Privacy Policy

Sylvadi Design Inc. ("Sylvadi", "we", "us", or "our") respects privacy and understands that clients use our website and portal to share business, design, product, technical, billing, and project information. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use our website, client portal, subscription design services, communications, files, and related services.

This Privacy Policy should be read together with our Terms and Conditions. If you use the services on behalf of a company or other organization, you represent that you have authority to provide personal information to Sylvadi for that organization.

This Privacy Policy does not govern third-party websites or services that we do not control, such as Stripe, Cloudflare, Linear, Resend, GitHub, Webflow, or other external platforms. Those providers may have their own privacy notices.

• The Sylvadi website.
• The Sylvadi client portal.
• Magic-link sign-in and account access.
• Subscription checkout and billing workflows.
• Client requests, support messages, task comments, revision notes, approvals, and deliverable reviews.
• Uploaded files and downloaded deliverables.
• Email notifications and support communications.
• Administrative, security, audit, and operational logs.

Depending on how you use the services, Sylvadi may collect account and contact information, billing and subscription information, project and portal information, technical and security information, and communications.

Account and contact information may include email address, name if provided, role, account timestamps, magic-link sign-in information, and session information.

Billing and subscription information may include selected plan, subscription status, current period information, live-slot entitlement, Stripe customer ID, Stripe subscription ID, checkout metadata, invoice status, billing event status, billing-related support communications, and tax-relevant information you provide or that is available through the billing process.

Sylvadi does not need to store full payment card numbers. Payment details are processed by Stripe.

Project and portal information may include request titles, briefs, priorities, notes, statuses, revision requests, task comments, support messages, task status, client priorities, project history, deliverable titles, review statuses, approvals, revision notes, uploaded reference files, comment files, deliverable files, file names, file sizes, content types, associated project metadata, and download logs.

Technical and security information may include session cookies, authentication tokens, IP address, browser, device, request and operational information, webhook event records, notification events, administrative action events, error logs, and security-relevant logs.

We collect information:

• Directly from you when you sign in, subscribe, submit a request, upload a file, post a comment, approve a deliverable, request revisions, contact support, or email us.
• Automatically when you use the website or portal, such as session cookies, timestamps, logs, and technical metadata.
• From service providers, such as Stripe checkout or subscription webhook events.
• From project-management tools, such as Linear issue or comment updates linked to a Sylvadi project.
• From administrators who manage workrooms, tasks, subscriptions, deliverables, comments, and files.

Sylvadi uses personal information for the following purposes:

• To provide and operate the website, portal, and subscription design services.
• To authenticate users and maintain secure sessions.
• To manage subscriptions, live slots, billing status, checkout, invoices, customer portal access, and tax handling.
• To receive, review, prioritize, scope, accept, archive, and fulfill client requests.
• To create, manage, review, approve, revise, deliver, replace, and archive files and deliverables.
• To provide support and respond to client communications.
• To send magic links, service notifications, administrative notifications, and billing-related communications.
• To sync relevant project information with internal tools, including Linear.
• To store private files and serve authenticated downloads.
• To log downloads, webhooks, notification events, administrative actions, and project events.
• To secure, debug, monitor, test, improve, and maintain the services.
• To enforce terms, prevent abuse, investigate incidents, and protect rights, safety, and security.
• To comply with legal, tax, accounting, audit, regulatory, and recordkeeping obligations.

Where Canadian private-sector privacy law applies, including PIPEDA or substantially similar provincial law, Sylvadi collects, uses, and discloses personal information only for purposes that a reasonable person would consider appropriate in the circumstances and with consent where required.

Consent may be express, such as when you submit a form, upload a file, start checkout, or contact support. Consent may also be implied where the purpose is obvious and reasonably necessary to provide the requested service, such as using your email address to send a magic sign-in link or using billing metadata to manage a subscription.

You may withdraw consent where legally permitted, but doing so may limit or prevent our ability to provide the services.

Sylvadi uses session cookies and related authentication technology to keep users signed in and to protect portal access. The session cookie is used for authentication and security.

At the time of this policy, the current app does not show a dedicated analytics, advertising, or session-replay integration. If analytics, advertising pixels, or similar tools are added later, this Privacy Policy should be updated before or when those tools are deployed.

Sylvadi does not sell personal information in the ordinary sense of selling a customer list for money. If applicable law defines sale or sharing more broadly, Sylvadi should update this section to reflect any applicable rights and practices.

