Troy stops |
| Withdraw consent | That consent you gave is withdrawn, at any time, without giving a reason | It does not undo what was lawfully done before you withdrew it |
| Automated decisions | Human involvement in a decision made only by a machine | Troy makes no such decisions. See clause 6 |
To use any of them, write to privacy@louin.io. Say what you want; you do not need to name the right or the article. Troy may ask for enough information to be sure who you are, and asks for no more than that. Troy answers within the statutory period: under PIPEDA an access request has to be answered within 30 days, with an extension only in the limited cases the Act allows and only if Troy tells you inside the first 30 days. Other laws set their own periods, and California’s are at clause 12.1.
One thing an access request will turn up. Because Troy’s records sit on systems Lunari Group runs and the other companies in the group can see them (clause 8.2), a copy of what Troy holds about you is not a copy of everywhere it has been. Troy can tell you what it holds and that the group can see it. Troy cannot today tell you who in the group has looked, because there is no access log across the group to answer that from.
If you are in California
In plain EnglishYou have rights to know, delete, correct and opt out. Troy does not sell or share personal information, so there is nothing to opt out of.
Under the California Consumer Privacy Act, as amended, you have the right to know what personal information Troy has collected about you and where it came from; to have it deleted; to have it corrected; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising any of them.
Troy does not sell personal information. Troy does not share personal information for cross-context behavioural advertising. It has never done either, and there is no mechanism in the site or the service by which it could happen today: there are no advertising pixels on troy-agency.com and no advertising audiences built from anything you send. There is therefore no “Do Not Sell or Share My Personal Information” link, because there is nothing behind it. Disclosure to the other companies in Lunari Group, described at clause 8.2, is not a sale and is not cross-context behavioural advertising, and it is disclosed there rather than counted out here.
Troy does not collect sensitive personal information as the CCPA defines it, and does not use or disclose any for a purpose that would trigger the right to limit.
Categories collected, their sources, why they are collected and who they go to are at clause 2, clause 2.4, clause 3 and clause 8. Retention is at clause 10.
To make a request, write to privacy@louin.io. An authorised agent may act for you if they show written permission and Troy can verify it with you. Troy answers within the periods the CCPA sets: confirmation of receipt within 10 business days, and a substantive answer within 45 days, extendable once by a further 45 days where the statute allows it.
If you are elsewhere in Canada, or elsewhere in the United States
In plain EnglishSimilar rights, different names. Ask and Troy will apply them.
In Canada, PIPEDA applies across the country to Troy’s commercial activity, and three provinces have their own private-sector laws that have been found substantially similar to it — Quebec, Alberta and British Columbia — each with its own commissioner. Quebec’s Law 25 goes further than PIPEDA in places: it gives a right to have personal information ported in a structured, commonly used technical format, and it requires an assessment before personal information is communicated outside Quebec.
Other US states with comprehensive privacy laws give residents broadly similar rights — to confirm what is held, to get a copy, to correct it, to delete it, to opt out of sale and targeted advertising, and to appeal a refusal.
Troy does not maintain a different standard for each place. Where a right exists in your jurisdiction, ask for it at privacy@louin.io and Troy will apply it. Where a law gives you a right to appeal a refusal, say so in your message and a different person will look at it.
How to complain
In plain EnglishTell Troy first if you want to. You do not have to.
If Troy has got something wrong, write to privacy@louin.io and say so. Troy would rather fix it than be told about it by a regulator.
You do not have to come to Troy first. You can complain directly to a privacy regulator. Troy’s is the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority. In Quebec, Alberta or British Columbia the provincial commissioner may be the right one instead. In California, the California Privacy Protection Agency or the Attorney General; in another US state, the regulator named in that state’s own privacy law.
Complaining to a regulator does not take away any other legal remedy you have.
Children
In plain EnglishThis is not for children, and Troy does not knowingly hold their data.
Troy sells to businesses. The site and the service are for people acting in a business capacity, and nothing on either is directed at children.
Troy does not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached Troy, write to privacy@louin.io and it will be deleted.
Troy does not knowingly sell or share the personal information of anyone under 16, and could not, because it does not sell or share personal information at all.
