1. Introduction

AuraByt Inc. ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://aurabyt.com (the "Site") or use our services.

This Privacy Policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, the General Data Protection Regulation (GDPR) in the European Union, and the California Consumer Privacy Act (CCPA) in the United States.

Please read this privacy policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Site.

2. Data controller

For the purposes of applicable data protection laws, AuraByt Inc. is the data controller responsible for your personal information.

Company: AuraByt Inc.
Email: connect@aurabyt.com

3. Data we collect

We may collect information about you in a variety of ways. The information we may collect on the Site includes:

3.1 Personal information you provide

When you voluntarily submit information through our contact form, we collect:

Name: To identify you and personalize our communication
Email address: To respond to your inquiries
Business name: To understand your business context (optional)
What you need: The project types you tick (optional)
Budget: The range you choose (optional)
About the project: What you write in the message box

Legal basis: We process this data based on your consent and our legitimate interest in responding to your inquiries.

3.2 Phone calls and text messages

Calls and texts to our studio number, 647-252-5352, are carried by Telnyx. When you text the number, we receive your phone number and what you send, including any photos. The text is relayed to the owner's mobile phone, and a copy is kept as an email record in our inbox at connect@aurabyt.com. Our replies come from the same studio number.

Legal basis: We process this data based on your consent and our legitimate interest in responding to your inquiries.

3.3 Automatically collected information

When you visit our Site, certain information about your device and usage may be automatically collected:

Device information: IP address, browser type, operating system, device identifiers
Usage data: Pages visited, time spent on pages, referral sources, navigation paths
Technical data: Screen resolution, language preferences, time zone

Legal basis: Legitimate interest in maintaining and improving our Site's functionality and security.

3.4 Cookies and tracking technologies

We do not use cookies for advertising, retargeting, or cross-site tracking, and the Site's own code sets no cookies.

Strictly necessary cookies: Our hosting provider, Vercel, may set a cookie that is strictly necessary to keep the Site secure, for example while it checks that a visitor is not automated traffic. These cookies cannot be disabled.

We do not use Google Analytics, advertising pixels, Facebook/Meta pixels, or any third-party advertising trackers.

3.5 Analytics and performance monitoring

We use first-party analytics provided by our hosting platform (Vercel) to understand high-level usage and to monitor site performance. These services do not set tracking cookies and do not collect personally identifiable information:

Vercel Web Analytics: Anonymous, aggregated counts of page views and of a few actions, such as following a link to the contact page or sending the contact form. A form count records only the project types and budget range chosen, never your name, email or message. No cookies, no cross-site tracking. See Vercel Analytics privacy.
Vercel Speed Insights: Anonymous Core Web Vitals measurements (LCP, INP, CLS) sampled from real visitors so we can improve page performance. No cookies, no PII.

Legal basis: Legitimate interest in maintaining and improving the Site (GDPR Art. 6(1)(f)). Because no personal data or identifiers are collected, no consent banner is required under Quebec Law 25, PIPEDA, GDPR, or the ePrivacy Directive.

3.6 Form security

Our contact form is protected by server-side measures (origin checks, a signed form token, a honeypot field, rate limiting, and screening for obvious spam) and by Cloudflare Turnstile, which tells people from bots. Turnstile runs in the background on the contact page, with nothing for you to click. To do this it processes signals from your browser and connection, such as your IP address, TLS fingerprint and user agent.

Cloudflare's handling of this data is described in its Turnstile Privacy Addendum and its Privacy Policy.

Legal basis: Legitimate interest in keeping the Site secure and the contact form free of spam (GDPR Art. 6(1)(f)).

4. How we use your data

We use the information we collect for the following purposes:

Communication: To respond to your inquiries, questions, and comments submitted through our contact form or sent by text to our studio number
Service delivery: To provide and maintain our services
Security: To operate and maintain the security of our Site, including preventing spam, fraud, and abuse
Analytics: To count page views and a few actions, such as sending the contact form, and to measure page speed, without cookies or personal identifiers (see 3.5)
Legal compliance: To comply with legal obligations and protect our rights
Business operations: To send important notices about our services or changes to our policies

We do not sell, trade, or rent your personal information to third parties.

We may share your information with third-party service providers who perform services on our behalf:

5.1 Service providers

Vercel Inc.: Our website hosting and serverless infrastructure provider. Vercel handles request routing, CDN delivery, and runs the serverless function that processes contact form submissions. Vercel may process IP addresses and request metadata for security and operational purposes. See Vercel's Privacy Policy.
Resend (Resend Inc.): Transactional email provider used to deliver contact form submissions, and the email records of texts to our studio number, to our inbox. Resend processes the message contents and the email address or phone number they come from so we can reply. See Resend's Privacy Policy.
Upstash, Inc.: When you send the contact form, your IP address is stored for up to 10 minutes to limit repeated submissions, then deleted automatically. When you text our studio number, your phone number may be kept for up to 30 days as the most recent sender, so that our reply reaches you.
Cloudflare, Inc.: Provides Turnstile, which checks that the contact form is being used by a person rather than a bot (see 3.6). It processes signals such as your IP address, TLS fingerprint and user agent. See Cloudflare's Turnstile Privacy Addendum and Privacy Policy.
Telnyx: Our phone provider. Telnyx carries calls and texts to our studio number, 647-252-5352, including the phone numbers involved and the contents of texts (see 3.2). See Telnyx's Privacy Policy.

