Privacy policy.

S.01 Scope

This policy explains how TNAADO Inc. (“TNAADO”, “we”, “us”) collects and handles personal information through service.tnaado.ca. TNAADO Inc. is a Canadian company at 1050 King Street West, Toronto, and this site is governed by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy statutes, and equivalent regimes where they apply to you.

It covers this site only. Our media property, our newsroom and our consumer apps are separate systems with separate databases, and they are covered by the universal policy at tnaado.ca/privacy.

S.02 What you tell us

The only form on this site that collects anything about you is the booking form. When you use it we store what you type: your name, email address, and optionally your company, phone number and message, together with which service you selected, the half-hour slot you chose, and the time zone your browser reports so the confirmation shows you the right clock time.

Nothing on this site asks for sensitive personal information, and nothing on it takes a payment. If you email or call us instead, we keep that correspondence in the ordinary way any business keeps its mail.

S.03 What is collected automatically

Every visit produces one pageview record: the path you looked at, the referring address if there was one, your browser’s user-agent string, whether the device is a phone, tablet or desktop, and how many seconds the page was actually visible. Your IP address and a coarse location derived from it are added by our server, not by your browser.

If you arrive from an advertisement or a campaign link, the campaign parameters in that address are recorded with the visit: the utm_ values, and whichever click identifier the advertising platform attached: Google Ads (gclid, gbraid, wbraid), Microsoft Ads (msclkid) or Facebook (fbclid). If you then book, those values are attached to the booking, so we can tell which advertisement produced an enquiry.

S.04 Cookies and local storage

We set one cookie of our own. tn_vid holds a randomly generated identifier, lasts one year, and is first-party and SameSite=Lax: it lets us see that two pageviews came from the same browser without knowing who you are, and it is not readable by any other website. Where campaign values are held for later, they are held in a second first-party cookie, tn_attr. Neither is an advertising cookie and neither follows you off this site.

Google Analytics sets its own cookies, described in S.05. The booking form also keeps the list of free slots in your browser’s sessionStorage for 45 seconds so that changing service does not re-request it; that cache holds no personal information and is gone when you close the tab.

You can clear or block all of the above in your browser settings. If you block them the site still works; the booking form still books.

S.05 Analytics

These are separate systems.

• Google Analytics 4, property G-Y561C98Y8Q. Google receives the pageview and sets its own cookies. It is used for aggregate reporting: which pages get read, which campaigns bring people in. The same tag also reports to our Google Ads account, conversion ID AW-17175265494, so an advertisement can be credited with the enquiry it produced. Google’s own handling is described in their privacy policy, and you can opt out with their browser add-on.
• Our own pageview record. One request per visit to site.tnaado.ca/api/collect, a TNAADO endpoint, which writes the fields listed in S.03 into our own database. It runs on our infrastructure and the row is not shared with anyone.

Requests our own system identifies as coming from a bot or crawler are discarded rather than recorded.

S.06 Booking a call or a visit

The booking form is served by Supabase, which hosts our database and the two functions behind it: one that lists free slots, one that books one. Booking writes a row holding the fields in S.02, the slot, its status, and the page you booked from.

Booking also creates a real event in a Google Calendar belonging to the person you are meeting, with you added as an attendee. That is how the invitation reaches you: Google emails it to the address you gave. A call receives a Google Meet link in that invitation; a booked visit to the office receives the street address and no video link. Cancelling or removing yourself from the event is done from the invitation in your own calendar, and you can ask us to delete the booking outright.

Your enquiry is also forwarded once to TNAADO’s own client-enquiry system at site.tnaado.ca, so that a real person sees it rather than only a calendar entry. That system is ours, it is not a third-party CRM, and the enquiry is not sent to our billing systems.

S.07 Spam and abuse controls

The booking form is protected by Cloudflare Turnstile. Turnstile runs a challenge in your browser and issues a token; we send that token and the IP address the request came from to Cloudflare to be verified. Cloudflare’s handling is covered by its own privacy policy.

We also rate-limit bookings. Doing so means recording the IP address a booking request came from, for the length of the limiting window, in a table used for nothing else. Without it a single script could take every appointment in the calendar.

S.08 The on-site assistant

The home page offers an assistant that answers questions about the firm. What you type into it is sent to one of our own Supabase functions to generate a reply. Do not put confidential or sensitive information into it: if something needs to be handled carefully, email or call us so it can be.

S.09 Third parties, named

These are all of them, and what each one is for:

• Vercel: hosts and serves the site.
• Cloudflare. DNS and content delivery in front of it, and Turnstile on the form.
• Supabase: the database and the functions behind the booking form and the assistant.
• Google. Analytics and Google Ads conversion measurement; Calendar and Meet for bookings, including delivery of the invitation email; and Google Fonts, which your browser requests directly, so Google sees the request.
• jsDelivr: a public code CDN that serves one JavaScript library to the home page; it sees the request for that file.

Each is bound by its own terms and by confidentiality where a contract applies. Beyond these, we disclose personal information only where the law requires it: a court order or a regulatory request: or in connection with a merger or transfer of the business, with notice where that is reasonably practicable.

S.10 What this site does not do

This site does not sell or rent your data. It carries no advertising: no ad network, no ad units, no remarketing pixel from a social platform. Visits are reported to Google Ads for conversion measurement, described in S.05. It takes no payment, so it never sees a card number. It has no login, so there is no account and no password. It does not add you to a mailing list: booking a call subscribes you to nothing.

S.11 Retention

Enquiries and bookings are kept while the conversation or engagement is live, and afterwards only as long as needed for our legal, tax and accounting obligations, then destroyed. Rate-limit records are short-lived by design. Analytics records are kept in aggregate. You can ask us to delete your enquiry at any time and we will, subject to anything we are required to retain.

S.12 Your rights

Subject to applicable law you may ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, withdraw consent where consent is what we relied on, and complain to a privacy regulator: in Canada, the Office of the Privacy Commissioner. Write to [email protected] and say which of those you want; we do not require a particular form of words.

S.13 Where the data sits

Our database is hosted in Canada. Some of the providers named in S.09 operate globally and may process data outside Canada, principally in the United States. Where that happens we rely on those providers’ contractual and organisational safeguards, which are intended to give comparable protection. Transmission to and from this site is over HTTPS with current TLS. No transmission over the internet is perfectly secure; do not send documents you would not want intercepted over a network you do not trust.

S.14 Changes and contact

When this policy changes, the current version is posted here and the “last updated” date above changes with it. A material change will be noted on this page.

TNAADO Inc.. Privacy Officer
1050 King Street West
Toronto, Ontario, Canada M6K 0C7
[email protected]

See also: universal privacy policy · contact