PAGE / COMMUNITY
Privacy notice
How this website handles messages, comments, optional Analytics, email signup and publishing access.
Who operates this project
The Mississauga Accountability and Transparency Coalition is operated by Vierimaa Consulting Inc. Website setup is provided by Protection Ordinateur AS (DITC). Contact and privacy requests go to mississauga@vierimaaconsulting.com.
Messages you send
The contact form asks for your name, email, subject and message. We use them to review your question and respond. A public-source link helps us follow the record. Do not send sensitive personal records or another person’s private information through this form. Messages are delivered to the Coalition’s contact mailbox.
Email signup
Signup asks for your email address, an optional name and your express request for research and civic engagement updates. A confirmation email verifies the request before the address is marked confirmed. We record the request, confirmation date and consent wording. You can unsubscribe through the link in the confirmation message. Confirmed addresses can be exported by the administrator for an approved email platform. Sending a regular newsletter still requires that platform and approved sender details.
Storage and service providers
The website, content database, uploaded files and publishing accounts use AWS services in Canada (ca-central-1). CloudFront delivers the website through its global network. Email delivery uses AWS SES in the United States and the recipient’s email provider. Email processing may therefore occur outside Canada.
Access and retention
Publishing access is limited to invited administrators and editors using an authenticator app. Only approved entries and files are made available to website visitors. Contact messages remain in the review mailbox until the owner removes them. Signup records remain while the request is active; an unsubscribed record is scheduled for removal after 90 days. Expired confirmation codes are scheduled for removal after 24 hours. Technical service logs and daily content backups are retained for seven days. Backup copies may persist briefly after a primary record is removed.
Cookies, storage and analytics
The website offers optional Google Analytics audience measurement, described below. It does not load the Google tag until you choose Allow analytics. Choosing Essential only keeps optional Analytics disabled. The motion reading preference and your analytics choice are stored in your browser. Publishing tokens are kept in tab session storage for up to three hours so a page refresh can restore access. Passwords and authenticator setup keys are not stored there. Signing out clears the session. The administrator access gate uses your browser’s HTTP authentication handling. First-party aggregate story counts and optional third-party media are described separately below.
Your requests
Email mississauga@vierimaaconsulting.com to ask about a message or signup, request a correction, or ask for removal. This notice describes the website’s current information handling practices.
Article reactions and public comments
Reader reactions use a random reader identifier stored in your browser, allowing you to change or remove a thumbs-up or thumbs-down choice. The identifier is signed by the service and stored as a pseudonymous key with reaction records. Reactions are website feedback, not an election result or representative poll.
Comments ask for an optional public display name and the text you choose to publish. They appear immediately with a timestamp below the article. Do not include private email addresses, telephone numbers or another person’s private information. Administrators can hide or restore comments and review reports. Public comments and reactions remain associated with their article; hidden comments remain available to the publishing administrator for review.
Short-lived request counters use hashed identifiers to limit repeat submissions and abuse. Duplicate-comment markers expire after two days; server-side request limits expire shortly after their limit window. No advertising or behavioural campaign profiles are created from this feature. Email mississauga@vierimaaconsulting.com for a removal or privacy request.
Security and spam verification
Comment and reaction records are stored in the Canadian AWS content database with encryption at rest using AWS KMS. HTTPS protects requests to the hosted website and its backend. Publishing and moderation access require an authorized account and authenticator verification. A published comment is intentionally readable on the website; storage encryption does not make published text private.
Contact enquiries, newsletter signup requests and new comments are protected by AWS WAF CAPTCHA and submission limits. A valid human-verification token is checked at the AWS edge before these submissions reach the website service. The website service also checks the trusted verification proof. Requests with missing, expired or invalid verification are rejected.
Amazon Web Services processes verification tokens, IP addresses and technical browser or device information to detect automated submissions. Security processing may occur outside Canada. Request sampling and full request logging are disabled for this website’s WAF rules; aggregate security metrics remain enabled. Google reCAPTCHA is not used. Form validation, hidden spam fields and existing request limits remain active.
The verification control appears with each form. After a successful check, verification may be reused briefly in the same browser session. Newsletter confirmation and unsubscribe links continue to use their own signed, limited-use tokens. For help or an alternative way to contact the Coalition, email mississauga@vierimaaconsulting.com.
