Privacy policy

VeraForge Privacy Policy 1. Who we are and what this policy covers VeraForge Technologies Corp. ("VeraForge", "we", "us", "our") operates the VeraForge platform, which includes The Blueprint, The Anvil, and the infrastructure that serves the websites you publish through them. You operate your own published site, and section 12 explains where our accountability ends and yours begins. Our registered office is at 10 Four Seasons Place, Suite 1000, Etobicoke, Ontario, Canada. This Privacy Policy explains what personal information we handle, why we handle it, who we share it with, where it is processed, how long we keep it, and what rights you have. It forms part of our Terms of Service. We are governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and by Quebec's Law 25 where it applies to you. Where you are located outside Canada, we handle your personal information under this policy and under the law that applies to you. This policy covers two different relationships, and the difference matters. When you hold a VeraForge account, we handle your personal information and we are accountable for it. When a member of the public visits a website you published through the Platform, that visitor's information is yours to account for, not ours. Section 12 explains that division in full. 2. What we collect, and why Account information. Your name, email address, and password credential. We collect this to create and secure your account, to authenticate you, and to contact you about your account. Without it you cannot hold an account. Billing information. Your plan, your subscription status, your purchase history, and your billing country. We do not store your full payment card number. Card details are handled by our payment providers, described in section 5. We collect billing information to provide the service you have paid for and to keep the records that tax and business law require. Domain registrant information. Where you register a domain through the Platform, we collect the registrant name, the registrant email address, the postal address and telephone number the registry requires, the Canadian Presence Requirements legal type where the domain requires one, your WHOIS display preference where the registry offers one, and your billing country. We collect this because a registry cannot register a domain without it, and because a registry may suspend or cancel a registration for inaccurate registrant data. Registry acceptance records. When you accept a registry agreement, we record which agreement you accepted, its version, and the time of acceptance. This is the evidence that consent was given, and it is required by the registry. Legal acceptance records. When you accept our Terms of Service and Acceptable Use Policy, we record your account identifier, the version of each document, the time of acceptance, and a cryptographic hash of the exact text you were shown. The hash exists so that the record proves which words you agreed to rather than merely which version number was in force. Your content. Anything you enter, upload, or generate in the Platform, including business facts, text, images, video, and site configuration. Some of this may be personal information about you or about other people, depending on what you choose to put in it. We handle it to provide the service and to publish your site. Support correspondence. Messages you send to our support, sales, privacy, or legal addresses, and our replies. Technical and security information. Internet protocol addresses, browser and device information, timestamps, and records of requests made to the Platform. We collect this to keep the service secure, to detect and investigate abuse, to enforce rate limits, and to diagnose faults. We do not collect sensitive categories of personal information deliberately, and we ask that you do not enter health information, government identifiers, financial account numbers, or information about a person's race, religion, sexual orientation, or political views into the Platform. 3. How we use personal information, and our lawful basis We use personal information to operate and secure the Platform, to publish and serve your sites, to register and manage domains you buy, to take payment, to provide support, to send the service messages described in section 4, to meet legal and regulatory obligations, and to detect, investigate, and prevent abuse. Under PIPEDA we rely on your consent. For most of what we do, that consent is implied by your use of the service for the purpose it obviously serves: you cannot publish a site without us storing the site. Where a use is not obvious from the service itself, we ask for express consent. We do not sell personal information, and we do not disclose it for another organisation's marketing. We do not use the contents of your sites to train artificial intelligence models offered to other customers. We use aggregated and de-identified information about how the Platform is used to operate, secure, and improve it. We do not make decisions about you by automated means that produce a legal or similarly significant effect. 4. Communications Service messages. We send messages necessary to operate your account, including billing notices, security alerts, domain expiry notices, and replies to your requests. You cannot opt out of these while you hold an account, because they carry information you need. Commercial messages. We send a commercial electronic message only where we have your consent or where Canada's Anti-Spam Legislation otherwise permits it. Every commercial message identifies us, gives our contact information, and includes an unsubscribe mechanism that we honour within ten business days. You may withdraw consent at any time using that mechanism or by writing to privacy@veraforge.ca. Transactional mail is sent through a third party. Our transactional email is delivered by Resend, sending from a subdomain we control. Delivery information, including the recipient address and delivery status, is processed by that provider. 