Privacy notice.

1. Who we are

Nuvetralise Systems Inc. is a Canadian corporation registered in Ontario. The studio is at 460 King Street West, Suite 401, Toronto, ON M5V 1L7. Our CRA business number is 78934 2156 RT0001. For privacy questions, write to privacy@nuvetralise.com; you can also reach our designated privacy lead, Mara Quill, at the same address.

2. What this notice covers

This notice covers personal information we collect through the website at nuvetralise.com, our marketing channels, and the standard course of running an engagement (a contract with a customer). It does not cover the telemetry data we process on our customers' behalf — that is governed by the Data Processing Agreement signed at engagement start.

3. What we collect, and why

3.1 You contact us

If you fill in the form on the contact page or email us, we collect your name, email, company, and the message itself. Legal basis under GDPR: legitimate interest (Art. 6(1)(f)) — replying to inbound business inquiries. Under PIPEDA, this is implied consent.

3.2 You subscribe to dispatches

If you subscribe to the monthly newsletter, we store your email and the date you subscribed. Legal basis: explicit consent (GDPR Art. 6(1)(a) and PIPEDA s. 6.1). You can unsubscribe in one click; we keep a single unsubscribe record so we don't contact you again by mistake.

3.3 You visit the website

We use Google Tag Manager and Google Analytics 4. Both honour Google Consent Mode v2 and only run after you click Accept on the cookie banner. If you decline, we collect nothing beyond what your browser sends in standard request headers (which we do not log persistently).

4. How long we keep it

• Inquiry form & email correspondence — three years from last contact, then deleted.
• Newsletter subscribers — until you unsubscribe, plus a thirty-day grace period.
• Analytics — fourteen months (the GA4 default we deliberately did not extend).
• Customer contract data — as long as the contract is active, plus seven years (Canada Revenue Agency record-keeping requirement under the Income Tax Act).

5. Who we share it with

We use a small, deliberately short list of vendors:

• Google Ireland Ltd. — analytics & tag management (data processed in the EU and US).
• Fastmail Pty Ltd — business email hosting (data processed in Australia and the US).
• Linear Orbit Inc. — CRM & project tracking (data processed in the US).
• Stripe Payments Canada Ltd. — invoice processing for Canadian customers (data processed in Canada and the US).

For transfers outside Canada and the EEA we rely on Standard Contractual Clauses (Commission Decision 2021/914) and, where applicable, supplementary measures.

6. Your rights

Under PIPEDA and GDPR you can ask us to: confirm what we hold about you; correct it; delete it; export it in a portable format; restrict processing; or object to processing. We respond within thirty days. If you are unhappy with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you are an EU resident, your national data protection authority.

7. Security

Data at rest is encrypted with AES-256. Backups live in two Canadian regions (Toronto and Montréal). Access to production systems is gated by hardware security keys and quarterly access reviews. We have not had a reportable breach since incorporation in 2021. We hope to keep it that way; if it changes we will notify affected individuals within seventy-two hours under GDPR Art. 33 and PIPEDA breach reporting requirements.

8. Children

The service is intended for businesses. We do not knowingly collect personal information from anyone under sixteen. If you believe we have, please write to privacy@nuvetralise.com and we will delete it.

9. Changes to this notice

We update this notice when our practices change, and at minimum once a year. The version number and "last updated" date at the top of the page are the source of truth.