Story reads and embedded media
Story read counts cover activity recorded since tracking was enabled. Administrators see aggregate public reads and private-preview reads separately, with reactions, comments and reports for each published story. Counts are page loads, not unique people or a representative poll. A per-story timestamp in tab storage limits repeated reads to one per 30 minutes. No advertising profile or persistent audience identifier is created for this feature.
The server stores aggregate totals and daily counts. Daily count records are scheduled to expire after 90 days; random request markers used to prevent duplicate increments expire after two days. Request limits use short-lived hashed counters. Raw IP addresses are not added to story analytics records. Aggregate totals remain with the story.
YouTube videos and X posts load only when a reader chooses to play or load the embed. At that point, the media provider may process technical information such as the reader’s IP address and browser details under its own privacy practices. YouTube uses its privacy-enhanced player. An original-source link remains available if a provider blocks or removes an embed.
Administrators may edit a comment with a recorded reason. The public comment is labelled as edited by a moderator, retaining its author and original posting date. Previous text, the reason, date and responsible administrator remain in private edit history for review.
Optional Google Analytics
If you opt in, Google Analytics measures page views and engagement to help the Coalition understand which pages are useful. The website sends a cleaned page address, page title and general usage information. It removes confirmation codes, unsubscribe codes, email query values and other unnecessary URL parameters. Contact messages, comment text, display names, passwords and authenticator codes are not sent by the website’s Analytics integration. Admin pages do not load Analytics.
Visiting an advocacy website may reveal civic or political interests. If you consent, the connection to Google discloses technical information such as your IP address and browser information, and Google may use Analytics cookies with pseudonymous browser identifiers. This is not described as anonymous tracking. Processing may occur outside Canada under Google’s privacy practices. Google signals, advertising personalization and automatic enhanced-measurement form tracking are disabled. We do not use this integration to build voter profiles or advertising audiences.
Shared links may contain general campaign labels, such as a social platform and campaign name, so consenting visits can be counted by campaign. The website accepts only the source, medium and campaign labels used for this purpose. These links must not contain names, email addresses, telephone numbers or identifiers assigned to individual people. Campaign attribution is optional and is separate from the first-party aggregate story counts.
Use Privacy choices in the footer at any time to allow or decline Analytics. Declining disables future Analytics collection and removes this website’s Analytics cookies where the browser permits it. Analytics cookies are configured to expire after 60 days without extending their existing expiry on each visit. Your browser choice is remembered for up to 180 days. Essential website functions and first-party aggregate story counts remain available when you decline.
Contribution form and campaign records
The contribution form is hosted in Google Forms on behalf of Vierimaa Consulting Inc. for its registered third-party advertising campaign. It collects contributor and contact information to review eligibility, maintain campaign records and issue receipts. Google Forms is a separate third-party service.
The names and addresses of contributors giving more than $100 in total must appear in the public campaign financial statement. Campaign contribution records are subject to election-law recordkeeping requirements, separate from the routine website contact and newsletter records described above.
Submitting the form does not make a payment or guarantee acceptance. E-transfers are sent through your bank or credit union using the instructions supplied for the campaign. Do not enter banking passwords or account numbers in the form. For questions about contribution records, contact mississauga@vierimaaconsulting.com.
Publishing workspace activity
For invited publishing accounts, the workspace keeps a short-lived online or away status. Administrators can open a five-minute live activity view only when at least two different accounts are active. This shows the account, workspace section and saved entry title; it does not capture passwords, authenticator codes, keystrokes or unsaved writing. Detailed updates stop when the timed view ends. The live view provides no activity history. Temporary status records expire after five minutes and are excluded from daily content snapshots; infrastructure recovery copies follow the normal backup retention settings. Draft records separately retain the account that created them and the account that last edited them.
Technical request logs
For website security and reliability, limited API access logs are retained for seven days. They contain a request identifier, time, route template, response status, processing time and response size. These access logs do not contain visitor IP addresses, full page addresses or query strings, request bodies, email addresses, passwords or authentication tokens. This is separate from the AWS abuse-verification processing described above and from optional audience analytics.