PRIVACY

Privacy notice.

This notice explains what the NEXFORA Digital Innovation website collects, why, which providers are involved, and how long information is kept.

Last updated: September 10, 2026

01 — Scope

What this notice covers.

This notice covers the NEXFORA Digital Innovation website and the two forms that submit information to us: the Start a Project inquiry form and the SmartCard beta signup form. Both are live, and both store what you submit.

It does not cover work carried out under a separate written agreement with a client, or any third-party website reached through a link here.

02 — Collection

Information we collect.

The information you give us directly is what you type into one of the two forms. There is no account system and no newsletter signup.

Separately, analytics records how the website itself is used — pages viewed, how you arrived, approximate location, and general device and browser information. Google Analytics does this only if you accept it when asked; Vercel's page-view and performance measurement runs for the site as a whole. Conversion events may include the requested service, source page, and CTA location, but never the name, contact details, business, project description, budget, timeline, or message content entered into a form. Section 08 explains it and your choice.

Alongside your answers, each submission carries a record that you ticked the consent box, the date and time you submitted, and a randomly generated identifier that lets us recognise a duplicate submission of the same attempt. Sections 04 and 05 list the fields for each form exactly.

03 — Use

How we use information.

We use what you submit to:

  • receive and review your inquiry or beta signup
  • reply using the contact details you supplied
  • send you a confirmation that we received your submission
  • protect the forms from spam and automated abuse

We do not sell your information, and we do not use it for advertising or automated decision-making. Submitting a form does not by itself create a client relationship, and we do not promise a reply within any particular timeframe.

04 — Project inquiries

Start a Project inquiries.

The form asks for your full name, email address, preferred contact method, the service you are interested in, and a description of the project. Your business or organisation, phone number, estimated budget, and target timeline are optional, except that a phone number is required if you choose phone as your preferred contact method.

When a submission passes the security checks, those answers are stored in our Supabase database together with the consent record and timestamp described above.

When available, the inquiry also records non-content marketing context: the actual requested service, the page and CTA that opened the form, the first page in the browser session, the referring site's origin, and standard UTM campaign values. Query strings are not stored as page paths, and the referring URL is reduced to its origin before storage. This context is held temporarily in browser session storage and is sent to us only if you submit the inquiry.

Storing the inquiry then triggers two emails through Resend: a notification to NEXFORA Digital Innovation that can be replied to at your address, and a confirmation to you. If email delivery fails, your inquiry stays recorded and we may still respond. Re-submitting the same attempt does not create a second record or a second email.

05 — SmartCard beta

SmartCard beta signups.

The form asks for your full name, email address, business or profession, delivery address, the SmartCard type you are interested in, how you plan to use it, and your preferred contact method. An address line, city or municipality, province, state or region, postal code, and country are required. A second address line, phone number, and website or social profile are optional, except that a phone number is required if you choose phone as your preferred contact method.

We use the delivery address to confirm service availability and, for selected beta participants, arrange delivery. Accepted signups are stored in our Supabase database with the consent record, the timestamp, and a note that the record came from the SmartCard beta form. Resend then sends a notification containing the submitted application to NEXFORA Digital Innovation and a confirmation to you.

If you submit twice with the same email address, we keep the existing record rather than creating a duplicate. A signup records your interest only: it does not confirm selection for the beta, guarantee access or a card, or set pricing or a release date.

06 — Providers

Service providers.

Three providers are involved in handling form submissions:

  • Supabase — hosts the database where inquiries and beta signups are stored.
  • Resend — delivers the notification and confirmation emails.
  • Cloudflare Turnstile — runs the security check that distinguishes people from automated submissions.

Two further providers measure how the website is used:

  • Google Analytics — reports which pages are visited and how visitors arrive. It runs only after you accept analytics, and sets no cookies before that. See section 08.
  • Vercel — hosts this website, and its Analytics and Speed Insights report page views and loading performance.

Each provider receives only what it needs for the function described above, and each operates under its own privacy terms.

07 — Security

Security and abuse prevention.

Both forms are rate limited so a single source cannot submit repeatedly in a short period. To do this without keeping your network address, the server converts your address into an irreversible identifier using a secret key, and stores only that identifier. Your raw network address is not written to the inquiry, beta signup, or rate-limit records.

The security check works differently: to verify it, the server sends the check's one-time token and your network address to Cloudflare. We are telling you this because that address does leave our server for verification, even though we never store it. The token is used once and is not stored by us.

Each form also contains a hidden field that people never see. A submission that fills it in is treated as automated and is quietly discarded rather than stored.

When something fails, our error logs record operational details such as which step failed and the provider's error code. They are not used to record the contents of your submission, and email addresses are filtered out of provider diagnostics before logging.

The database tables holding inquiries and beta signups are not readable from the browser. Access is denied to public and visitor roles and granted only to the server, and the rate-limit records are reachable only through a restricted database function rather than directly.

08 — Cookies

Cookies and similar technologies.

NEXFORA Digital Innovation uses Google Analytics to understand how this website is used — which pages are visited, how visitors arrive, the general device and browser in use, and approximate location. This is reported to us as aggregate patterns rather than as a named person.

Google Analytics is switched off until you allow it. On your first visit a banner asks whether to accept analytics, and until you choose Accept, Google Analytics stores no cookies and cannot recognise you across visits. Choosing Decline keeps it off. Your choice is remembered in your own browser's local storage — it records only the choice itself, and it is not an advertising identifier. Clearing your browser storage makes the banner appear again.

Advertising and remarketing signals are switched off permanently and are not affected by your choice. We do not use this website for advertising, and we do not sell what analytics reports. Form events report only the service slug, source path, CTA location, and a coarse error type where relevant; names, contact details, and message content are not sent to analytics. We do not run a social media tracking pixel or a tag manager.

Vercel Web Analytics and Vercel Speed Insights are separate from Google Analytics and are not controlled by the analytics banner. They report page views and loading performance for the site as a whole. Their data handling is described in Vercel's own privacy terms.

You can opt out of Google Analytics with Google's browser opt-out add-on, or by blocking cookies in your browser settings.

Cloudflare Turnstile is used on the submission forms for security and abuse prevention. Turnstile is a third-party service and may use browser storage or related technologies as part of its security operation. That behavior is controlled by Cloudflare rather than by us.

09 — Retention

How long we keep information.

NEXFORA Digital Innovation generally retains project inquiry information for up to 12 months after the last meaningful communication relating to the inquiry.

NEXFORA Digital Innovation generally retains SmartCard beta application information for up to 12 months after the last meaningful beta-related communication.

If an inquiry becomes an active client engagement, or a beta applicant becomes an active SmartCard user or customer, the information needed for that active relationship may be handled separately as part of that business relationship rather than under the limits above.

To be clear about how this works in practice: the 12-month limit is an operational retention policy that we apply and act on manually. Stored submissions are not removed by an automatic scheduled deletion job. The short-lived security records described in section 07 are the exception, as each one expires automatically once its window has passed.

10 — Your requests

Privacy requests and contact.

You may contact us to:

  • ask for access to the personal information you submitted
  • ask us to correct information that is inaccurate
  • ask us to delete information, where appropriate
  • ask a question about how your information is handled

For privacy-related questions or requests, contact NEXFORA Digital Innovation through the business contact information provided on our Contact page.

We will ask for enough information to identify the relevant submission, then locate and act on it. Requests are handled manually, so we do not commit to a fixed response deadline, and deletion is not possible in every circumstance — for example where information forms part of an active engagement or must be kept for business records.