+1 coinfor reading to the end
+1
Contents0
Dock shows
Coin sound
Plain words
Protectionkeeps the business safe
Productivitykeeps your team working
Performancegrows the business with smart systems
WILDCARD Cybersecurity Inc., operating as WILDCARD * Managed IT Services ("WILDCARD", "we", "us"), provides the products and services offered at teamwildcard.ca and its subdomains. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.
WILDCARD Cybersecurity Inc., operating as WILDCARD * Managed IT Services, is a corporation registered in Alberta, Canada.
We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and to Alberta's Personal Information Protection Act (PIPA).
This policy applies to teamwildcard.ca and to the WILDCARD services delivered through its subdomains, including quotes.teamwildcard.ca, my.teamwildcard.ca, start.teamwildcard.ca and onboard.teamwildcard.ca. It also applies to the WILDCARD applications that connect to a Microsoft 365 or Google Workspace tenant on your behalf.
Our sister brand wildcardmsp.ca publishes its own privacy policy. Where you engage WILDCARD under a signed Master Services Agreement, that agreement's confidentiality and data handling terms apply to the services it covers, alongside this policy.
We do not collect or store full payment card numbers. Card payments are processed by Stripe, which receives your card details directly. We receive only a transaction record, the last four digits, the card brand and the expiry date.
When you visit our sites, we and our service providers collect your IP address, browser and device type, referring page, the pages you view, and timestamps. We use this to keep the service secure, diagnose faults, and understand which pages are useful.
Our public sites currently load five third-party components:
We also run our own first-party analytics: a random visitor id in a cookie (wc_vid, one year) records the pages you view, what you click, how far you scroll and how long you stay. It goes only to WILDCARD's own systems and is tied to you only if you give us your email through a scan, assessment or checkout. It respects Global Privacy Control and Do Not Track.
We do not run advertising pixels or social-network tracking pixels on teamwildcard.ca.
If you are a WILDCARD client, delivering the service requires us to hold technical and administrative information about your environment: user and mailbox lists, licence and seat counts, device inventories, configuration records, security alerts, backup status, and support ticket history. This information may include personal information about your staff. Where it does, your organization is the one accountable for that information, and we handle it on your behalf and under your instructions.
Our applications connect to Google Workspace in three ways:
A Google Workspace administrator approves each connection, on Google's own consent screen or in the Admin console, which lists the permissions below.
The read-only connection requests these permissions. Every one of them is read-only, except that Google bundles reading licences with changing them; we only read.
| Permission | What we read | Why |
|---|---|---|
| admin.directory.user.readonly | User accounts: name, email address, administrator status, 2-Step Verification status, last sign-in, organizational unit | Find accounts without 2-Step Verification, unprotected administrators and unused accounts |
| admin.directory.rolemanagement.readonly | Administrator roles and who holds them | Show who has administrator access, and which kind |
| admin.directory.domain.readonly | Verified domains and aliases | Confirm which organization we are reading, and check the email protection on its domain |
| apps.licensing | Licence and seat counts | Count seats and spot unused licences |
| cloud-identity.policies.readonly | Security settings, such as 2-Step Verification rules, password rules and Gmail protection settings | Find settings that leave accounts or email exposed |
| admin.reports.audit.readonly | Sign-in and administrator activity: failed and suspicious sign-ins with their time and IP address, 2-Step Verification changes, administrator privilege changes | Spot password guessing, suspicious sign-ins and unexpected administrator changes |
| admin.reports.usage.readonly | Google's daily security counts, such as how many accounts use 2-Step Verification | Check our counts against Google's own |
| admin.directory.group.readonly | Groups and their members | Find groups that hold administrator roles or include people outside the organization |
| admin.directory.orgunit.readonly | Organizational units | Show which settings apply to which accounts |
| admin.directory.device.mobile.readonly | Phones and tablets that sync company data: model, operating system, owner, last sync, compromised status | Find compromised or forgotten devices |
| admin.directory.device.chromeos.readonly | Chromebooks: model, operating system version, user, last sync | Find outdated or forgotten Chromebooks |
| openid, email | The administrator who approved the connection | Record who granted access, and for which domain |
The management connection requests these permissions:
| Permission | What it lets us do | Why |
|---|---|---|
