Privacy Policy
What we collect, why, and what we do with it.
Who we are
DEVSFLOW Technologies Ltd. is a mobile development studio based in Toronto, Canada. We run this website (devsflow.ca) and four subdomain sites: guarding.devsflow.ca, neuro.devsflow.ca, staffing.devsflow.ca, and maintenance.devsflow.ca.
Our privacy contact is Zawar Nadeem, founder. Email zawar@devsflow.ca for any privacy question, data access request, or data deletion request. We will respond within 30 days.
What we collect
We collect different things depending on your consent choice. When you first visit, you will see a banner with two options: "Essential only" and "Accept all". Here is exactly what each one means.
If you choose "Essential only":
- One consent cookie, named
devsflow_consent, storing your choice so we do not show you the banner again. Expires after 365 days. - Standard server access logs from our hosting provider, kept for security and abuse prevention. This includes the page you requested, your browser type, and a timestamp. Logs are kept briefly and not used for tracking or marketing.
If you choose "Accept all":
In addition to the essential items above, we collect:
- Your IP address and the approximate location it maps to (country, region, city). We use this to understand where our visitors come from and to flag returning visitors.
- A session cookie, named
devsflow_session, holding a random identifier so we can group page views from the same visit. Expires when you close your browser. - A visitor cookie, named
devsflow_visitor, holding a random identifier so we can recognize when you come back. Expires after 365 days. - Page views: which pages you visit, in what order, and how long you stay on each.
- The site that sent you (referrer), if any.
- Your browser, operating system, and screen size, used only to make sure the site works on the devices visitors actually use.
- Specific interactions: when you click an email or phone link, or move between our subdomains, we record the event so we know which pages drive contact.
Why we collect it
Three reasons, all practical.
- To run the website. Server logs let us catch errors and stop abuse (spam, scrapers, attacks).
- To make the site better. Knowing which pages help visitors and which do not tells us what to improve. Knowing where visitors come from tells us where to invest our time.
- To respond to you and follow up. If you contact us, we need your email or phone to write back. If your company visits our site repeatedly, we may reach out to introduce ourselves.
Where the data is stored
The website itself is hosted by Vercel, a US company. When you load a page, Vercel handles the request and logs it briefly for security.
The detailed visitor data we collect under "Accept all" is stored on our own hardware in Toronto, Canada. It does not go into any third-party analytics platform. We chose this so the data stays under our direct control and inside Canada.
To make our self-hosted tracking endpoint reachable from the internet, we route traffic through Cloudflare Tunnel. Cloudflare sees the IP address and domain of every connection that reaches our endpoint, but the visitor data itself is encrypted in transit and only readable on our hardware. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.
If you contact us by email, your message is stored by our email provider, also in the United States.
Cookies in detail
Three cookies in total, and only the first one is set without your consent.
devsflow_consent: stores your consent choice. Set when you click either banner button. Expires in 365 days. Used to avoid showing the banner again.devsflow_session: random session identifier. Set only after "Accept all". Expires when you close your browser. Used to group page views from one visit.devsflow_visitor: random visitor identifier. Set only after "Accept all". Expires in 365 days. Used to recognize return visits.
You can change your mind at any time. Clear the devsflow_consent cookie in your browser and the banner will appear again on your next visit.
Who we share your data with
We use a small number of third-party services to run the site. They each see some of your data.
- Vercel (vercel.com) hosts the website and processes server logs. Vercel is a US company. Their privacy policy is here.
- Cloudflare (cloudflare.com) routes traffic to our self-hosted tracking endpoint. Cloudflare sees the IP address of the connection but cannot read the visitor data itself, which is encrypted in transit.
- Google sees your visits indirectly through Google Search Console, which reports search queries that led to our site. Google does not get data from us directly; it gets it from your browser when you click a search result.
- Our email provider stores messages you send us at info@devsflow.ca and zawar@devsflow.ca.
We do not share your visitor data with anyone else. We never sell it.
How long we keep it
- Server logs: roughly 24 to 48 hours at the hosting layer.
- Visitor data (page views, IP, location): 24 months, then deleted. Aggregate counts (for example, "this page got 500 views last quarter") may be kept longer in summary form with no personal data.
- Consent cookie: 365 days, then it expires and the banner reappears.
- Email conversations: until the conversation no longer serves any purpose, then deleted on request or as part of routine cleanup.
Your rights (Canada and United States)
If you are in Canada, you have rights under Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you are in Quebec, under An Act respecting the protection of personal information in the private sector (Quebec Law 25). You can ask us to:
- Tell you what data we have about you.
- Send you a copy of that data in a portable format.
- Correct any data that is wrong.
- Delete your data, where we are not required to keep it for legal or accounting reasons.
- Stop processing your data, or withdraw consent you previously gave.
If you live in Quebec and believe we are not following Quebec Law 25, you can file a complaint with the Commission d'accès à l'information du Québec. If you live elsewhere in Canada, you can file with the Office of the Privacy Commissioner of Canada.
If you are in the United States, your rights depend on your state. We honor requests from anyone in any US state, regardless of whether that state has a specific privacy law.
- California (CCPA / CPRA): you have the right to know what we collect, request a copy, request deletion, correct inaccurate data, opt out of any "sale" or "sharing" (we do neither), and not be discriminated against for exercising these rights.
- Virginia, Colorado, Connecticut, Utah, and others: similar rights to California.
- Other US states: we extend the same rights regardless.
Email zawar@devsflow.ca with your request. We may need to verify your identity before we act, especially for deletion or data export. We respond within 30 days at no charge.
Do Not Track and Global Privacy Control
Some browsers send a "Do Not Track" or "Global Privacy Control" signal. If your browser sends GPC, we treat that as a request to use "Essential only" tracking, even if the consent banner has not been shown to you yet.
Children
This site is for businesses and adult professionals. We do not knowingly collect data from anyone under 16. If you believe we have, email zawar@devsflow.ca and we will delete it.
Changes to this policy
If we change anything material (for example, adding a new third-party service or starting to collect a new category of data), we will update this page, update the "last updated" date at the top, and reset the consent cookie so you see the banner again with the new options.
Contact
DEVSFLOW Technologies Ltd.
Toronto, Ontario, Canada
Privacy contact: Zawar Nadeem, founder
Email: zawar@devsflow.ca
Phone: +1 (514) 963-3744