Sylvadi may share personal information with:

• Service providers that host, store, secure, process, or transmit data for us.
• Payment processors, including Stripe, for checkout, subscriptions, billing portal access, invoices, payment processing, taxes, fraud prevention, and payment records.
• Infrastructure providers, including Cloudflare, for hosting, Workers, D1 database, R2 private storage, email, security, and related infrastructure.
• Email providers, including Cloudflare Email or Resend, for magic links, portal notifications, support notifications, and administrative messages.
• Project-management tools, including Linear, for task, request, issue, comment, revision, and workflow synchronization.
• Development and operations tools, including GitHub and deployment providers, when needed to build, maintain, secure, or debug the services.
• Contractors, employees, advisors, accountants, lawyers, or other representatives who need access to provide or support the services and are subject to confidentiality or professional obligations.
• Government, law enforcement, regulators, courts, or other parties where required or permitted by law.
• A successor or prospective successor in connection with a merger, acquisition, financing, restructuring, sale of assets, change of control, bankruptcy, or similar transaction.

Sylvadi and its service providers may process, store, or access personal information in Canada, the United States, and other jurisdictions where our service providers operate. Privacy laws in those jurisdictions may differ from the laws where you live.

By using the services or providing information to Sylvadi, you understand that your information may be processed outside your province, state, or country. We use service providers for legitimate business purposes and take reasonable steps to protect personal information in our custody or under our control.

Sylvadi uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, disposal, or similar risks.

No method of transmission or storage is perfectly secure. You are responsible for protecting your email account, devices, browser sessions, downloaded files, and any links or files you share.

• Magic-link sign-in and session cookies.
• Server-side paid-access checks for portal routes.
• Private file storage for deliverables.
• Authenticated file download routes.
• Signed, time-limited comment-file links in some contexts.
• File name sanitization and upload limits.
• Webhook verification for certain third-party events.
• Administrative logging and download logging.

Sylvadi retains personal information for as long as reasonably necessary to provide the services, maintain accounts, manage subscriptions, preserve project history, support clients, keep business records, comply with legal, tax, accounting obligations, resolve disputes, enforce agreements, and maintain security.

Active project and portal records may be retained while the account, subscription, workroom, or project remains active.

Archived requests, comments, deliverables, file records, download logs, webhook logs, and notification logs may be retained for business, audit, support, legal, and security reasons.

Payment and subscription metadata may be retained as required for tax, accounting, audit, and dispute purposes.

Sylvadi should adopt a formal retention schedule before publishing this policy at scale.

Depending on where you live and which laws apply, you may have rights to request access to personal information Sylvadi holds about you, request correction of inaccurate or incomplete personal information, withdraw consent where consent is the legal basis and withdrawal is permitted, ask questions or challenge Sylvadi's privacy practices, and request deletion subject to legal, contractual, business, security, and technical limits.

To make a privacy request, contact Sylvadi using the information below. We may need to verify your identity and account authority before responding.

The portal is intended for project, design, development, support, and billing-related materials. You should avoid uploading sensitive information that is not necessary for the project.

Do not upload financial account numbers, health information, government identifiers, private keys, passwords, export-controlled data, regulated personal information, confidential third-party data, or other highly sensitive information unless Sylvadi has expressly requested it and you have authority to provide it.

If you upload third-party personal information, you are responsible for ensuring you have all required notices, consents, rights, and lawful authority to provide that information to Sylvadi.

The services are intended for businesses and adults. They are not directed to children. Do not use the services if you are under the age of majority in your jurisdiction unless a parent, guardian, or authorized organization has approved and is responsible for your use.

Sylvadi does not knowingly collect personal information from children. If you believe a child has provided personal information to Sylvadi, contact us so we can review and take appropriate action.

The website or portal may link to third-party services or websites. Sylvadi is not responsible for the privacy practices, security, content, or policies of third parties. You should review third-party privacy notices before using their services.

Important third-party providers may include Stripe, Cloudflare, Linear, Resend, GitHub, Webflow, email providers, domain providers, and other vendors used to operate or support the services.

Sylvadi may update this Privacy Policy from time to time. The updated version will be posted on the website or otherwise made available. The "Last updated" date indicates when it was last revised.

Your continued use of the services after an updated Privacy Policy is posted means you acknowledge the updated policy.

For privacy questions or requests, contact Sylvadi Design Inc. at portal@sylvadi.com or 148 Byng Ave North York ON M2N 4K7 Canada.

If you are in Canada and are not satisfied with our response, you may have the right to contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.