Privacy & Cookie Policy

Last updated: 2026-09-28

1. Who we are

This policy applies to the websites valmentum.ca and valmentum.ai (collectively, "the Site", "our Site"). The Site is operated by:

  • Feng Liang, operating as a sole proprietor
  • Business address: Burnaby, British Columbia, Canada
  • Privacy / general contact email: [email protected]

For privacy-specific requests you may write to the same address and mark your message "Privacy / PIPA request". We have designated a privacy contact responsible for compliance with British Columbia's Personal Information Protection Act (PIPA); day-to-day privacy matters are handled through the Privacy address above.

We operate as a sole proprietor in British Columbia and meet our privacy obligations under BC PIPA; where processing is interprovincial or cross-border, PIPEDA may also apply.

2. Scope

This policy covers personal information we collect through the Site, including account/subscription data, contact-form or support emails, payment-related data, forum/membership activity, and technical data such as server logs and cookies. The Site may contain links to third-party websites. We are not responsible for the privacy practices of those websites; check their policies before providing personal information.

3. What is personal information

Under BC PIPA, "personal information" means information about an identifiable individual (for example name, email, billing data, IP address, device/browser data, subscription history, forum posts tied to your account). It does not include purely business contact information held for directory purposes.

4. Your rights under BC PIPA

Subject to PIPA's exceptions, you have the right to:

  1. be told why we collect, use or disclose your personal information at or before collection;
  2. give, and withdraw, consent (withdrawal does not affect lawful processing already done);
  3. access the personal information we hold about you, including how it has been used and to whom it has been disclosed;
  4. request correction of inaccurate or incomplete personal information;
  5. complain to us and, if unresolved, to the Office of the Information and Privacy Commissioner for British Columbia (OIPC).

BC PIPA requires organizations to respond to access requests no later than 30 days after receipt. We may extend up to 60 days where the request lacks detail, involves a large volume of information, or requires consultation with another organization, and we will tell you in writing if we do. Correction requests are handled on a similar reasonable-timeline basis; if we disagree with a correction we may annotate your record instead.

If you are unsatisfied with our response, you may complain to the OIPC:

Office of the Information and Privacy Commissioner for British Columbia - https://www.oipc.bc.ca

5. What we collect and why

a) Account & subscription data - name, email, billing details, subscription type/period, login identifiers. Purpose: create your account, provide paid content, renew/manage subscriptions, respond to support, meet tax/accounting obligations. Legal basis under PIPA: consent and, where required, performance of the subscription contract.

b) Support & contact emails - any information you include (name, email, message, attachments). Purpose: reply to inquiries, troubleshoot, maintain records. Basis: consent and our legitimate need to operate support.

c) Payment data - subscription payments are processed through Stripe. We do not store full card numbers on our systems; Stripe collects and processes card/billing data as a payment processor. Purpose: take payment, prevent fraud, issue refunds. See Stripe's privacy policy for its processing.

d) Forum / membership activity - posts, messages, watchlists, comments, and any user-generated content in member areas. Purpose: operate community features, moderate, enforce terms. Basis: consent and contract performance. You are responsible for the content you post and must not post unlawful, defamatory, infringing or abusive material (see our Terms).

e) Educational/market content inputs - if you save watchlists, scans, notes or upload files, we store them to provide the service. Market statistics, quotes and third-party data shown in the Service are provided "as available" and may come from third-party data sources; we do not guarantee accuracy and nothing is investment advice (see Terms).

f) Technical & log data - IP address, browser type/version, operating system, device data, referring URL, pages viewed, timestamps, approximate location derived from IP, and error logs. Purpose: security, abuse prevention, debugging, analytics, service improvement.

g) Cookies and similar technologies - see Section 8.

We aim to collect only what is reasonably necessary. PIPA requires that collection, use and disclosure be for purposes a reasonable person would consider appropriate in the circumstances.

6. Consent

Where PIPA requires consent, we obtain it at or before collection - for example when you create an account, buy a subscription, join the forum, or sign up for marketing emails. You may withdraw consent at any time by contacting [email protected]. Withdrawal may affect your ability to use certain paid or personalized features, but we will not retaliate by withholding data to which you are entitled. We do not currently set any non-essential cookies, so there is no cookie consent to withdraw; if that changes, Section 8 explains how consent will be obtained and withdrawn.

Certain processing does not require fresh consent where permitted by PIPA - e.g., limited use needed to perform your subscription contract, comply with tax/legal obligations, or protect the security of the Site, subject to PIPA limits.

7. Sharing, processors and cross-border

We do not sell your personal information. We share it only with limited parties, under contract or legal obligation:

  • Cloudflare - domain/DNS, and, where enabled, CDN/proxy, WAF, email routing or bot protection. Cloudflare may process technical data such as IP, request metadata and email headers. Cloudflare acts as our service/processing provider.
  • Stripe - payment processing, fraud screening, invoicing/refunds.
  • Google Analytics - not currently used. We do not currently run Google Analytics or any comparable analytics service. If we enable analytics in the future, this policy will be updated first and analytics cookies will be set only with your consent (see Section 8).
  • Email/hosting/infrastructure providers - used to operate the Site, store data, send email and back up systems.
  • Professional advisers, auditors, regulators - where required by law or to defend legal claims.
  • Successor entity - if we sell, merge or transfer the business/assets, your personal information may transfer to the successor on the same privacy terms.

