Privacy Policy

Accountability — Our Privacy Officer

DevAc is accountable for the personal information it collects, uses and discloses in connection with the service, and has designated a privacy officer to oversee compliance with this policy and with PIPEDA and, where applicable, Quebec’s Law 25. The privacy officer identified above on this page is responsible for handling questions, access requests and complaints related to your personal information.

Identifying Purposes — Why We Collect Your Information

We collect account and contact information (such as your name and email address) to create and manage your account; order and payment metadata to process and administer your subscription — your payment card details are collected and held by Stripe, not by DevAc; the answers you provide during onboarding to produce your site brief and generate your website; domain and DNS information to provision and operate your hosting; mailbox configuration data to provision and operate your professional email; and the content of support messages and contact-form submissions to respond to your questions.

When you accept our Terms and Conditions or this Privacy Policy — when you create an account, at checkout, or in your dashboard — and when you give or withdraw consent to receive marketing emails, we keep a record of that choice as evidence: the document and version concerned, the date and time, the language it was shown in, the IP address and the browser user agent (the type of browser and device) of the request and, for an acceptance at checkout, the identifier of the Stripe Checkout session. The IP address and user agent stored in these records are used only as evidence of consent. We also process IP addresses for security and abuse prevention, for example to limit repeated sign-up attempts (rate limiting).

Consent

By creating an account, subscribing to the service, or otherwise submitting personal information to us, you consent to its collection, use and disclosure as described in this policy. Where the law requires a more specific or separate consent — for example, at signup or checkout — we obtain it there. You may withdraw consent at any time by contacting our privacy officer, subject to legal or contractual restrictions; because the service cannot be provided without the information it needs to operate (an account, billing information, domain and mailbox configuration), withdrawing consent for that core information means we can no longer provide the service to you.

Limiting Collection

We collect only the personal information reasonably necessary for the purposes described in this policy. We do not collect categories of information the service has no operational purpose or legal ground for holding.

Limiting Use, Disclosure and Retention — Who We Share Data With

We do not sell your personal information. We disclose personal information only to the service providers (“sub-processors”) that operate the service on our behalf, each bound to use the information only for the purpose we engage them for, and to other parties where required by law.

The sub-processors that may process personal information in connection with the service are: Stripe (payment processing); Supabase (database hosting and authentication); Vercel (application hosting); Cloudflare (DNS and domain zone management); Name.com (domain registration); Migadu (mailbox hosting); Resend (transactional email delivery); Anthropic (the AI assistant used during onboarding); Upstash (caching and rate limiting); Amazon Web Services (file storage); Sentry (error monitoring and diagnostics); Hostinger (hosting for DevAc’s own @devac.app support mailboxes); and Google/YouTube, which receives visitor data when our demo video — embedded through YouTube’s privacy-enhanced (youtube-nocookie.com) player — is viewed on our site.

Most of the sub-processors listed above operate outside Canada, primarily in the United States. As a result, your personal information is stored and processed outside Canada. While outside Canada, your information may be accessible to foreign courts and to law enforcement or national security authorities under the laws of the jurisdiction where it is held, which may differ from Canadian privacy law.

How long we retain personal information, and how it is destroyed or anonymised, is described in the Data Retention and Destruction section below.

Accuracy

You can review and correct your account information at any time from your account dashboard. If you believe other personal information we hold about you is inaccurate or incomplete, contact our privacy officer and we will correct it.

Safeguards

We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold. Mailbox passwords are stored encrypted, not in the clear; access to personal information within our systems is restricted by role (customer or administrator); and our infrastructure providers apply their own security controls to the data they process on our behalf.

Openness — How This Policy Is Published and Updated

This policy is published at this page and describes our current practices for handling personal information. When we make a material change to this policy, we publish a new version with an updated version identifier and effective date, both shown at the top of this page.

Individual Access

You may request access to the personal information we hold about you, and request a copy of it, by contacting our privacy officer. We will respond within a reasonable time — generally within 30 days — and, where we cannot provide access (for example, because the information is not held or an exemption applies), we will explain why.

Challenging Compliance — How to Complain

If you have a concern about how we handle your personal information, or believe we have not complied with this policy or applicable privacy law, contact our privacy officer with the details of your concern; we will investigate and respond. If you are not satisfied with our response, you may escalate your complaint to the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d’accès à l’information du Québec.

Data Retention and Destruction

We retain personal information for as long as it is needed for the purposes described in this policy — including for the duration of an active subscription and through the seven-day grace period described in our Terms and Conditions when a payment fails — and for any additional period required to meet our legal, accounting or tax obligations. Once personal information is no longer needed for these purposes, we destroy it or render it anonymous.

This is a destruction-and-anonymisation obligation, not an unconditional right to on-demand deletion: we cannot destroy information we are still required to retain for an active subscription or a legal obligation, and destroying information needed to operate your hosting, domain or mailbox while your subscription is active would prevent us from providing the service.

Records of your acceptance of our legal documents and of your marketing-email choices, including the IP address and user agent stored with them, are kept as evidence of consent even after your account is closed, for as long as we may need to demonstrate that consent, and are not used for any other purpose.

Language of Record

This Privacy Policy is drafted in English, which is the governing language of this document. The Spanish (es) and French (fr) versions are provided as courtesy translations for convenience; in the event of any conflict or ambiguity between versions, the English text prevails.

About This Policy

This policy was prepared by DevAc based on our current business practices and our understanding of PIPEDA and Quebec’s Law 25. It has not been reviewed by outside counsel and should not be treated as a substitute for professional guidance tailored to your specific situation. If you have questions about this policy or about your personal information, write to our privacy officer at the support email shown above on this page.