| admin.directory.user | Read, create, update and suspend user accounts, add email aliases, reset passwords | Add and remove people, and create WILDCARD's two administrator accounts |
| admin.directory.user.security | Sign a person out and revoke their app access and app passwords | Secure an account when someone leaves or an account is compromised |
| apps.licensing | Read, assign and remove licences | Give new people a licence, remove unused ones, and keep WILDCARD's administrator accounts on free licences |
| admin.directory.group | Create groups and change their members | Set up team addresses such as info@ without paying for extra accounts |
| apps.groups.settings | Change group settings | Make a group work as a shared inbox and control who can post to it |
| admin.directory.orgunit | Read organizational units and move accounts between them | Apply the right security settings to each account |
| admin.directory.device.mobile.action | Remove company data from a phone or tablet | Protect company data when a phone is lost or a person leaves. We only remove the work account, never personal data |
| admin.datatransfer | Move ownership of files and calendars from one account to another | Hand a departing person's work to their successor |
| admin.directory.resource.calendar | Create and read shared calendars and rooms | Set up shared and resource calendars |
| admin.directory.domain | Read domains and add a domain or domain alias | Connect an organization's new or additional email domain |
| openid, email | Identify the administrator who approved the connection | Record who granted access, and for which domain |
Delegated access, where an organization has added it, covers these permissions:
| Permission | What it lets us do | Why |
|---|---|---|
| admin.directory.user | Read user accounts, and create a user | Count licensed users, and create one documented emergency administrator account |
| admin.directory.domain.readonly | Read verified domains | Confirm we are connected to the right organization |
| apps.licensing | Read licence and seat counts | Bill accurately and spot unused licences |
These lists are complete. We request nothing beyond them.
We use the management connection only in organizations that have hired us to administer them, and only for work they asked for or that our service includes. Every change it makes is logged. It cannot give any account administrator rights, except WILDCARD's own two administrator accounts when the connection is first set up, and it cannot change or remove those two accounts. We record both accounts in our documentation so your organization can see them and remove them.
No connection can read Gmail, Google Drive, Google Calendar, Google Photos or Google Chat content. Moving file or calendar ownership changes who owns them; we do not open or read them. We cannot read your messages or your files.
Read-only connection. We turn what we read into a security report: a grade and a short list of what to fix, shown on screen or as a PDF. If the organization signs up for monitoring, we read the same data again on a schedule to track how those items change and to alert the organization to new problems.
Management connection and delegated access. We use them to deliver the service you hired us for: adding, changing and removing people, groups, licences and devices when you ask or our service calls for it, counting licensed users for billing, confirming the organization, and keeping WILDCARD's administrator access.
We use Google user data for nothing else.
WILDCARD's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not and will not:
People at WILDCARD look at this data only to deliver or support the service, to fix a problem you reported, to meet a security or legal obligation, or when you ask us to.
Access tokens and service-account credentials are stored encrypted in our Cloudflare Workers infrastructure. They are never written into our source code, never logged, and reachable only by our operations service behind an authenticated endpoint. Privileged operations require a second authentication factor.
We keep the security report: the grade, the findings, the counts behind them, and the names and email addresses of the accounts the findings point to. It is stored encrypted under the same controls. We never see or store your people's own passwords. The passwords of WILDCARD's two administrator accounts, and any temporary password we set when you ask us to reset one, are kept only in our encrypted password vault.
For a one-time security check, we ask Google to end our access once the check has run. For monitoring and managed clients, we keep the connection until the organization removes it or our engagement ends, then delete it.
We keep security reports while we work with the organization and while any monitoring service runs. The organization can ask us to delete them at any time by emailing help@wildcardmsp.ca, and we answer within the 30 days described in section 9.
An administrator can remove WILDCARD at any time:
Removal takes effect immediately. It does not delete security reports or stored tokens on our side; email help@wildcardmsp.ca and we will delete them.
Microsoft 365 access is granted through admin consent and Microsoft's delegated administrative privileges. It can be withdrawn in the Microsoft 365 admin center or on the Microsoft Partner relationships page.