5.2 Legal requirements

We may disclose your information if required to do so by law or in response to:

Valid legal requests from government authorities
Court orders or subpoenas
Protection of our legal rights or property
Investigation of potential violations of our Terms of Service
Protection of the safety of individuals

5.3 Business transfers

If we are involved in a merger, acquisition, or sale of assets, your personal information may be transferred. We will provide notice before your information is transferred and becomes subject to a different Privacy Policy.

6. Data retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Contact form submissions: The email containing your message is retained in our inbox for up to 2 years, or until you request deletion.
Texts to our studio number: Each text is kept as an email record in our inbox. Your phone number may also be kept for up to 30 days as the most recent sender, so that our reply reaches you.
Rate-limit records: Your IP address, for up to 10 minutes after you send the contact form.
Vercel Analytics and Speed Insights: Aggregated, non-personal data retained per Vercel's defaults (rolling 30 days for detailed views; longer for aggregate counts). No individual visitor can be re-identified from this data.
Server logs: Vercel may retain request logs (IP, user-agent, request path) for a short period (typically days, not months) for security and debugging.

When data is no longer needed, we securely delete or anonymize it in accordance with industry standards.

7. Your data rights

Depending on your location, you have certain rights regarding your personal data:

7.1 Rights under PIPEDA (Canada)

Access: Right to know what personal information we hold about you
Correction: Right to correct inaccurate information
Withdrawal of consent: Right to withdraw consent for data processing
Complaint: Right to file a complaint with the Privacy Commissioner of Canada

7.2 Rights under GDPR (EU/EEA)

Right to access: Request copies of your personal data
Right to rectification: Request correction of inaccurate data
Right to erasure: Request deletion of your data ("right to be forgotten")
Right to restrict processing: Request limitation of data processing
Right to data portability: Receive your data in a machine-readable format
Right to object: Object to processing based on legitimate interests
Right to withdraw consent: Withdraw consent at any time
Right to lodge a complaint: File a complaint with your local supervisory authority

7.3 Rights under CCPA (California)

Right to know: Request disclosure of personal information collected
Right to delete: Request deletion of your personal information
Right to opt-out: Opt-out of the sale of personal information (we do not sell data)
Right to non-discrimination: Equal service regardless of exercising privacy rights

7.4 How to exercise your rights

To exercise any of these rights, please contact us at connect@aurabyt.com. We will respond to your request within:

30 days for PIPEDA requests
1 month for GDPR requests (extendable to 3 months for complex requests)
45 days for CCPA requests

8. Security of your information

We implement administrative, technical, and physical security measures to protect your personal information, including:

Encryption: HTTPS/TLS encryption for data in transit
Access controls: Limited access to personal data on a need-to-know basis
Secure infrastructure: Hosting on secure, SOC 2 compliant servers
Regular security audits: Periodic review of security practices
Data minimization: Collecting only necessary information

Important: While we take reasonable steps to secure your data, no security measures are perfect or impenetrable. No method of data transmission over the internet can be guaranteed as 100% secure. You transmit information at your own risk.

9. International data transfers

Your information may be transferred to and maintained on servers located outside of your country, province, or jurisdiction where data protection laws may differ. By using our Site, you consent to the transfer of information to Canada, the United States, or other countries where our service providers operate.

For EU users: When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Children's privacy

Our Site is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe we have collected information about a child, please contact us immediately at connect@aurabyt.com, and we will delete the information.

11. Third-party websites

The Site may contain links to third-party websites and applications. We are not responsible for the privacy practices or the content of such websites. We encourage you to read the privacy policies of any third-party sites you visit.

12. Do Not Track signals and GPC

Because we do not engage in cross-site tracking and do not run third-party advertising or analytics that profile visitors, "Do Not Track" (DNT) and Global Privacy Control (GPC) signals do not change our data practices. There is nothing for us to disable. Our analytics (Vercel Web Analytics and Speed Insights) are cookieless, anonymous, and aggregated regardless of any browser signal.

13. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. We will notify you of any material changes by:

Posting the new Privacy Policy on this page
Updating the "Last updated" date at the top of this policy
For significant changes, we may provide additional notice (such as a banner on our homepage)

Your continued use of the Site after any changes indicates your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

14. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Company: AuraByt Inc.
Email: connect@aurabyt.com

Response time: We reply to privacy questions within one business day, and complete requests within the deadlines in section 7.4.