5. Service providers, and what each one receives We use the following providers. Each receives only what it needs for its function. Lovable Cloud and Supabase host the Platform and its database. All account information, your content, and platform records are stored on this infrastructure. Polar Software Inc. is the merchant of record for subscriptions and credits. Polar receives your payment details, your billing country, and the transaction information required to sell to you and to remit tax. Polar is the seller of record for those transactions and handles them under its own privacy policy. Stripe, Inc. is the merchant of record for domain purchases. Stripe receives your payment details, your billing country, and the transaction information required to sell to you and to remit tax. Stripe is the seller of record for those transactions and handles them under its own privacy policy. OpenSRS, an accredited domain registrar, receives registrant information for any domain you register through the Platform and transmits it to the relevant registry. Registry operators, including the Canadian Internet Registration Authority for .ca domains, receive registrant information as the registration requires and hold it under their own rules. Resend delivers our transactional email and receives the recipient address and message content of those messages. HeyGen Inc. processes video generation. Section 7 describes this in full because it warrants its own section. Approximated provides the infrastructure that serves custom domains, and receives the hostname of a request. Cloudflare provides domain name service and network protection, and processes request metadata including internet protocol addresses. Google LLC provides the address suggestions in the Blueprint's location field. When you type in that field, the characters you type are sent from our servers to Google's Places service so that it can suggest matching places. Google receives what you type and a session identifier, and it does not receive your name, your email address, or your account details. We may also disclose personal information where the law requires it, in response to a lawful order or a valid request from a registry, registrar, regulator, or court, to establish or defend a legal claim, or to protect the rights and safety of people or of the Platform. If our business is sold or merged, personal information may transfer as part of it, and this policy continues to apply until it is replaced by a policy that is not less protective. 6. Where personal information is processed Personal information is processed in Canada and in the United States, and may be processed elsewhere where a provider operates. Information processed outside Canada is subject to the laws of the jurisdiction where it is processed, including lawful access by courts, law enforcement, and national security authorities in that jurisdiction. We use contractual protections with our providers requiring them to protect personal information to a standard comparable to ours and to use it only for the purpose we engaged them for. 7. Video generation, and the HeyGen relationship Video generation is not yet available. This section describes what will happen when it is released, so that you can read it before you decide to use it. The Platform includes a video generation feature. This section describes it in detail because it is the one feature that may process a person's likeness or voice. What is transmitted. When you generate a video, we transmit to HeyGen the script you supply, the presenter or avatar you select, and any image, audio, or other asset you provide for the purpose. If you supply the likeness or voice of a real person, including your own, that likeness or voice is transmitted. Where it is processed. HeyGen processes these inputs on servers outside Canada, including in the United States, under the transfer terms in section 6. Our role and theirs. VeraForge is the controller of this information and HeyGen acts as our processor. We hold the account through which the generation request is made, and HeyGen does not receive your identity as a separate customer of theirs. We minimise what stays with the processor. When a video finishes rendering, we download it and then delete the video and its input assets from HeyGen's systems. HeyGen removes deleted data from its active systems promptly and purges it from its disaster recovery backups within sixty days. We do this deliberately rather than leaving generated video in the provider's storage. What we keep, and for how long. We store the downloaded video in our own storage for as long as the site it belongs to exists, because a video embedded in a published site must keep working. We keep the current video for a section and the immediately previous one so that an undo is possible, and we discard older takes. When a site or an account is deleted, the videos belonging to it are deleted within thirty days. Screening. We may inspect and refuse a script or asset before transmitting it, both to meet the provider's content rules and to enforce our Acceptable Use Policy. Your obligation. You must have the right to supply everything you submit, and you must not submit the likeness, voice, name, or other personal attributes of any person without that person's consent. 8. Domain registration, and the public record Registering a domain makes you the registrant, and registrant information travels to the registrar and to the registry. Some of it becomes public. Registry rules determine what appears in a public directory such as WHOIS. Where the registry offers a display preference, we record and transmit yours. Where it does not, the registry's default applies. We cannot suppress a disclosure a registry requires. For .ca domains, the Canadian Internet Registration Authority requires every registrant to meet its Canadian Presence Requirements. You select the legal type that applies to you and confirm it is accurate, and CIRA may verify eligibility. CIRA holds registrant information under its own privacy policy and its own rules. Accuracy is your obligation and a registry may suspend or cancel a registration for inaccurate registrant data. Tell us at support@veraforge.ca if your registrant details change. 9. Published sites, and the pages we serve Pages we serve for a published site contain no client side JavaScript authored by VeraForge. We do not place an analytics script, an advertising script, or a tracking script on those pages. We do not set cookies on them for our own purposes. This is a property of how we render and serve them, not a setting. Embedded features are the exception, and you control them. If you add an embedded feature to your site, such as a scheduling widget, a map, a store, or a media player, that embed is loaded from the third party you chose. It runs in its own frame under that third party's control, it may set cookies or collect information from your visitors, and it is governed by that third party's privacy policy rather than ours. Our statement about client side scripts describes the pages we serve, not the contents of a frame you chose to embed. If you add an embed, any disclosure or consent your visitors are owed is yours to provide. Hosting records. Serving a published site produces the ordinary technical records described in section 2, including internet protocol addresses and request timestamps. We use these for security, abuse prevention, and diagnostics. 