Privacy policy

What I collect

• Estimate requests: your name, email, and optionally your business name, phone number, business address, project description, timeline and budget, plus the options you picked.
• Contact messages: your name, email, subject and message.
• Client portal accounts: your email, name, a securely hashed password, and the projects, messages, files and invoices we share there.
• Newsletter: your email and, if you give it, your name.
• Technical data: a one-way hash of your IP address (to stop spam and abuse), and, only if you allow analytics cookies, anonymous usage statistics (see the cookie policy).

Why I use it

• To prepare your estimate and quote, and reply to you.
• To set up and run your client portal, deliver your project, and send invoices.
• To send the newsletter you signed up for (unsubscribe any time from any email).
• To keep the site secure and working, and to meet legal and tax record-keeping duties.

By submitting a form you consent to these uses. I don't use your information for anything else without asking.

Who processes it for me

I use a small number of trusted services to run the site. They process data only on my instructions:

• Supabase: database, client portal sign-in and file storage (servers in the United States).
• Turso: database for blog posts, messages and newsletter sign-ups (United States).
• Vercel: website hosting (global network).
• Resend: sending emails (United States).
• Google: Maps address autocomplete on the estimate form, and Tag Manager/Analytics if you accept cookies.

Some of these services store data outside Canada, so it may be subject to the laws of those countries. Each provider is contractually required to protect it.

How long I keep it

• Estimate requests and messages that don't lead to a project: up to 2 years, then deleted.
• Client project records and invoices: 6 years after the work ends, as Canadian tax law requires.
• Newsletter: until you unsubscribe.

How I protect it

Everything travels over HTTPS. Databases enforce row-level security so each client can only ever see their own data, passwords are never stored in plain text, admin access requires two-factor authentication, and every admin change is recorded in an audit log that can't be edited.

Your rights

You can ask to see the personal information I hold about you, correct it, or have it deleted (except records I must keep by law), and you can withdraw consent at any time. If you're in the EU or UK, you also have the rights given by the GDPR. Email raaghvv0508@gmail.com and I'll respond within 30 days. If you're not satisfied, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Children

This site isn't aimed at children under 16, and I don't knowingly collect their information.

Changes

If I change this policy, I'll update the date at the top. Significant changes affecting clients will be emailed.

Contact

Raghav Mahajan · Edmonton, Alberta, Canada · raaghvv0508@gmail.com