This website
What this site collects, named
A short page about cardinal-os.com rather than about the product. It names every measurement running here, the cookies each one writes, the three hosts your browser talks to on the way, and what becomes of an address typed into a form. The analytics have an off switch and it is on this page.
This site is a set of pages about a property management system. It has no account to open, no dashboard to log into and no database of its own. Almost everything it knows about a visit is a number in an aggregate: how many people read the pricing page this week, how long the homepage took to render on a phone.
The exceptions are worth naming precisely, because a system sold on Canadian data handling should be able to account for its own marketing site as readily as for the product.
- Aggregate traffic, with no cookie
- Vercel Analytics and Speed Insights count page views and measure how fast pages render. They set no cookie, they build no profile, and the beacon goes to this site's own domain rather than to a third party.
- Google Analytics, which sets two cookies
- Two first-party cookies, _ga and _ga_68RN0ZYJ9G, plus the request that carries the page view to Google. They last 400 days. The switch below turns this off, and with it off neither cookie is set at all.
- The Meta pixel, which sets one cookie and sometimes a second
- Facebook and Instagram ads point at this site, and the pixel is how Meta is told that an ad brought somebody here. It writes a first-party cookie, _fbp, for 90 days, and a second one, _fbc, only if you arrived from a Meta ad. It reports which page you opened and, from the four forms, that a form was submitted. It is never sent the name or the email address you typed. The same switch below turns it off, and with it off the pixel is not loaded at all.
- What you type into a form, and only that
- The demo request asks for a name, an email address and the property, with the number of rooms and a message optional. The guide signup asks for an address. The channel waitlist adds which channel and which property. The accounting enquiry adds the practice, a name, roughly how many clients and a note. Nothing is inferred, appended or enriched from anywhere else.
- Three hosts outside this domain see the request
- Google, for the analytics tag. Meta, for the advertising pixel. jsDelivr, for the icon font the pages are set in. All three see an IP address the way any server does when a browser asks it for a file. Typefaces and photographs are served from this domain, so the font and image hosts see nothing.
The cookies, and the switch
Two tags run here, and one switch on this page turns both off
Quebec's Law 25 asks that a visitor be told when technology capable of identifying or profiling them is in use, and be given the means to deactivate it. This is that notice and that means.
The first is Google Analytics 4. It writes two first-party cookies, both lasting 400 days: _ga, which holds a random identifier so that four page views in one sitting count as one visit rather than four, and _ga_68RN0ZYJ9G, which holds the state of that one visit. The page view, the page address and the coarse location Google derives from the IP address go to Google. It runs on the production site only, so a preview build measures nothing.
The second is the Meta pixel, and it is here because this site runs Facebook and Instagram advertisements. It writes _fbp, which holds a random identifier for 90 days so that a visit and a click can be matched to each other, and _fbc, which records that you arrived from a Meta ad and exists only if you did. Meta is sent the page address, and when one of the four forms is submitted it is sent the fact that a submission happened. It is not sent the name or the address you typed into it. Like the tag above, it runs on the production site only.
The reason the first is here is ordinary: this site is a funnel, and a funnel that cannot be measured is rebuilt on opinion. The reason the second is here is narrower: an advertisement nobody can attribute is a budget spent on a feeling. The reason there is one switch rather than two is that measurement of a person is a different thing from measurement of a page, and the choice belongs to the person.
Measurement on this browser
Your choice is stored in this browser, so it holds on this device and travels with nothing.
The switch holds for as long as this browser keeps its site data. Clearing site data clears the preference along with everything else, and a different browser or device is a separate choice. A page view that already fired before you reached this control stays in the aggregate, and a cookie already written stays until it expires or you clear it. Turning it back on resumes Google Analytics on this page and the pixel on the next one, because while the switch is off the pixel is never loaded.
Browsers that block third-party tags, and extensions that block Google's domain or Meta's, already stop this before the page does. The switch above is for everyone else, and it works with JavaScript enabled because the thing it switches off is JavaScript.
Forms
Where an address goes after you type it
There are four forms on this site: the demo request, the guide signup, the channel waitlist and the enquiry from an accounting practice. All four end in the same place. The submission becomes an email to the person who runs Cardinal, sent through Resend, and it arrives in one inbox.
This site keeps no copy. There is no customer database behind these pages, no advertising platform receives the address, and it is not sold or passed to a list. If a webhook is configured for a lead to reach a second place, it reaches a destination the founder set, named on request.
One address, one purpose: replying to what you asked about. Ask for it to be deleted and it goes, along with the thread it arrived in.
A marketing site that cannot say where an address ends up is answering the question the product will be asked next.
Your rights
What you can ask for, and who answers
Under PIPEDA, and under Law 25 for a visitor in Quebec, a person can ask what is held about them, ask for it to be corrected, ask for it to be deleted and withdraw a consent already given.
On this website that resolves to a short list, because the holdings are short: an aggregate you are not identifiable in, the cookies you can switch off above or clear yourself, and whatever you typed into a form. All of it is reachable at one address, answered by a person rather than a ticket queue.
This page describes the website. Guest records inside the product are a separate system with a separate answer: data resident in Canada, one property's records readable only by that property and enforced by the database itself, daily backups. Those are set out in the questions page, and a procurement review of the product should start there rather than here.