Privacy Policy

1. About this policy

1.1 Who we are

service.tnaado.ca is published by TNAADO Inc., a corporation organized under the laws of Ontario, Canada, at 1050 King Street West, Toronto, Ontario, Canada M6K 0C7 ("TNAADO", "we", "us"). This policy covers service.tnaado.ca only. It was last updated on 26 October 2026. Our newsroom and consumer apps are separate and are covered by the policy published at tnaado.ca/privacy.

1.2 Privacy contact

Privacy Officer, TNAADO Inc., 1050 King Street West, Toronto, Ontario, Canada M6K 0C7. Email: contact@tnaado.ca.

1.3 Governing law

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, and we describe rights under US state laws below.

2. Summary

• The booking form and the assistant collect what you type. Nothing on the site takes a payment, and there are no accounts or logins.
• Each visit produces a pageview record in our own database, and Google Analytics and Google Ads measurement also run.
• The site shows no advertising and does not sell personal information.
• You can ask to see, correct or delete what we hold at contact@tnaado.ca.
• We disclose information to authorities only as the law requires or in narrow emergencies, and we can only produce what we hold. See Legal requests and disclosures.

3. Information we collect

3.1 What you tell us

The booking form stores your name, email address, and optionally your company, phone number and message, together with the service you selected, the time slot you chose and the time zone your browser reports. If you email or call us, we keep that correspondence as any business keeps its mail. Please do not send sensitive personal information through the site.

3.2 The on-site assistant

The home page offers an assistant that answers questions about the firm. What you type into it is sent to a server function that we operate on Supabase, which generates the reply. As written in our code, the function also saves each exchange (your message, the reply and a random session identifier) in our database, and creates an enquiry record if you give it your email address. Do not enter confidential or sensitive information; email or call us instead.

3.3 Collected automatically

Each visit produces a pageview record sent by a script on the site to a TNAADO endpoint (site.tnaado.ca/api/collect): the page path, the referring address, your browser's user-agent string, the device type, how long the page was visible, and any campaign parameters in the address (such as utm values or a Google Ads click identifier). Our server adds your IP address and an approximate location derived from it. Requests that our script identifies as bots are not recorded. If you arrive from an advertisement and then book, the campaign values are attached to the booking so we can tell which advertisement produced an enquiry.

3.4 Google and Cloudflare measurement

The site uses Google Analytics 4 (measurement ID G-Y561C98Y8Q) and a Google Ads conversion tag (ID AW-17175265494). Google receives page views and interactions, browser and device details, and an approximate location derived from your IP address, and sets cookies. Google states that Google Analytics 4 does not log or store IP addresses. The Google Ads tag lets an advertisement be credited with the enquiry it produced. We do not send names, email addresses or phone numbers to Google Analytics or Google Ads. Cloudflare, which sits in front of the site, may also load its own web analytics script. See Cookies and measurement.

3.5 Fonts and code libraries

Your browser requests fonts directly from Google Fonts and one JavaScript library from the jsDelivr public code network, so those providers see your IP address and browser details with the request.

4. Cookies and browser storage

We set first-party cookies and use browser storage as described in Cookies and measurement. You can block or clear them in your browser settings; the site and the booking form still work.

5. How we use information

We use information to respond to enquiries and book calls and visits, to run and secure the site, to measure which pages and campaigns lead to enquiries, and to meet legal obligations. We do not sell or rent personal information and we do not add you to a mailing list: booking a call subscribes you to nothing. We do not send marketing email from this site.

6. Who receives information

• Vercel hosts and serves the site.
• Cloudflare provides DNS and content delivery in front of the site, and Turnstile, a security check on the booking form. Turnstile receives a token and the IP address of the request to verify it.
• Supabase hosts the database and server functions behind the booking form and the assistant.
• Google provides Analytics, Ads conversion measurement, Calendar and Meet (a booking creates a Google Calendar event with you as an attendee, and Google emails you the invitation), and Fonts.
• jsDelivr serves a public code library.

Your enquiry is also passed to TNAADO's own client-enquiry system so that a person sees it. Beyond these providers, we disclose personal information only as described in Legal requests and disclosures below, or in connection with a merger or transfer of the business.

7. Spam and abuse controls

The booking form is protected by Cloudflare Turnstile and by a rate limit. The rate limit records the IP address of a booking request for the length of the limiting window.

8. Legal requests and disclosures

8.1 In short

We disclose information to authorities when the law requires it, we disclose without a court order only in the narrow emergencies below, and we can only produce what we actually hold. We do not promise that we will never disclose information. The separate Legal requests and disclosures document sets out the process and how to send us a request.

8.2 When the law requires us to disclose

We comply with valid legal process, for example a court order, search warrant, production order or subpoena from a court or authority with jurisdiction over us, and with a lawful demand or order to preserve data. Some statutes require reports without any request. In Canada, the Act respecting the mandatory reporting of Internet child sexual abuse and exploitation material requires a person who provides an Internet service to the public to report, and to notify police, when it has reasonable grounds to believe its service is being used to commit such an offence. In the United States, 18 U.S.C. 2258A requires providers to report apparent child sexual exploitation to the National Center for Missing and Exploited Children once they have actual knowledge. We say "to the extent the law applies to us" because no lawyer has told us whether this site is a provider under those statutes. Neither statute requires us to search for such material, and we do not. Canada's privacy law (PIPEDA, s. 7(3)) also lists situations where an organization may disclose personal information without consent, including to comply with a subpoena, warrant or court order. Requests may also arrive through mutual legal assistance treaties between Canada and the United States. Because our hosting and delivery providers are United States companies, United States legal process can reach data they hold even though TNAADO is an Ontario company, and Canadian process can reach data we hold.

