Privacy Policy
Last updated: October 14, 2026
Who we are
XLR Security Inc. sells security cameras, recorders and networking equipment to security dealers and installers across Canada. This policy explains what personal information we collect, why, who we share it with, and the choices you have.
It covers our website (www.xlrsecurity.com), customer accounts, orders and invoices, payments, shipping, phone calls and live chat. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for customers in Quebec, the Act respecting the protection of personal information in the private sector (Law 25).
Most of our customers are businesses. Business contact details, such as a name, work email and phone number, are still personal information, and we treat them that way.
Privacy Officer
Jaeden Wiens, Privacy Officer
XLR Security Inc., 1 High Meadow Pl, Unit 15, Toronto, ON M9L 0A3
info@xlrsecurity.com · 905-794-5508
Contact our Privacy Officer with any question or request about your personal information.
Information we collect
We collect only what we need to run your account, fill your orders and support you. Most of it comes from you directly; some is recorded automatically when you use our website or call us.
| Source | What we collect |
|---|---|
| Your account | Name, company name, email, phone, password (stored scrambled; we can’t read it), billing and shipping addresses |
| Dealer and distributor applications | Name, company, contact details, business information and anything else you write in the form |
| Orders, quotes and invoices | Products, prices, PO or job reference, billing and shipping addresses, order and payment history |
| Card payments | Card type, last four digits, expiry date, the approval code, and a token for a card you save. Your name and billing address go to our payment processor to verify the card. Full card numbers go straight to our payment processor; they never pass through or are stored on our servers |
| Phone calls | Your phone number, caller ID name, and the date, time and length of the call. We do not record calls |
| Live chat | Your messages, any name or email you give, and technical details about your browser |
| Your messages and contact details | |
| Website visits | IP address, browser and device type, pages viewed, the site that referred you, and the time of each visit (see Cookies and analytics) |
| Security | Sign-in attempts and the IP addresses they came from, used to block password-guessing attacks |
We don’t collect sensitive information such as health or financial account details beyond the payment details above, and we don’t buy personal information from other sources.
How we use it
We use your information to sell to you, support you and run our business, and for nothing else without your consent. Specifically, to:
- review dealer and distributor applications and set up your account and pricing;
- process quotes, orders, invoices and payments, and keep your card on file if you ask us to;
- ship your orders and give you tracking information;
- show your order history, invoices and account balance in My Account;
- answer your calls, chats and emails, and handle warranty returns (RMAs);
- keep our website and accounts secure, including blocking suspicious sign-in attempts;
- understand how our website is used so we can improve it (in aggregate, not to profile you);
- keep the accounting and tax records the law requires.
We do not sell or rent your personal information, and we do not use it for advertising on other websites. If we ever want to send you marketing email, we will ask first, and every message will include a way to unsubscribe.
Cookies and analytics
Our website uses a small number of cookies: some keep you signed in and your cart working, one measures how the site is used, and our chat widget sets its own. We use no advertising or social-media tracking cookies.
| Cookie or tool | Run by | Why | How long it lasts |
|---|---|---|---|
| Sign-in cookies | XLR Security (WordPress) | Keep you signed in | Until you close your browser (at most 2 days), or 30 days if “Remember me” is ticked |
| Cart and session cookies | XLR Security (WooCommerce) | Remember your cart and checkout | Up to 2 days |
| Analytics (Matomo) | XLR Security, on our own server | Count visits and see which pages are useful | Visitor cookie 13 months; session cookie 30 minutes |
| Live chat (Tawk.to) | tawk.to, Inc. | Run the chat window and reconnect you to an open chat | Set by Tawk.to; see its privacy policy |
Analytics. We use Matomo, which runs on our own server rather than a third party’s, so your browsing data isn’t shared with an analytics company. Matomo shortens your IP address before saving it, and records page views, clicks on our phone number, and form submissions. We use it to improve the site, not to identify you or target ads.
Videos. Our pages show YouTube video thumbnails, which load from Google’s servers. Google receives your IP address when a thumbnail loads, and sets its own cookies only if you play a video.
Your choices. You can block or delete cookies in your browser settings. If you block sign-in or cart cookies, you won’t be able to sign in or check out. Blocking analytics or chat cookies doesn’t affect the rest of the site.
