Privacy
What we collect, why, where it is kept and for how long — and how to see it or have it deleted. Last updated 2026-10-17.
Who we are
Nurath, in Whitby, Ontario. For anything about your information, emailnurathhq@gmail.com.
What we collect, and why
When you run the free audit
- Your business's name, town, what it sells and the kind of business — to run the audit and write the report.
- Your website address, if you have one — the audit reads only that website, as any visitor would.
- The results — what each check found, with what we saw. They are built only from what anyone can see on your website.
- Your email address, only if you choose to keep your report. We send one email to it: a link that signs you in to the report. Nothing else is sent to an address until that link has been opened.
- Answers to the optional questions, if you give any — to understand who the audit is for.
- Your consent to follow-up emails, only if you tick the box (it starts unticked): when, the exact words you agreed to, and your internet (IP) address at that moment, as the law requires us to be able to prove.
- A scrambled version of your IP address, to limit audits to 3 a day from one connection. It cannot be turned back into the address without a secret only our server holds.
Until you keep your report, the audit belongs to no one: only the browser that ran it can claim it, and if nobody does, it is deleted after 7 days.
When you have an account
- Your email address — it is your account, and where sign-in links go. There are no passwords.
- When you were last signed in — so an account nobody uses can be deleted (see below).
- Light or dark look for the dashboard, if you choose one.
- Each re-run of the checks, saved the same way as the first audit.
- Which plan you are on.
To keep you signed in, your browser stores one item under the name nurath.session. It is written only when you open a sign-in link, and removed when you sign out. It is not a cookie.
The business finder asks for your skills, how much time and money you have, and your town. These are used to answer that one request and are not stored anywhere.
What we do not collect, or do
- No cookies. Nothing is stored in your browser unless you sign in.
- No passwords, phone numbers, home addresses or dates of birth.
- No tracking pixels, advertising identifiers or fingerprinting.
- We do not sell personal information, and do not share it for advertising.
- Your audit is shown only to you. There is no public list or shareable link of anyone's results.
Who handles it for us, and where
- Supabase stores the database, sends sign-in links, and runs the audit. Its servers are in theUnited States (Oregon). Information stored outside Canada can be accessed by authorities there under their laws.
- Cloudflare hosts this website, and so receives the IP address of every visitor, as any web host does.
- Cloudflare Turnstile checks that a person, not a program, is starting an audit. It runs on that one step only; we receive only pass or fail.
- Google (Gmail) holds the emails you send to nurathhq@gmail.com.
We do not count visits to this website yet. If we start, we will use Cloudflare Web Analytics, which sets no cookie, and this page will say so before it is switched on.
Emails we send
Today, only sign-in links, because you asked for them. We send no marketing email yet. If we ever do, it will go only to people who ticked the box, each one will say who it is from and have a one-click unsubscribe, and an unsubscribe is permanent.
How long we keep it
Deleted automatically, every night, when its time is up:
| What | Kept for |
|---|---|
| An audit nobody kept | 7 days |
| An account on the free plan with no sign-in and no audit | 12 months, then deleted with everything in it |
| An account in use, or on the paid plan | While the account exists; deleted within 30 days if you ask |
| The scrambled IP address used for the daily limit | 2 days |
| Consent records | 3 years after the last email sent under them, or after you withdrew |
| Records of marketing emails sent | 3 years |
| Privacy requests | 2 years after they are answered |
| An unsubscribe | Never deleted — that is what keeps you unsubscribed. We keep a scrambled form of the address, not the address. |
Seeing, correcting or deleting your information
Email nurathhq@gmail.com to ask for a copy of what we hold about you, to correct it, to delete it, or to withdraw consent to follow-up emails. We answer within 30 days. Before handing anything over or deleting it, we check that the email address is yours.
An audit result is a record of what was on your website at the time, so it is not edited: re-run the checks and the new result replaces it on your dashboard. If you ask us to delete your account, we keep only the scrambled unsubscribe record and any consent records, because the law requires us to be able to show we had permission.
If you are not happy with how we handled your information, you can complain to theOffice of the Privacy Commissioner of Canada.