10. Cookies and similar technologies On the Platform, meaning the application you sign in to, we use cookies and equivalent browser storage that are strictly necessary to keep you signed in, to keep your session secure, and to remember interface preferences. We do not use advertising cookies and we do not use third party analytics cookies on the Platform. On published sites, we set no cookies of our own. Cookies a visitor encounters on a published site come from an embed the site operator chose. 11. Security We protect personal information with access controls, encryption in transit, row level security in the database so that one account cannot read another's records, server side authorisation on every write, and restricted handling of credentials. Secrets are held in a managed vault and are never exposed to a browser. No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will report it to the Privacy Commissioner of Canada and notify affected individuals as PIPEDA requires, and we will keep the records of breaches that PIPEDA requires us to keep. 12. Your site visitors, and where our accountability ends If your published site collects personal information from a visitor, through a contact form, a booking, an embedded store, or otherwise, you are accountable for that information and we are not. You determine why it is collected and what happens to it. We process it on your behalf as part of hosting your site. That means you must have a privacy notice appropriate to what you collect, you must handle access and correction requests from your own visitors, you must obtain any consent required before sending them a message, and you must comply with the privacy law that applies to you. We can tell you what we hold on your behalf; we cannot answer your visitor's request for you. Form submissions we hold on your behalf are retained for one hundred and eighty days, after which a scheduled job deletes them automatically. Export anything you need to keep before that point. 13. How long we keep personal information We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires. Transaction and payment records: seven years, because tax and business record requirements apply. Domain registrant records and registry acceptance records: the life of the registration plus seven years, because the registration must be provable for its whole life and the record supports it afterwards. Legal acceptance records: the life of the account plus seven years, as evidence of what you agreed to and when. Account records after closure: two years, because two years is the general limitation period in Ontario. Your content and published sites: while your account is active, because we need it to provide the service. Your content after account closure: thirty days, then deleted. That period is the export window described in our Terms of Service. Generated video: the life of the site, then deleted within thirty days after the site or the account is deleted, because a video embedded in a published site must keep working while the site exists. Site version snapshots: the most recent fifty per site, which is enough to undo without keeping everything forever. Form submissions held for a site operator: one hundred and eighty days, which is long enough to act on a lead and short enough not to accumulate. Security and access logs: twelve months, which is long enough to investigate an incident. Backups: ninety days, for disaster recovery, then rotation. Where a retention period has passed but the law requires us to keep something longer, such as during a legal hold, we keep only what is required and for only as long as it is required. 14. Your rights Access. You may ask what personal information we hold about you and receive an account of how it has been used and to whom it has been disclosed. Correction. You may ask us to correct information that is inaccurate or incomplete. Withdrawal of consent. You may withdraw consent to a use that is not necessary to provide the service. Withdrawing consent to something the service requires means we can no longer provide that part of the service. Deletion. You may ask us to delete your account and the personal information in it. We will do so subject to what section 13 requires us to keep, and we will tell you what is retained and why. Portability. You may request an export of your content in a commonly used machine readable format. How to exercise these rights. Write to privacy@veraforge.ca or to VeraForge Technologies Corp., 10 Four Seasons Place, Suite 1000, Etobicoke, Ontario. We will respond within thirty days. We may ask you to verify your identity before we act, so that we do not disclose your information to someone else. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, and, if you are in Quebec, to the Commission d'acces a l'information du Quebec. 15. Quebec, and Law 25 Where Quebec's Law 25 applies to you, the following also apply. We have designated a person responsible for the protection of personal information, reachable at privacy@veraforge.ca. We conduct a privacy impact assessment before transferring personal information outside Quebec where the law requires one, and section 6 states plainly that processing occurs outside Canada. You have the right to the portability of your computerised personal information in a structured, commonly used technological format, and the right to be informed of the use of technology that identifies, locates, or profiles you. We do not use such technology on published sites, and on the Platform we use only what section 10 describes. 16. Children The Platform is not directed at children and we do not knowingly collect personal information from a person under the age of majority in their jurisdiction. If you believe a child has given us personal information, write to privacy@veraforge.ca and we will delete it. 17. Changes to this policy We may change this policy. If a change is material, we will give notice at least thirty days before it takes effect, by email to the address on your account or by a prominent notice in the Platform, and the new version will state its effective date. Continuing to use the Platform after that date means you accept the revised policy. 18. Contact VeraForge Technologies Corp., 10 Four Seasons Place, Suite 1000, Etobicoke, Ontario, Canada. Privacy questions, access and correction requests: privacy@veraforge.ca. General support: support@veraforge.ca. Legal: legal@veraforge.ca. Telephone: (437) 830-4226.