Who we share it with
We share personal information only with the service providers below, and only what each needs to do its job for us. They may use it only to provide their service to us.
| Provider | What they do for us | What they receive |
|---|---|---|
| Zoho Books (Zoho Corporation) | Accounting, quotes, invoices and customer records | Contact details, addresses, orders, invoices and payments |
| Converge (Elavon) | Card payments and saved cards | Card details, cardholder name, billing address, payment amount and invoice number |
| Freightcom | Shipping quotes and labels. We save your shipping address in our Freightcom address book so we don’t retype it for each order | Name, company, shipping address and phone number |
| Shipping carriers (booked through Freightcom, such as Purolator) | Delivering your orders | Name, company, shipping address and phone number |
| Telnyx | Phone line connection for our phone system | Phone numbers and the date, time and length of calls |
| Tawk.to | Live chat on our website | Chat messages, any name or email you give, IP address and browser details |
| Microsoft 365 | Our email, including emails our website sends | Emails and the contact details in them |
| Vultr | Hosting our website and its database | Everything stored by our website |
Our phone system (FreePBX) and website analytics (Matomo) run on servers we control.
We may also disclose information when the law requires it (for example, a court order), to protect against fraud, or to a buyer if our business is sold, in which case this policy would continue to apply to your information.
Where your information is stored
Our website, its database, its backups and our analytics are hosted in Toronto, Canada. Our email (Microsoft 365) is stored in Canada, and our phone provider (Telnyx) stores call records in Canada. Some of our service providers store information in the United States: Zoho Books and Tawk.to. Our payment processor, Converge (Elavon), may process and store payment information outside Canada, including in the United States.
Information stored outside Canada is protected by our agreements with those providers, but it is subject to the laws of the country where it is held, and authorities there may be able to access it. Before choosing a provider that stores information outside Canada, we check that it protects personal information to a standard comparable to ours.
How long we keep it
We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires. Then we delete it or remove anything that identifies you.
| Information | How long we keep it |
|---|---|
| Orders, invoices and payment records | At least 6 years after the end of the tax year they relate to, as the Canada Revenue Agency requires |
| Account details | While your account is open. Accounts with no order or sign-in for 3 years are closed and their details deleted, except records we must keep |
| Saved card | Until you ask us to remove it or your account is closed |
| Saved shipping addresses (Freightcom) | While you are a customer |
| Emails, including dealer applications, voicemails and chat notifications | 7 years |
| Chat transcripts | We delete chats more than 2 years old at least once a year |
| Phone call records | 90 days at our phone provider; 1 year in our phone system’s call log |
| Website server logs and sign-in security records | 52 days |
| Analytics visit data | 25 months; after that only totals with no personal information |
| Backups | Our two most recent weekly backups (about 2 weeks) |
How we protect it
We protect your information with safeguards matched to how sensitive it is:
- Our website is encrypted (HTTPS) on every page.
- Card numbers are entered in our payment processor’s secure window, so they never reach our servers. This keeps us within the payment card industry’s (PCI) simplest compliance level.
- Passwords are stored scrambled (hashed), so no one at XLR Security can read them.
- Administrator accounts require two-factor authentication, and repeated failed sign-ins are blocked automatically.
- Only staff who need your information for their work can access it, and our website’s connection to our accounting system is read-only.
- We back up our website weekly so we can recover from a failure.
No system is perfectly secure. If a breach of your information creates a real risk of significant harm, we will notify you and report it to the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d’accès à l’information) as the law requires.
Your choices and rights
You can ask our Privacy Officer to do any of the following, at no cost. We’ll reply within 30 days and may ask you to confirm your identity first.
- See your information: get a copy of the personal information we hold about you, and learn how it’s used and who it’s been shared with.
- Correct it: fix anything inaccurate or incomplete. You can update most account details yourself in My Account.
- Delete it or close your account: we’ll delete your information except records the law requires us to keep, such as invoices.
- Remove a saved card or saved shipping address.
- Withdraw your consent to a use of your information. If that information is needed to serve you, such as a shipping address, we’ll explain what that means for your account.
- Get a copy in a common electronic format (for Quebec residents), so you can move it elsewhere.
If you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
Changes to this policy
We’ll update this policy when our practices or service providers change, and show the date of the latest version at the top of this page. If a change affects how we use information we already hold, we’ll tell account holders by email before it takes effect.
Questions or requests: Jaeden Wiens, Privacy Officer, info@xlrsecurity.com, 905-794-5508, 1 High Meadow Pl, Unit 15, Toronto, ON M9L 0A3.