# Privacy policy · Horizon Canonical: https://withhorizon.co/privacy-policy Legal # Privacy policy How we collect, use, disclose and protect personal information. Effective July 13, 2026 Compliance PIPEDA · Law 25 Governs Site & Services Keep a copy Important By using the Site or Services, you consent to the practices described in this Privacy Policy. Contents · 16 sections [01What we collect](#s1)[02How we use it](#s2)[03When we share it](#s3)[04International transfers](#s4)[05Cookies](#s5)[06Commercial messages](#s6)[07Retention](#s7)[08Security](#s8)[09AI & automated processing](#s9)[10Session recordings](#s10)[11Your choices & rights](#s11)[12Children](#s12)[13Provincial variations](#s13)[14Changes to this policy](#s14)[15Contact us](#s15)[16Governing law](#s16) Questions about anything here? Reach our Chief Privacy Officer. [privacy@withhorizon.co →](mailto:privacy@withhorizon.co?subject=Privacy%20question%20or%20request&body=Hi%20Matt%2C%0D%0A%0D%0AI%20have%20a%20question%20or%20request%20about%20my%20personal%20information%3A%0D%0A%0D%0A) Contents · 16 sections [01What we collect](#s1)[02How we use it](#s2)[03When we share it](#s3)[04International transfers](#s4)[05Cookies](#s5)[06Commercial messages](#s6)[07Retention](#s7)[08Security](#s8)[09AI & automated processing](#s9)[10Session recordings](#s10)[11Your choices & rights](#s11)[12Children](#s12)[13Provincial variations](#s13)[14Changes to this policy](#s14)[15Contact us](#s15)[16Governing law](#s16) This Privacy Policy explains how Exit Horizon Inc., operating as Horizon ("Horizon," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit exithorizon.com (the "Site") or use our Services. We comply with: - Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act ("PIPEDA"); - Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, where applicable to Quebec residents; and - Applicable substantially similar provincial legislation in Alberta and British Columbia. In Ontario, PIPEDA governs most private-sector organizations. Ontario's Personal Health Information Protection Act, 2004 (PHIPA) applies to health information custodians; we do not act as a health information custodian and do not seek to collect personal health information. For clarity, "personal information" means information about an identifiable individual. It does not include aggregate or anonymized information that cannot identify a person. Related documents [Website Terms of Use](/terms-of-use)[Terms of Service (paid client engagements)](#)[Discovery Call Terms](#) Section 01 ## What we collect ### 1.1 Information you provide directly - Contact details such as name, email address, phone number, job title, company name, and province. - Application and onboarding information for programs, memberships, or advisory engagements, which may include business size, revenue range, industry, years in operation, ownership structure, and goals. - Communications you send to us, such as emails, intake forms, survey responses, or support requests. - Financial and operational information you share during the course of advisory Services, including financial statements, employee schedules, customer and supplier information, and transaction-related documents. - Payment-related information provided to our payment processor (Stripe), such as billing address and the last four digits of a card. We do not collect or store full card numbers on our systems. ### 1.2 Information collected automatically - Device and usage information such as IP address, browser type, device identifiers, pages viewed, referring pages, and the dates and times of visits. - Cookie and similar-technologies information for essential Site functionality, analytics, personalization, and marketing, consistent with your cookie preferences and applicable law. ### 1.3 Information from third parties - Newsletter platforms, scheduling tools, analytics services, and payment providers may share limited information with us, such as subscription status, attendance, or transaction confirmations. - Publicly available information, such as LinkedIn profiles and company websites, to verify eligibility, understand your business context, and tailor content. Section 02 ## How we use personal information We use personal information to: - Operate, maintain, and improve the Site and Services; - Review applications and determine fit for advisory engagements, memberships, or programs; - Deliver advisory services, coaching, peer groups, workshops, assessments, and value baseline reports, including sending program communications and resources; - Personalize content and recommendations; - Process payments and manage accounts, billing, and renewals; - Send newsletters and other commercial electronic messages where we have your consent or a lawful basis to do so; - Respond to inquiries and provide customer support; - Conduct research and analytics to