Your data, plainly put.
We are a small design studio, not an ad network. There are three ways your information reaches us: the form on this site, the lead form on our Facebook and Instagram ads, and our booking page. This page says exactly what each one collects, who else touches it, where in the world it ends up, and how to make us delete it.
The short version
- We collect what you type into one of three forms: the one on this site, the one attached to our Facebook and Instagram ads, and our booking page.
- Five companies handle some part of it on the way to us: Meta, HubSpot, Google, FormSubmit and Vercel. We name each one below, with what it gets and why.
- Most of them process it outside Canada. We spell out what that means below.
- We do not sell, rent or trade your information. There is no advertising tracker on this website.
- Ask us to delete your inquiry and we delete it from the inbox, from the CRM, and from Meta.
Who we are
Webrivio is a web design studio based in Toronto, Ontario, Canada. We build websites for small businesses across Toronto and the GTA. We are a service-area business, which means we work with clients on site and remotely and do not operate a public storefront address.
This policy covers webrivio.com, the lead form attached to our ads on Facebook and Instagram, and the page you use to book a call with us. If you email or call us directly, the same principles apply.
Rudra Garg, founder, is the person accountable for the information we hold and for this policy. Reach Rudra at hello@webrivio.com or (437) 494-1295. Because we have no public street address, there is no counter to walk up to; if you need a postal address to send a formal request, ask and we will give you one.
What we collect
We collect what you type into a form, plus the ordinary technical details any website sees. We set out everything, in both categories, below. There is no hidden profiling and no data enrichment: we do not go off and buy a richer picture of you from a data broker.
The form on this website
- Name
- So we know who we are talking to.
- Email address
- So we can reply to you.
- Phone number
- So we can call you if that is faster than email.
- Business name
- So we can look at your current site and understand your market.
- Industry
- So we can quote realistically for the kind of work you need.
The lead form on our Facebook and Instagram ads
If you tap one of our ads, the form opens inside Facebook or Instagram: you never leave the app, and it never reaches this website. It asks for your first name, last name, email address, phone number, details about your business, and your answers to a few qualifying questions about the project you have in mind.
Some of those boxes may already be filled in. Meta pre-fills what it already knows from your Facebook or Instagram profile so you do not have to retype it. You can change anything it has filled in before you send the form, and if Meta does not hold a detail, it asks you to type it yourself. Along with your answers, we also receive the practical details of the submission itself: which ad and campaign you came from, and when you sent it.
The booking page
Our booking page runs on Google Calendar. To hold a slot it asks for your first name, last name, email address and phone number. Booking creates an event in our calendar, sends a confirmation and reminder by email to both of us, and generates a Google Meet link for the call. Anyone with the link can open the booking page, so treat it as public. You do not need a Google account to book, or to join the call, and we do not record or transcribe our calls.
Ordinary technical information
When any browser loads this site, our host and our analytics record the usual technical details: the page requested, approximate region, device and browser type, referring page, and the IP address the request came from. The typefaces on this site are served by Google Fonts, so Google also receives your IP address when a page loads.
The analytics side of that is aggregated and cookieless. The server logs are not; they record individual requests, including the IP address. But they exist to serve you the pages and keep the site online, and we do not use either to work out who you are.
Why we collect it
Four reasons, and no others: to reply to you, to understand the project well enough to quote it honestly, to book a call, and, if you hire us, to do the work and keep the records a business has to keep.
We do not use your details for anything you did not contact us about, and we do not sell, rent or trade them. Nobody buys this list, because there is no list to buy.
The basis for all of it is your consent (you chose to send us the form) together with the steps you asked us to take before entering into a contract with you. You can withdraw that consent at any time (see Your rights).
Who else handles it
We keep this list as short as we can, but running ads honestly means it is no longer short enough to hand-wave. Five companies touch some part of your information, and they do not all play the same role.
Meta (Facebook and Instagram) is not working for us. When you submit the lead form inside Meta's apps, Meta passes your answers to us, and it also keeps them for its own purposes, under its own privacy policy, including to pre-fill forms for you in the future. We do not control that and cannot switch it off on your behalf. Meta makes your submission available to us for 90 days; after that we lose access to its copy. If you would rather Meta was not part of this at all, skip the ad form and email us at hello@webrivio.com; it reaches the same place.
- HubSpot is our CRM: it holds your inquiry as a contact record so we do not lose track of it. Leads from our ads are copied into it automatically, because we connected the two: you do not do anything to trigger that, and connecting the two can also copy across leads from the previous 90 days, so an inquiry you sent before we had a CRM may have landed in it too. HubSpot stores the record on our behalf and acts only on our instructions; it does not get to use your information for its own purposes. If you want that record changed or gone, ask us, not HubSpot.
- Google. We run on Google Workspace, so your inquiry sits in a Gmail inbox. The booking page, the calendar entry, the confirmation emails and the Meet link are all Google's too. The typefaces this site is set in are served from Google Fonts too, which is how Google comes to see your IP address even if you never contact us. Google processes all of it under the terms that apply to our Workspace account and its own privacy policy. Joining a Meet call means Google handles the technical side of the call: your connection, device and the display name you join under. Calls are encrypted in transit. They are not recorded.
