Privacy Policy

Lighthill Consulting ("Lighthill", "we", "us") is a consulting practice based in Ontario, Canada. We help businesses with marketing, operations, and AI systems. This policy explains what information we handle, why, and the choices you have. It covers this website (lighthillconsulting.ca), our client services, and the software integrations we operate — including applications that connect to advertising platforms such as Meta and Google.

Questions, requests, or complaints: alec@lighthillconsulting.ca.

1. This website

This site is mainly informational. It runs no analytics or advertising trackers and contains no forms. The one exception is our TikTok connection page, used only by account holders we've invited. It sets one temporary security cookie, which lasts 15 minutes and isn't used for tracking. If you email us, we receive what you choose to send and use it only to respond to you.

Our hosting provider (Vercel) generates standard server logs — IP address, user agent, pages requested — for security and reliability. We do not use these logs to identify or profile visitors.

2. Information we handle when providing services

In the course of client engagements we handle two kinds of information:

• Business contact information — names, work email addresses, and correspondence of the people we work with, used to deliver and administer engagements.
• Client advertising and analytics data — described in section 3.

3. Platform integrations (Meta, Google, TikTok, and similar)

We operate internal software that connects to advertising and analytics platforms — including the Meta Marketing API, the Google Ads API, and Google Analytics — solely to provide services to clients who have authorized that access (for example, by granting our business partner access to their ad account).

What we access

• Advertising account structure and campaign settings (campaign names, statuses, budgets, targeting configurations);
• Aggregated performance metrics (spend, impressions, clicks, conversions);
• Audience definitions and, where a client directs it, customer lists the client already owns.

What we do with it

• Reporting, analysis, and campaign management for that client only;
• We never sell this data, never share one client's data with another, and never use platform data for purposes beyond the engagement it belongs to;
• We access the minimum data needed, using read-only credentials wherever possible.

How we protect it

• Credentials are stored in an encrypted secret manager (Google Cloud), never in plain text;
• Data is stored in access-controlled cloud infrastructure located in Canada where practical. Our website host may process requests, including connection requests, outside Canada, and some service credentials are replicated by our cloud provider across regions it selects;
• We limit access to the people and automated systems that need it, and credentials are never shared with other clients.

Retention

Platform data is retained only as long as needed to provide the engagement and meet legal obligations. When an engagement ends, we revoke our own access and delete or return client data on request.

TikTok

With the permission of a TikTok account holder, given on TikTok's own authorization page, we can use TikTok's Accounts API in two ways, through separate apps. Analytics: we read insights for that account: profile details, follower and post counts, daily account metrics, per-post performance, and aggregated audience breakdowns. We use this only to report to that account holder and the team they work with. Drafts: we send a video supplied by that account holder's team to the account's TikTok drafts. The account holder finishes it in the TikTok app and decides whether to publish it; we don't publish it. We keep our copy of a video only as long as needed to deliver it. We don't edit or delete posts, comment, message, or change ads; we don't download videos or images from TikTok; and we don't store information about individual viewers or followers. You can revoke access at any time in the TikTok app under Settings and privacy > Security > Manage app permissions. The retention and deletion terms in this policy apply. Each TikTok connection has an agreed end date. After it, we stop reading the account, revoke our access and delete the data we hold for it. Deleted data can remain recoverable in our cloud provider's backups for up to about nine days.

4. Data deletion requests

You may request deletion of any personal or business data we hold at any time. Email alec@lighthillconsulting.ca with the subject "Data deletion request" and a description of the data concerned. We will confirm receipt and complete the deletion within 30 days, and tell you when it is done. This is also the deletion mechanism for any data obtained through Meta, Google, or TikTok platform integrations.

5. Your rights

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). You may request access to personal information we hold about you, ask that it be corrected, or withdraw consent to its use. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

6. Children

Our website and services are directed at businesses and are not intended for children. We do not knowingly collect information from anyone under 18.

7. Changes

If this policy changes, we will update this page and the date at the top. Material changes affecting active clients will be communicated directly.