improve our frameworks and offerings; - Detect, investigate, and prevent fraud or misuse; and - Comply with legal obligations. Section 03 ## When we share personal information We may share personal information with: - **Service providers** who help us operate the Site and Services — including hosting, analytics, email and newsletter platforms, customer-relationship tools, scheduling and calendar tools, communications tools, artificial-intelligence and productivity tools, and payment processors. Service providers are permitted to use personal information only to provide services to us. - **Facilitators and contractors** who deliver parts of the Services under confidentiality obligations. - **Referred third-party service providers** (such as M&A advisors, accountants, tax counsel, legal counsel, or wealth advisors) whom we introduce to you with your consent, in accordance with our Terms of Service. - **Other members in your cohort or group**, but only information that you choose to share in those settings. - **Business partners** for event co-hosting or speaker engagements, where appropriate and disclosed to you. - **Legal and safety authorities** where required by law, regulation, subpoena, or court order, or to protect our rights, your safety, or the safety of others. We do not sell personal information. We do not share personal information for the personal-information-broker purposes prohibited under Quebec Law 25. Section 04 ## International transfers Our Site hosting and some service providers process personal information outside of your province and outside of Canada, primarily in the United States and, in limited cases, the European Union and other jurisdictions where reputable service providers maintain infrastructure. When personal information is processed in another country, it may be subject to the laws of that country and accessible to government authorities in that jurisdiction under lawful process. We use contractual and organizational measures — including standard contractual protections and vendor assessments — intended to provide a comparable level of protection to that required under Canadian privacy law. By using the Site or Services, you consent to the transfer, processing, and storage of your information in jurisdictions outside of Canada. Section 05 ## Cookies and similar technologies We use cookies and similar technologies to operate the Site, understand usage, remember preferences, and measure the effectiveness of our content. You can manage cookie preferences through the Site's cookie settings and your browser controls. Blocking some cookies may impact Site functionality. We categorize cookies as: Necessary Required for core Site features (session management, security). Analytics To understand how the Site is used and how it performs. Some of this is anonymous; with your consent, we may also link the pages you visit to the details you share with us. Personalization To remember your choices and preferences. When you fill in a form, your browser keeps your name, email, company and phone on your own device so the next form fills them in for you; it is not sent to us until you submit. Clear it any time with "Forget my details" in Cookie preferences. Marketing With your consent, to measure and improve our marketing and advertising, including showing you relevant ads on other sites. In accordance with Quebec Law 25 and best practice, Quebec residents receive an opt-in cookie consent banner before non-necessary cookies are set. Residents of other Canadian provinces receive a cookie notice consistent with PIPEDA implied-consent principles. Section 06 ## Commercial electronic messages We send newsletters and other commercial electronic messages ("CEMs") in accordance with Canada's Anti-Spam Legislation ("CASL") and, where applicable, the Unsolicited Telecommunications Rules and National Do Not Call List administered by the Canadian Radio-television and Telecommunications Commission. We obtain express or implied consent as required, clearly identify Horizon as the sender, provide a physical mailing address in each message, and include an easy unsubscribe mechanism. You may opt out of marketing communications at any time using the unsubscribe link in our messages or by contacting us at [privacy@withhorizon.co](mailto:privacy@withhorizon.co?subject=Privacy%20question%20or%20request&body=Hi%20Matt%2C%0D%0A%0D%0AI%20have%20a%20question%20or%20request%20about%20my%20personal%20information%3A%0D%0A%0D%0A). On our Site, we ask for your consent when you give us your email. A newsletter sign-up form subscribes you when you submit it. Other forms, such as your Optionality Score report, saving your diligence checklist or asking a buyer a question, only send what you asked for, and add you to our newsletter only if you tick the box. We keep a record of what you agreed to and when. Our