Privacy, explained clearly.

01 Scope and operator

Nuveso Inc., an Ontario-incorporated business, is responsible for personal information collected through Nuveso.ca and related inquiry and privacy correspondence. Our business correspondence address is 6 Greyabbey Trail, Scarborough, ON M1E 1V7, Canada. Contact privacy@nuveso.ca about privacy.

This policy covers the website. Handling of MSP customers’ systems or end-customer information under a service engagement is governed separately by the applicable agreement and instructions. This website is intended for business contacts, not children.

02 Information we receive

The inquiry form asks for your name, work email, company, organization type, service interest and a high-level description of your requirements. A phone number is optional. We receive the correspondence you choose to send and the information needed to reply.

Website and security services also process technical information, including IP address, browser/device signals, requested URLs, timing and security-verification results. Our rate limiter stores a keyed, one-way IP-derived identifier and short-lived counters, not inquiry text or plain IP addresses. A temporary submission identifier helps prevent duplicate delivery when you retry.

Do not send passwords, credentials, confidential end-customer data, production logs or other sensitive operational records in general business inquiries. If an engagement requires sensitive exchanges, we will agree on a suitable channel separately.

03 How information is used

We use inquiry information to understand your request, respond, assess the fit of our services and continue the business discussion you requested. Necessary technical information helps deliver the website, verify submissions, limit abuse and investigate faults or security incidents.

Submitting an inquiry asks us to use the information for these purposes and the provider processing below. Providing a phone number is optional. You may choose not to submit or contact us by email instead; email still involves our business-email providers. We do not sell inquiry information, enroll senders in marketing or use inquiry details to make automated service-eligibility decisions.

We may disclose information when legally required, to protect legitimate rights or safety, or to professional advisers where necessary and subject to appropriate confidentiality.

04 Providers and processing locations

Nuveso’s founder currently manages business inquiries and privacy correspondence and accesses this information from both Canada and India. Access is not Canada-only. Providers and subprocessors also process information internationally, including in the United States. Information processed outside Canada may be subject to the laws and lawful-access requirements of those countries.

Vercel hosts the website and processes web requests and the Contact endpoint, including request/security metadata and submitted fields during delivery. See Vercel’s privacy information.

Resend delivers inquiry notifications from send.nuveso.ca to contact@nuveso.ca. It processes message fields, addresses and delivery records. Sending is configured in US East; stored message and log data is in the United States. Open and click tracking are disabled. See Resend’s processing and retention information.

Microsoft 365, supplied through GoDaddy, receives and stores business correspondence, including contact@, sales@ and privacy@ messages. Microsoft and service providers may process email internationally; we do not make a Canada-only mailbox-residency guarantee. See Microsoft’s Privacy Statement and GoDaddy’s Privacy Policy.

Cloudflare Turnstile checks for automated abuse on Contact. Cloudflare processes signals including IP address, TLS fingerprint, browser User-Agent and site origin to detect bots and improve detection. We do not send form-field content to Turnstile. See the Turnstile Privacy Addendum.

Upstash provides managed Redis rate limiting in AWS US East. We send keyed IP-derived identifiers and counters, not inquiry bodies or plain IP addresses. See Upstash’s Privacy Policy.

Access is limited to personnel authorized for the relevant responsibility. Changes to staff access, purposes or providers require a review of our safeguards and this notice.

05 Cookies and analytics

The website does not load advertising pixels, marketing trackers or website analytics. We do not persist inquiry drafts in browser storage. Turnstile loads on Contact for security; hosting, security and protected-deployment authentication services may use necessary technical storage or cookies. These services are separate from advertising tracking.

Turnstile is configured without pre-clearance. Cloudflare describes security signals and cookie practices in its linked addendum. Restricting scripts or storage can prevent verification and form submission.

We will assess notice and consent requirements before introducing optional analytics or other tracking.

06 Retention and safeguards

We retain correspondence for as long as reasonably needed to respond, manage the business discussion or relationship, resolve outstanding matters and meet applicable legal or preservation requirements. Information no longer needed for those purposes may be deleted or anonymized, subject to those requirements and the deletion/recovery mechanisms available from our providers. You can contact privacy@nuveso.ca about access, correction or deletion. We do not promise automatic deletion after a fixed period.

Deleting active correspondence does not promise immediate deletion from recoverable items, provider backups or records that must be preserved. Resend’s published Free-plan retention is 30 days for email/log data, with backups persisting for 7 days. Application rate-limit keys expire after 10 minutes. Hosting, email and security providers maintain operational records under their policies; recoverable copies and lawful holds may persist after active records are removed.

We restrict authorized access, keep application credentials server-side and use HTTPS. The online inquiry endpoint validates input on the server, verifies Turnstile tokens and applies a managed distributed rate limit. We do not intentionally log inquiry bodies, raw IP addresses, challenge tokens or provider credentials in application logs. Safeguards reduce risk but cannot guarantee that transmission or storage will never be compromised.

07 Privacy requests

Email privacy@nuveso.ca to ask about processing, request access or correction, withdraw consent where applicable, or request deletion. You can also write to our business address. We may verify identity proportionately before disclosing or changing information; do not email identity documents unless we agree on an appropriate method.

We respond within the time required by applicable law—generally 30 calendar days for access requests under PIPEDA, subject to lawful extensions with required notice. Rights can be limited by law, another person’s privacy or preservation obligations. If we cannot fulfill a request, we will explain the applicable reason and available recourse. Withdrawing information needed for a requested service may limit our ability to continue that discussion.

Please raise concerns with us first. You may also contact the Office of the Privacy Commissioner of Canada.

08 Marketing messages

Submitting an inquiry does not subscribe you to promotional emails. We use your address to respond to the requested discussion. If we introduce marketing messages, we will assess an appropriate consent basis and provide identification and unsubscribe mechanisms required by Canada’s Anti-Spam Legislation.

09 Updates and contact

We will update this policy when actual practices change and show its effective date above. Material changes will receive appropriate notice and, where required, renewed consent before information is used for a new purpose.

Privacy: privacy@nuveso.ca
Business inquiries: contact@nuveso.ca
Nuveso Inc., 6 Greyabbey Trail, Scarborough, ON M1E 1V7, Canada.