We rely on your consent, express or implied by the circumstances, as PIPEDA provides. You may withdraw consent at any time, subject to legal and contractual limits, by writing to help@wildcardmsp.ca. Withdrawing consent for information we need in order to deliver the service may mean we can no longer provide it.
We do not sell your personal information.
We share personal information with service providers who process it on our behalf, under contract, and only for the purposes described in this policy. The categories, and the providers we use today:
| Purpose | Provider |
|---|---|
| Website and application hosting, security, edge storage | Cloudflare |
| Business records, CRM, quoting | Airtable |
| Payments, invoicing, subscriptions | Stripe |
| Transactional email delivery | Resend |
| Our own email, files and collaboration | Microsoft 365 |
| Support ticketing, documentation, monitoring, backup | Autotask, IT Glue, Datto RMM, Datto SaaS Protection (Kaseya) |
| Affiliate and referral attribution | Impact.com |
| Search optimization, web typography | SearchAtlas, Google Fonts |
| Email signature management | Xink |
| Sales research and prospecting | Apollo.io |
We also disclose personal information to our professional advisers, accountants and insurers where necessary; to a purchaser or successor if our business is reorganized, sold or merged, in which case this policy continues to apply to the information transferred; and where the law requires it, including in response to a court order, a subpoena, or a lawful request from a government or law enforcement authority.
Where WILDCARD acts as a Microsoft Cloud Solution Provider or as a reseller for a product you buy through us, we share the details needed to provision and support your licences with that vendor.
Several of the providers listed above store and process information in the United States and other countries. While information is in another country it is subject to that country's laws, and may be accessible to its courts, law enforcement and national security authorities. We require contractual protections comparable to our own, and we remain accountable for the information throughout. To ask about our practices for a specific provider, write to help@wildcardmsp.ca.
No system is perfectly secure. We cannot guarantee absolute security, and we ask you to keep your own account credentials confidential.
| Information | Retention |
|---|---|
| Billing, invoice and tax records | 7 years after the transaction, as Canadian tax law requires |
| Client account and service records | The term of the engagement, then 7 years |
| Security assessment results (questionnaires) | 24 months from submission |
| Google Workspace security reports (section 4) | While we work with the organization and while any monitoring service runs; deleted on request |
| Prospect and enquiry contact details where no engagement follows | 12 months from last contact |
| Microsoft 365 and Google Workspace access tokens | Until access is revoked or the engagement ends, then deleted |
| Web and security logs | Up to 12 months |
| Marketing contact records | Until you unsubscribe or ask us to delete them |
When a retention period ends we delete the information or irreversibly anonymize it. Where we have to keep a record longer to meet a legal obligation or to defend a legal claim, we keep only that record, and only for as long as it is needed.
You may ask us to:
Write to help@wildcardmsp.ca. We respond within 30 days, and we will tell you if we need more time and why. We may ask you to verify your identity before we act, which protects you against someone else making a request in your name. If we refuse a request we will tell you why, and how to challenge that decision.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca.
If you work for an organization that engaged WILDCARD, and your question is about information held in that organization's systems, we will pass your request to that organization, which is accountable for it.
We use cookies and similar technologies to keep you signed in, remember your preferences, attribute referrals, and understand how the site is used. You can block or delete cookies in your browser settings. Blocking them may stop parts of the site from working, including sign-in and checkout.
Every marketing email we send carries an unsubscribe link, and we act on unsubscribes promptly, as Canada's Anti-Spam Legislation requires. Unsubscribing from marketing does not stop service and account notices, which we need to send you about your account, your billing and your security.
Our services are sold to businesses and organizations. They are not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, write to help@wildcardmsp.ca and we will delete it.
If a breach of our security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, keep a record of the breach, and tell you what happened and what to do about it.
We may update this policy. The version and effective date at the top of this page always show the current version. If we change how we collect, use or share personal information in a way that materially affects you, including any change to how our applications use Google user data, we will post the updated policy here and notify account holders by email before the change takes effect.
Our Privacy Officer is reachable at help@wildcardmsp.ca, or by mail at WILDCARD Cybersecurity Inc., operating as WILDCARD * Managed IT Services, 10650 113 ST NW, Suite 234, Edmonton, Alberta, T5H 3H6, Canada.