mailing address and contact details are in [Section 15](#s15). When you ask us for something specific, such as booking a discovery call, sending a note to our team or sharing your story, we may follow up about that request by email, phone or text message: to confirm, remind, reschedule or respond. We use the contact details you gave us for this, only in connection with your request. Marketing messages still require your consent, and we do not add you to marketing text messages without your express permission. You can ask us to stop calling or texting you at any time by replying, telling us on a call, or contacting [privacy@withhorizon.co](mailto:privacy@withhorizon.co?subject=Privacy%20question%20or%20request&body=Hi%20Matt%2C%0D%0A%0D%0AI%20have%20a%20question%20or%20request%20about%20my%20personal%20information%3A%0D%0A%0D%0A). Transactional communications directly related to Services you have engaged (invoicing, scheduling, deliverables) are not marketing communications and continue as necessary to provide the Services. Section 07 ## Retention We retain personal information only as long as necessary for the purposes described in this policy, to meet legal or reporting requirements, and to resolve disputes. Specific retention periods include: Prospect and inquiry data People who contact us but do not become clients: up to twenty-four (24) months from last contact. Newsletter subscribers For the duration of the subscription plus twenty-four (24) months after unsubscribe (for CASL compliance records). Discovery-call and value-baseline records Including recordings and notes: up to twenty-four (24) months from the date of the meeting, unless a client engagement follows. Client engagement records Contracts, deliverables, communications: for the duration of the engagement and seven (7) years after termination, consistent with Canadian tax and business record retention requirements. Financial and payment records Seven (7) years, per Canada Revenue Agency requirements. Session recordings For engaged clients: retained for the duration of the engagement plus twelve (12) months after termination, unless a longer period is required by law. At the end of the applicable retention period, personal information is deleted or anonymized. Aggregated or anonymized data derived from personal information may be retained indefinitely for research and improvement purposes. Section 08 ## Security We use administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, use, or disclosure. Measures include access controls, encryption in transit, vendor due diligence, and secure disposal of records. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. In the event of a privacy breach involving a real risk of significant harm, we will notify affected individuals and the applicable privacy commissioner(s) in accordance with PIPEDA's breach-notification requirements. Section 09 ## AI and automated processing We use third-party software and cloud-based services, including artificial-intelligence and machine-learning tools, to help us: - Schedule, transcribe, summarize, and analyze meetings and calls; - Prepare for a call you book with us, by reviewing publicly available business information about you and your company (such as your company’s website, news coverage and public professional profiles); - Prepare and improve deliverables, frameworks, and internal work product; - Draft communications and follow-up materials; - Analyze aggregated and anonymized data to improve our methodologies; and - Support internal operations, research, and communications. By using our Services, you consent to the use of such tools for these purposes, subject to the confidentiality and use restrictions set out in our Terms of Service and Discovery Call Terms. We do not use your personal information to train third-party AI models where we have the ability to opt out, and we select AI service providers with contractual protections against such use where feasible. We do not make significant decisions about you based solely on automated processing. Any decisions we make in the course of the Services — such as engagement fit, advisory recommendations, or referrals — involve human review and judgment. Section 10 ## Session recordings With your consent (which you provide by booking or attending a meeting subject to our Discovery Call Terms or Terms of Service), we may record advisory sessions, calls, workshops, and other meetings conducted as part of the Services. Recordings are used for: - Internal quality assurance and training; - Preparation of session summaries, action items, and follow-up materials; and - Reference in connection with the ongoing delivery of the Services. Recordings are treated as Confidential Information under our Terms of Service and Discovery Call Terms and are retained in accordance with [Section 7 (Retention)](#s7). You