8.3 When we may disclose without a court order

We may disclose limited information without a court order only where we reasonably believe, in good faith, that (a) there is an imminent risk of death or serious physical harm to a person and disclosure could help prevent it, (b) child sexual abuse or exploitation material is involved and the law requires or permits a report, or (c) disclosure of the minimum necessary is needed to detect or stop fraud or abuse aimed at our systems or to protect our legal rights, and then only to a party with a real need. We do not volunteer information about lawful activity to authorities, and we do not treat an informal request, email or letter from police as enough, on its own, to hand over personal information outside those cases.

8.4 What we do first

When we receive a request we (a) check that it is genuine and comes from an authority with jurisdiction; (b) read what it actually requires, and ask the authority to narrow it if it is too broad, vague or unrelated to what we hold; (c) tell the person affected before disclosing, where the law allows and where we can reach them (for most visitors we hold no contact details); (d) where we believe an order is unlawful, overbroad or would reveal protected information, ask the court or authority to vary or cancel it within the time the law allows (a Canadian production order, for example, gives a short window to give notice that we will apply); (e) disclose only what is required; and (f) keep a record of the request and of what we gave and when.

8.5 What we can produce

• Booking-form records: your name and email address, and optionally your company, phone number and message, with the service you selected, the time slot you chose, your time zone and any campaign values from the address you arrived through. They are stored in a database we control, and a person at TNAADO is notified of each one.
• On-site assistant exchanges: as written in our code, the assistant's server function saves each exchange (your message, the reply and a random session identifier) in our database, and creates an enquiry record if you give it your email address. We have read this in the code; we have not checked the live database or how long rows are kept.
• Page-view records: one per visit, sent to site.tnaado.ca (page, referrer, user-agent string, device type, visible time, campaign values). The receiving server adds your IP address and an approximate location.
• Rate-limit records: the IP address of a booking request, for the length of the limiting window.
• Email and calls: correspondence with us is held in our email system, and a booking creates a Google Calendar event with you as an attendee.
• Held by others, not by us: Request logs at Vercel and Cloudflare. Supabase hosts the database and server functions behind the booking form and the assistant. Cloudflare Turnstile, Google (Analytics, Ads measurement, Calendar, Meet, Fonts) and jsDelivr each hold what they receive, under their own policies. Vercel hosts the site and Cloudflare sits in front of it as a proxy and cache, so both see visitors' requests, including IP addresses. Those providers may receive legal process directly, and their policies, not ours, govern what they do.

8.6 Material you generate with this site

Everything you enter into the booking form or the assistant is sent to us and stored, so it can be produced. A quote or engagement agreement, and the work we make for you, are governed by the Client Service Terms, whose confidentiality clause covers your non-public information; if the law compels us to disclose it we will, where the law allows, tell you first and disclose only what is required. Material that never reaches us cannot be produced by us, but your device and the other services you use may be subject to their own legal process.

8.7 What we do not promise

We do not promise that we will never disclose information to authorities. A court may order us not to tell you that we received a request or what it asked for, in which case we cannot notify you. Deleting something on our side does not guarantee it is gone from backups, caches, provider logs or a copy already preserved under a legal order.

9. Where information is processed

The booking database and the functions behind the form and the assistant are hosted by Supabase in the United States (AWS US East region). Our other providers operate internationally. Your information may therefore be processed in the United States and elsewhere outside Canada, where privacy laws may differ.

10. Retention

We keep enquiries and bookings while the conversation or engagement is live, and afterwards only as long as needed for our legal, tax and accounting obligations. Pageview records are used for reporting. Rate-limit records are kept only for the limiting window. Google Analytics keeps event data for the period set in our property (Google offers 2 months or 14 months). You can ask us to delete your enquiry at any time, subject to anything we are required to keep.

11. Your rights

11.1 Canada

You may ask for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, withdraw consent where we rely on it, and challenge our compliance. You may complain to the Office of the Privacy Commissioner of Canada.

11.2 United States

Depending on the state where you live, you may have rights to know or access, delete and correct personal information, and to opt out of targeted advertising or the sale or sharing of personal information. We do not sell personal information. We include this section so that visitors in any state know how to reach us, whether or not a particular state's law applies to us. We do not discriminate against anyone for making a request.

11.3 How to make a request

Email contact@tnaado.ca and say what you want. We may ask you to confirm the request is yours, and we will respond within the time required by the law that applies. If you disagree with how we handled it, tell us and we will review it.

12. Browser signals and email

Do Not Track: there is no agreed standard for responding to "do not track" browser signals, and we do not respond to them. We also do not read Global Privacy Control or similar signals ourselves. Google Analytics, if you allow it, may collect information about your online activities over time and across other websites, and whether it responds to such signals is for Google. Email: we send no marketing email and no commercial electronic messages from this site, and we have no mailing list. If that changes we will ask for your consent first and include an unsubscribe route, as Canada's anti-spam law (CASL) and the United States CAN-SPAM Act require.

13. Children

This site is for businesses and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has given us information, contact contact@tnaado.ca and we will delete it.

14. Security

The site is delivered over HTTPS. We use reasonable administrative and technical safeguards. No transmission over the internet or storage is perfectly secure; do not send documents you would not want intercepted.

15. Changes

We will post changes on this page and update the date at the top.