Privacy & accessibility
Last updated 2026-08-01. This site collects very little, and this page says exactly what and why.
Who runs this site
This site is operated by DevAxis Software Solutions, a one-person software development practice based in Cambridge, Ontario, Canada. It is owned and run by Rishik Gupta. There is no team and no third party with access to your enquiry other than the processors named below.
I am the person accountable for privacy here, because I am the only person here. For anything on this page, including a request to see or delete your data, email rishik.gupta@devaxis.ca. If you need a postal address for a formal request, ask and I will give you one.
What this site collects
Three things, and nothing else.
- What you send me in a form. If you start a project enquiry, I receive what you typed: what you’re trying to achieve, your stage, and your name and email. Most fields are optional, and the budget question is never required.
- Anonymous Next Move sessions. When you use the Next Move tool I record which position and blocker were chosen, with no name, email, or account attached. It tells me which answers people need; it cannot tell me who you are.
- Cookieless analytics. Page views and referrers, through Vercel Analytics. It sets no cookies and builds no cross-site profile, which is why this site has no cookie banner.
There is no tracking cookie, no advertising pixel, no session recording, and no third-party analytics script. I don’t ask for your phone number.
About IP addresses
Form submissions are rate-limited to stop abuse, which needs a way to recognise repeated requests. Your IP address is never stored. It is combined with a secret salt and hashed, and only that hash is kept: enough to count requests, not enough to identify you or to recover the original address.
Why I collect it
To reply to you, to work out whether I can help, and to understand which parts of the site are useful. That’s the whole list. I don’t sell data, share it for advertising, or add you to a mailing list. There isn’t one.
How long it’s kept
- Enquiries are kept while the conversation is live and reviewed annually. If nothing came of it, it gets deleted.
- Next Move sessions are deleted automatically after 12 months by a scheduled job. Funnel data older than a year tells me nothing useful.
- My inbox also gets a copy of every enquiry, because the site emails it to me when you submit. So it lives there as well as in the database. If you ask me to delete an enquiry, I delete both.
Who else processes it
Four services, named with their regions. None of them are given your data for their own purposes.
| Service | What it does | Region |
|---|---|---|
| Vercel | Website hosting and privacy-friendly analytics | United States, with edge delivery worldwide |
| Supabase | Database for form submissions and anonymous Next Move sessions | Canada |
| Resend | Delivers the notification email when you submit a form | United States |
| Cal.com | Scheduling, if you book a call. It takes your name, email and timezone | United States |
Your enquiry data is stored in Canada. The database region is Canadian, so everything you send through a form stays under Canadian jurisdiction. Vercel serves the pages from a global edge network, but no personal data is stored there.
Your rights under PIPEDA
Under Canada’s Personal Information Protection and Electronic Documents Act you can ask what I hold about you, ask for it to be corrected, ask for it to be deleted, and withdraw consent at any time.
Email rishik.gupta@devaxis.ca and I’ll answer within 30 days. Being honest about the mechanics: there are few records that I do this by hand, running a query and replying to you. There is no self-serve privacy dashboard, and I’d rather say that than build a page that pretends otherwise.
Accessibility statement
The target for this site is WCAG 2.2 Level AA, and it is treated as a build requirement rather than an audit that happens afterwards.
What has been tested. Automated accessibility checks run against every component and every page in continuous integration, and the build fails on a violation. Every colour pairing is checked against the AA contrast thresholds by a script that reads the design tokens. The site has had a full keyboard pass, and every interactive element has a static equivalent that works with JavaScript disabled.
Known gaps, stated honestly. A full manual screen-reader pass with NVDA and VoiceOver, and testing on physical iOS and Android handsets, are still outstanding. Automated tools catch perhaps half of real accessibility problems, so this list is a genuine gap and not a formality.
If something doesn’t work for you, email rishik.gupta@devaxis.ca and tell me what you were trying to do and what got in the way. I’ll reply, and tell you whether and when I can fix it.
Changes to this policy
If this policy changes materially the date at the top changes with it. There is no mailing list to notify, so the date is the honest signal.
The terms covering use of this site are on the terms page.
Questions about any of this?
Ask. A privacy policy you have to interpret isn’t doing its job.