Privacy Policy
What personal data we collect through this website, why, who helps us handle it, how long we keep it and what rights you have.
Last updated: [TODO-CONFIRM: date of the lawyer-approved version]
Who is responsible
The controller of your personal data is Adactaengineering Ltd, trading as Canvaz X.
- Company number: [TODO-CONFIRM: company registration number]
- Registered office: [TODO-CONFIRM: registered office address]
- Country: [TODO-CONFIRM: country of registration / governing law]
- Privacy contact: hello@canvazx.com
- Data protection officer: [TODO-CONFIRM: Data Protection Officer or privacy contact, if one is required]
What we collect and why
Contact form. The details you type (for example your name, email address, company, the services you are interested in and your message) and a spam-check result. We use them to reply to your enquiry and to prepare a proposal. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering business enquiries.
AI assistant. Where the assistant is available, the messages you type are sent to our AI provider to produce a reply. When you open the assistant, a Cloudflare Turnstile spam check loads and receives your IP address and browser details; the result is verified with your first message. Please do not enter sensitive personal data. Legal basis: our legitimate interest in helping visitors and answering questions.
Server logs. Our hosting provider records technical request data such as your IP address to deliver the site and keep it secure. Legal basis: legitimate interest in security and reliability.
Visit statistics. We use a cookieless analytics service that counts visits without cookies or a stored identifier. We record events such as which button was clicked, never the content of forms or messages.
Embedded media. Videos from YouTube (Google) load only after you choose to load them. See the Cookie Policy.
We do not sell personal data and we do not use it for advertising.
Who else handles your data
These companies process data on our behalf or, in the case of YouTube/Google, receive it when you load their content.
| Provider | What it does | Data | Location and safeguards |
|---|---|---|---|
| Resend | Sends the emails produced by the contact form to us. | The details you type into the contact form. | [TODO-CONFIRM: Resend hosting region and transfer safeguard] |
| Cloudflare | Spam protection (Turnstile) on the contact form and on the website assistant, and, if used, DNS and network security. | Your IP address, browser details and a challenge result. For the assistant, the challenge loads and receives these when you open the assistant panel, and the result is verified with your first message. | [TODO-CONFIRM: Cloudflare transfer safeguard] |
| Anthropic | Provides the AI model behind the website assistant, where it is enabled. | The messages you type into the assistant. | [TODO-CONFIRM: Anthropic transfer safeguard and whether the assistant is live] |
| Vercel (hosting) | Hosts the website and delivers its pages. | Your IP address and request details, in server logs. | [TODO-CONFIRM: hosting provider, region and transfer safeguard] |
| Plausible (analytics) | Cookieless, aggregate visit statistics, when switched on. | Page, referrer, country, browser and device type. No cookies, no stored identifier, no cross-site tracking. | [TODO-CONFIRM: Plausible hosting (EU or self-hosted) once configured] |
| YouTube / Google | Plays embedded case-study videos (youtube-nocookie.com), only after you click to load them or allow embedded media. | Your IP address and device details, and any cookies Google sets once the video loads. | [TODO-CONFIRM: Google transfer safeguard] |
Where a provider is outside the European Economic Area or the UK, the transfer relies on a safeguard such as an adequacy decision or standard contractual clauses.
How long we keep it
| Data | Kept for |
|---|---|
| Contact enquiries (form and email) | [TODO-CONFIRM: retention period, e.g. months after the last contact] |
| Assistant conversations | [TODO-CONFIRM: retention period, or confirm they are not stored] |
| Hosting and security logs | [TODO-CONFIRM: log retention period] |
| Cookie consent record | 12 months in your browser, then we ask again. |
We delete or anonymise data once it is no longer needed for the purpose above or a legal duty to keep it.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing.
To use a right, email hello@canvazx.com. You can also complain to your supervisory authority: [TODO-CONFIRM: competent supervisory authority].
Changes
We will update this page when our practices change and show the date at the top.