- FormSubmit (formsubmit.co) handles the form on this website only. The form does not post to our own server; it posts to FormSubmit, a third-party form-delivery service based in the United States, which forwards your submission to our inbox. Prefer not to use it? Email us directly instead.
- Vercel hosts this site and processes standard server request data, including your IP address, in order to serve you the pages and keep the site online.
That is the complete list. We do not share your information with advertisers, data brokers, or anyone else who is not named above. If that ever changes, this page changes first.
Where it is processed
Most of the companies above are American, and your information is stored and processed on their servers outside Canada, primarily in the United States. Here is what that means in practice: while your information is in another country, it is subject to that country's laws, and may be accessible to its courts, law enforcement and national security authorities under those laws. That applies to Meta, Google, FormSubmit and Vercel.
HubSpot is the exception, and only partly. Our HubSpot account is hosted in HubSpot's Canadian data centre in Montreal, so the CRM record itself stays in Canada. HubSpot is still a US company, and some of its own service providers and support staff may access data from outside Canada.
Handing your information to a company that processes it for us does not make it theirs, and it does not let us off the hook: under Canadian law we remain accountable for your information wherever it is held, and we rely on those companies' contractual commitments to protect it to a comparable standard. If you would rather not have your information leave the country, the honest answer is that we cannot fully offer that today. Apart from the CRM in Montreal, every tool a studio this size can afford is hosted abroad.
Cookies, analytics & ads
This site uses Vercel Web Analytics and Vercel Speed Insights. They tell us which pages get read and how fast the site loads for real visitors. Neither sets cookies to identify you, and neither builds a profile of you or follows you across other websites.
We advertise on Facebook and Instagram, so it is fair to ask what that puts on this website. The answer today is nothing. There is no Meta Pixel, no HubSpot tracking code, no Google Analytics, no retargeting tag and no cross-site tracker on webrivio.com, and we set no cookies of our own beyond what is technically required to run the site. The ads and their forms live entirely inside Meta's apps, where Meta's own tracking applies under Meta's policy, not ours.
If we ever add an advertising or analytics tracker to this site, we will say so in this section before it goes live, not after.
How long we keep it
We keep an inquiry while it is useful: to reply to you, and to follow up while the conversation is alive. Once a conversation is clearly over and nothing came of it, we delete it from the CRM, from the inbox, and from Meta's leads centre. We do not keep inquiries forever on the theory that they might come in handy one day.
You do not have to wait for us to get around to it. Ask, and we delete it. Two honest caveats: HubSpot's permanent delete can take up to 30 days to finish purging, and isolated backup copies may persist for a limited period after that before they age out.
Two of the clocks are not ours to control. Meta keeps its own copy of anything you submitted through its lead form under its own policy; our access to it ends 90 days after you send it. And if you become a client, we keep the business and tax records we are legally required to keep: six years from the end of the tax year they relate to, as the Canada Revenue Agency requires.
Follow-up, and how to stop it
Sending us an inquiry is not a newsletter signup, and we do not treat it as one. It lets us get back to you about the thing you asked about, and it is normal for us to follow up once or twice if you go quiet, because people get busy and a single email is easy to miss.
Tell us to stop and we stop. Every commercial email we send identifies us, includes a way to reach a person, and carries an unsubscribe you can use in one click, which we act on within ten business days. If you would rather we did not phone you, say so and we will note it and not call.
If we ever want to send you something broader than the project you asked about, we will ask for your permission first, in a way you have to actively agree to. No pre-ticked boxes.
Your rights
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:
- Access the personal information we hold about you, and know how it has been used and who it has been given to.
- Correct anything that is wrong or out of date.
- Withdraw consent at any time and ask us to stop using your information.
- Have it deleted, subject to any records we are legally required to keep.
- Complain to the Office of the Privacy Commissioner of Canada if you think we have handled your information badly. We would rather you told us first so we can fix it.
Send any of these to hello@webrivio.com and we will answer within 30 days, which is the deadline the law gives us. We will not charge you for it. One thing to know: we can only act on the copies we hold. Meta and Google hold their own copies under their own policies, and you deal with them directly for those. We will point you to the right place if that is easier.
If you are contacting us from outside Canada, send us the same request and we will honour it. We are not going to argue about which statute applies to you.
Security
The site is served over HTTPS, the services we rely on are established providers with their own security practices, and access to the inbox and the CRM is limited to the two of us, the founders. We do not hand anything to contractors or outsource it.
We are not going to claim certifications we do not have. No website or email system is perfectly secure, so please do not send us passwords, banking details, or other sensitive information through any of our forms. We will never ask you for them there.
If something did go wrong and a breach created a real risk of serious harm to you, we would tell you and report it to the Privacy Commissioner, as the law requires.
Changes to this policy
If we start using a different form service, a different CRM, a different analytics tool, or collect anything beyond what is listed above, we will update this page and change the date at the top. The date at the top moves with it, so you can always tell whether anything has changed since you last read it.
How to reach us
Questions about this policy, or about the information we hold about you? Email or call, and one of us answers.