Your data, handled with discipline.

What we collect

1. /01

   Information you give us

   Name, email, company, contact number, preferred contact time, and message when you use the contact form or request an audit. Contact number and preferred time are optional. Sign-in details are collected only if you hold an account.

2. /02

   Technical data with a form submission

   When you submit the contact form we also record the IP address and browser user-agent the request came from. We use these only to prevent abuse and rate-limit spam, and they are held with the enquiry itself — not used to profile or track you across sites.

3. /03

   Account & access data

   If you hold a Veltheon account, your sign-in identity and approval status, managed through Supabase Auth.

4. /04

   Security & audit logs

   If you are signed in, your sign-ins and protected-page views are recorded for security and accountability (who accessed what, and when). Those security logs are separate from public-site analytics and restricted to administrators.

5. /05

   Optional public-site analytics

   Only after you choose Allow analytics, we record pseudonymous page views, navigation and call-to-action clicks, scroll depth, engagement time, campaign tags, an advertising click identifier if you arrived from a paid search advertisement, browser performance metrics, and coarse country/region codes supplied by our delivery edge. Random visitor and session identifiers connect the journey to an enquiry if you later submit one. We do not record form values, raw IP addresses, city-level location, or browser user-agents in marketing analytics, and rows expire after 180 days.

6. /06

   Cookies and local storage

   Essential storage keeps sign-in and security controls working, and we store your analytics choice. If you allow analytics, we store random visitor/session identifiers and may load Microsoft Clarity for heatmaps and session playback on public marketing pages only. Clarity is configured for consent mode and strict masking; it is never loaded on admin, portal, sign-in, or product-delivery pages. We do not use advertising cookies, and we load no advertising or analytics tag from an ad network: if you arrive from a paid advertisement, the click identifier is read once from the web address and stored with your other analytics data, never set as a cookie in your browser.

Why we use it

To respond to your enquiries, provide and secure the services and accounts you ask for, meet our legal and contractual obligations, keep an honest record of access for security, and—only with your permission—understand which public pages and conversion paths are useful. We do not sell personal information, use it for advertising, or contact an anonymous visitor who has not chosen to identify themselves.

Where it lives & how long

Our core application records and authentication data are stored in a Supabase managed Postgres project in Canada (AWS ca-central-1), encrypted in transit (TLS 1.2 or later) and at rest by the platform, behind deny-by-default access controls. Supporting providers for application delivery, edge protection, source hosting, and transactional email may process limited data outside Canada. Their purposes, data, regions, and DPA status are listed on the sub-processors page. We keep personal information only as long as needed for the purpose it was collected or as the law requires, then delete or anonymise it. Pseudonymous first-party marketing events carry a 180-day expiry; enquiries and commercial records follow their separate legal and operational retention needs.

Sub-processors

We rely on a small set of vetted providers to operate the service:

• Supabase — Database & authentication (Canada region)
• Vercel — Application hosting & delivery
• Cloudflare — Edge, DNS & DDoS protection
• Resend — Transactional email (notifications)

The full, current list — with each provider's region and data-processing terms — lives on our sub-processors page.

Your rights

You can ask us at any time to:

• Access the personal information we hold about you
• Ask us to correct anything inaccurate
• Request deletion of your information, subject to our legal obligations
• Withdraw consent or object to a particular use
• Ask how, where, and how long your data is processed

To exercise any of these, email our Privacy Officer at [email protected]. We respond within the timelines set by applicable law.

Breaches

If a privacy breach creates a real risk of significant harm, we will notify affected individuals and the relevant authorities as required under PIPEDA and Québec Law 25.

Changes

We keep this policy current and will post any material change here with a new version number and effective date, recorded in the revision history below. For an engagement, the specifics are also governed by the agreement we sign with you.