may request that a recording be paused or that a specific session not be recorded by notifying Horizon in writing in advance or verbally at the start of the meeting. Discovery calls booked on our Site as video calls are recorded and transcribed using Fireflies.ai, an AI notetaker that joins the meeting; we tell you this when you book and in the calendar invite. Phone calls are not recorded. Section 11 ## Your choices and rights Access and correction You may request access to the personal information we hold about you and ask for corrections if it is inaccurate or incomplete. Withdraw consent Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing completed before withdrawal or processing based on other lawful grounds. Portability (Quebec residents) If you are a Quebec resident, you have the right to receive personal information you have provided to us in a structured, commonly-used, technology-neutral format, or to have it transferred to another organization, in accordance with Law 25. Cease dissemination or de-indexing (Quebec residents) In certain circumstances under Law 25, you may request that we stop disseminating your personal information or de-index links containing it. Marketing preferences You may unsubscribe from marketing communications at any time using the link in our emails or by contacting us at [privacy@withhorizon.co](mailto:privacy@withhorizon.co?subject=Privacy%20question%20or%20request&body=Hi%20Matt%2C%0D%0A%0D%0AI%20have%20a%20question%20or%20request%20about%20my%20personal%20information%3A%0D%0A%0D%0A). How to exercise these rights Contact our Chief Privacy Officer using the details in [Section 15](#s15). We will respond within thirty (30) days of receipt of a verified request, or within a longer period permitted by applicable law where necessary. Section 12 ## Children Our Services are intended for adults in a business context. We do not knowingly collect personal information from children under the age of 13 (or the applicable age of consent in your jurisdiction). If you believe a child provided us with personal information, please contact us so we can delete it. Section 13 ## Provincial variations Ontario For most private-sector activities in Ontario, PIPEDA applies. Ontario's Personal Health Information Protection Act, 2004 (PHIPA) applies to health information custodians. We are not a health information custodian and do not intend to collect personal health information. If we inadvertently receive such information, we will delete or de-identify it unless we have a lawful basis to retain it. Quebec Quebec residents are protected under the Act respecting the protection of personal information in the private sector, as amended by Law 25 (in force September 22, 2024). In addition to PIPEDA-comparable rights, Quebec residents have specific rights to data portability, cessation of dissemination and de-indexing, and disclosure of automated-decision logic where applicable. Alberta and British Columbia Residents of Alberta and British Columbia are protected under their respective provincial Personal Information Protection Acts, which have been deemed substantially similar to PIPEDA. Where those laws apply, we will comply with their requirements. Section 14 ## Changes to this policy We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. If we make material changes, we will post the updated policy on the Site, update the effective date, and — where required by law — notify affected individuals directly. Your continued use of the Site or Services after the effective date means you accept the revised policy. Section 15 ## Contact us If you have questions or requests regarding this Privacy Policy, wish to exercise your rights, or wish to make a complaint, please contact our Chief Privacy Officer: Matt Harrison Chief Privacy Officer, Horizon [privacy@withhorizon.co](mailto:privacy@withhorizon.co?subject=Privacy%20question%20or%20request&body=Hi%20Matt%2C%0D%0A%0D%0AI%20have%20a%20question%20or%20request%20about%20my%20personal%20information%3A%0D%0A%0D%0A) Mailing address Exit Horizon Inc., operating as Horizon 2967 Dundas St W, #1781 Toronto, ON M6P 1Z2 Canada We will work with you to resolve any concerns. You also have the right to contact: - The Office of the Privacy Commissioner of Canada for issues under PIPEDA ([priv.gc.ca](https://priv.gc.ca)); - The Commission d'accès à l'information du Québec for issues under Quebec Law 25 ([cai.gouv.qc.ca](https://cai.gouv.qc.ca)); - The Information and Privacy Commissioner of Ontario for issues under Ontario law such as PHIPA ([ipc.on.ca](https://ipc.on.ca)); or - The applicable privacy authority in your province of residence. Section 16 ## Governing law This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario. Where Quebec Law 25 applies to Quebec residents, its provisions apply to that extent. Effective July 13, 2026