Some of these providers may process or store personal information outside Canada. Where data is processed outside BC/Canada, it may be subject to the laws of another jurisdiction, including possible disclosure to courts, regulators or law-enforcement authorities in that jurisdiction. We seek to protect your information through written agreements, appropriate technical and organizational safeguards, and vendor due diligence; however, cross-border processing carries different legal exposures than storing data solely in BC. If you want specifics of current sub-processors, email [email protected].

We will disclose personal information where required by Canadian law, court order, tax/financial regulation, or to investigate abuse/fraud/security incidents.

8. Cookies & tracking

We currently use only cookies and similar technologies that are strictly necessary to operate the Site and provide the services you request. We do not currently use analytics, advertising, marketing, personalisation or any other non-essential cookies, and we do not sell or share cookie data for advertising.

What we set, and why:

  • Strictly necessary - session / authentication. A single first-party session cookie (HttpOnly, Secure, SameSite) keeps you signed in, preserves your language and market preference for the session, and protects against cross-site request forgery and abuse. It is set when you sign in, and it is cleared when you sign out or when it expires. If you do not sign in, session-scoped data is not retained beyond your browser session.
  • Strictly necessary - security. Our network provider (Cloudflare) may set or process technical identifiers to detect and block malicious traffic, rate-limit abuse and protect the Site. These are used only for security and are not used to build advertising profiles.

Because we use only strictly necessary cookies, no consent is required and no consent banner is shown. Where a cookie is strictly necessary to deliver a service you have asked for, PIPA permits it to be set without consent. You can still block or delete cookies at any time using your browser settings; note that blocking the session cookie will prevent sign-in and paid-content access from working.

If we introduce non-essential cookies in the future (for example analytics), we will: (a) update this policy before they are set; (b) set them only after you give consent; and (c) provide a way to change or withdraw that consent at any time (for example a "Cookie settings" link in the footer). We will not treat your continuing use of the Site as consent for non-essential cookies.

Data collected through the strictly necessary cookies and Cloudflare's security processing is described in Sections 5 and 7 above; Cloudflare publishes its own privacy and cookie policies, which you can consult for retention details.

9. Marketing emails and CASL

If you subscribe to newsletters, market updates, product announcements or educational emails, we send them under Canada's Anti-Spam Legislation (CASL). We rely on express consent (opt-in checkbox, not pre-ticked) or, where permitted, an existing business relationship (e.g., recent subscription/purchase). Every commercial electronic message will include our identity, a valid contact address, and an unsubscribe mechanism. You can unsubscribe at any time; we process unsubscribe requests within 10 business days.

Transactional emails about your account, payment, security or legal notices are not marketing and may be sent based on your use of the Service.

10. Security

We maintain reasonable safeguards appropriate to the sensitivity of the information - HTTPS/TLS in transit, access controls, authentication controls (including MFA where available for admin/account access), logging, patching, backups and least-privilege access. Because we are a small operation, controls are proportionate but documented; payment-card data is handled by Stripe rather than stored locally. No method is 100% secure; we cannot guarantee absolute security but will respond to suspected incidents under our internal breach process.

Under BC PIPA, private-sector breach notification is not governed by the same mandatory significant-harm regime that applies to public bodies; however, we treat suspected breaches seriously, contain and investigate them, and may notify affected users and the OIPC where appropriate.

11. Retention

We keep personal information only as long as necessary for the purposes in this policy or as required by law:

  • account/subscription data: for the life of your account plus a limited period for tax, dispute, renewal and security purposes;
  • payment records: as required by Canadian tax/accounting rules (generally at least 6 years for tax-support records; confirm with your accountant);
  • support emails: typically until the issue is resolved plus a reasonable support/audit period;
  • forum/membership content: while published or until you delete it, subject to moderation backups;
  • server logs: limited retention for security/debugging (e.g., a few weeks to a few months depending on risk);
  • session/authentication records: for the life of the session, and for as long as an authenticated session remains valid where you chose to stay signed in;
  • security/abuse records (including network-provider processing): limited retention for security and debugging (e.g., a few weeks to a few months depending on risk);

When information is no longer required, we delete or anonymize it using reasonable methods.

12. Access and correction requests

To request access to your personal information, email [email protected] with "PIPA access request" in the subject and enough detail to locate your records (name, email used for the account, approximate dates). We will acknowledge, verify your identity, and respond within 30 days or any permitted extension. A minimal fee may be charged only where permitted by PIPA (e.g., for photocopying/electronic production of large volumes); we will tell you in advance if any fee applies.

To correct inaccurate data, use the same address; if we agree, we correct and, where appropriate, notify parties to whom we disclosed the information in the prior year; if we disagree, we may annotate your record.

13. Children

The Site and subscriptions are for users aged 18 or older. We do not knowingly collect personal information from minors; if you believe a minor has provided data, contact us to delete it.

14. Changes

We may update this policy for legal, regulatory or operational reasons. Material changes will be posted on the Site and, where required, notified by email or in-account. Continued use after changes take effect constitutes acceptance of the updated policy.

15. Complaints

First contact [email protected] with "Privacy complaint". We will investigate and respond. If you remain unsatisfied, you may apply to the OIPC: https://www.oipc.bc.ca. For cross-border/PIPEDA-only issues you may also contact the Office of the Privacy Commissioner of Canada, but for our BC operations PIPA is the primary provincial regime.

16. Contact

Privacy contact

Feng Liang, sole proprietor

Burnaby, British Columbia, Canada

This page is the authoritative English version. Translations into other languages are provided for convenience only; in case of ambiguity, the English version prevails.