Cookies and what is stored in your browser
In plain EnglishNo tracking cookies today. Your appearance settings stay on your device.
The cookie policy, published alongside this document, is the full account of what troy-agency.com puts in your browser and why. In summary: there are no analytics cookies, no advertising cookies and no third-party trackers today, and your appearance settings are stored locally on your own device rather than sent anywhere.
One thing is not confirmed. Whether Vercel Inc. sets a strictly necessary cookie of its own on this project once it is deployed — for routing, load balancing or a bot check — has not been checked at the host: To be completed: Whether Vercel sets a strictly necessary cookie of its own on this project once deployed — routing, load balancing or a bot check. Confirm at deploy and list it in the cookie policy.. It is confirmed at deployment and listed in the cookie policy, which is the document that tracks it.
Because there is nothing to consent to, there is no cookie banner. If that changes, a banner appears before the cookie does, the choice is real, and refusing is as easy as accepting.
Changes to this policy
In plain EnglishEvery version is dated and the changes are listed at the end.
This policy will change, and often, because most of the decisions behind it have not been made. Every change is recorded in the version history at the foot of this page, with the date and what changed. Troy does not quietly edit a policy in place.
If a change materially affects how Troy uses personal data it already holds, Troy will tell affected clients and contacts directly before it takes effect, and will not apply a new purpose to old data without a lawful basis for doing so.
This version is a draft. It has not been reviewed by a lawyer, it is not in force, and it does not create obligations for anyone. The contract you sign governs.
How to reach Troy about your data
In plain EnglishOne address for privacy, one for everything else, and a person on the end of both.
For anything in this policy — a rights request, a question, a complaint — write to privacy@louin.io.
For anything else, troy@louin.io.
By post: Troy Agency Inc., Unit 6, 10651 Keele Street, Maple, Ontario L6A 3Y9, Canada. Formal legal notices go to troy@louin.io and are dealt with in the website terms and the service terms, not here. To report a vulnerability, troy@louin.io, on the terms at clause 11.
No individual is named on this site. Privacy questions reach the person accountable for privacy at Troy through the address below. Troy has not appointed a data protection officer and does not claim to have one; if it ever does, the name and the contact details are published in this clause. Until then every privacy request goes to privacy@louin.io, and a named person answers it.
Troy does not offer its services to people in the European Union or the United Kingdom. An organisation established outside the EU that offers goods or services to people in it has to appoint a representative there under Article 27 of the GDPR, and the UK GDPR asks the same for the United Kingdom. In the EU, none appointed. Troy does not offer its services to people in the European Union, and will appoint a representative there before it does. In the United Kingdom, none appointed. Troy does not offer its services to people in the United Kingdom, and will appoint a representative there before it does. If you are in either place, that is the thing Troy has to do before it can take you on, and this clause is where it will be named.
Version history
| Version | Date | What changed |
|---|---|---|
| 0.3 | 20 Sep 2026 | Material change, and the reason this version exists. Earlier versions said that being part of a group gave Troy no shortcut to anyone's data and that access was never assumed. That is not how Troy works: Troy, Louin and Lunari Group share systems and data, client data sits on systems Lunari Group runs, and the companies in the group can see each other's data. Clause 8.2 now says so, Lunari Group is named as a processor, and the lawful basis for the sharing is a visible blank in clause 3 and clause 8.2 because there is not one yet. Also: the incorporation is described as in progress rather than complete, the markets are Canada and the United States only, the EU and the UK are no longer addressed as current markets, clause 9 says plainly that the site runs in the United States, the AI vendors are named, and the security clause states that no insurance is held. |
| 0.2 | 20 Sep 2026 | Ontario incorporation, the Vercel host and the published contact addresses settled. Retention periods, the transfer mechanism and the breach window filled in as proposed defaults, marked as proposals. PIPEDA added alongside the GDPR material, CASL added where Troy's own marketing and a client's sends are dealt with, and Quebec's Law 25 flagged as possibly applying. Still a draft, still not reviewed by a lawyer. |
| 0.1 | 19 Sep 2026 | First draft, written alongside the site. Not reviewed by a lawyer. |