Privacy Policy

Effective October 21, 2026.

Introduction

Welcome to EvolveDash's privacy policy. EvolveDash respects your privacy and is committed to protecting your personal data. This privacy policy will inform you of how we collect, use, and protect your personal information when you visit our website or use our services. While EvolveDash is based in Canada and the United States, our operations are conducted in Pakistan and are subject to the laws and regulations of these countries.

This website is operated by EvolveDash (Montreal, Quebec, Canada, and the United States). When we build or run software for a client, the client's data is handled under our contract with that client, not under this policy.

Information We Collect

Email Addresses: We collect email addresses for the purpose of sending newsletters. You may opt out of receiving these newsletters at any time by using the unsubscribe link provided in the emails. With your address we keep a record of your consent: the wording you agreed to, the page, the language and the time, but not your IP address or browser.

Contact Form Information: When you use our contact form, we collect your name, work email, company and message, and the service area, budget range and timeline you choose, along with the page you sent it from and the time. This information is used solely for the purpose of responding to your inquiries and providing you with our services. Please do not send health information or other sensitive personal information through the form. When you send us a form, we record the IP address and country it came from, to protect the site against spam and abuse. We keep the IP address for one year and then erase it; the country stays with your message. To keep our forms free of spam and abuse, we use Cloudflare Turnstile, which checks in the background, without any action from you, that a form is sent by a person and not an automated program. To do this, Cloudflare processes your IP address and technical details of your browser. Cloudflare describes this in its Turnstile Privacy Addendum.

Careers: This website takes no job applications. Our careers page lists open roles and links to our hiring platform, Manatal, where you apply; Manatal's own privacy notice applies to what you send there.

Analytics, only if you agree: If you accept analytics in the cookie notice, our analytics provider records how the site is used: pages viewed, device and browser type, an approximate location derived from your IP address, and a random identifier stored in a cookie. Nothing is collected until you agree, and a Global Privacy Control signal from your browser counts as "no" unless you then accept in the cookie notice; if your browser starts sending it after you accepted, it counts as "no" again.

Server Logs: Like every website, our servers and our content delivery network see your IP address, the page you requested, the referring page and your browser type. We use these only to deliver the site, keep it secure and fix faults.

Use of Your Information

We use the information we collect for the following purposes:

• To send newsletters to email subscribers who have opted in to receive them (based on your consent).
• To respond to inquiries submitted through our contact form and provide our services to prospective clients (to take the steps you ask for before a contract, and in our legitimate interest in answering business inquiries).
• To communicate with you about updates or changes to our services, only if you subscribed to our emails (based on your consent).
• To keep the website secure and working (in our legitimate interest in running a secure website), and, only with your consent, to understand how it is used.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not make decisions about you by automated means alone.

Cookies

We use as few cookies as possible:

• csrftoken: Protects our forms from forgery. Necessary. Lasts 1 year.
• ed_consent: Remembers your cookie choice. Necessary. Lasts 12 months.
• Our analytics provider's cookies: To tell visits apart. Analytics, only with your consent. Lasts up to 2 years.

The cookie notice asks before any analytics cookie is set, offering three equal choices: "Accept all", "Reject all" and "Manage preferences". You can change your choice at any time with the "Cookie settings" link at the bottom of every page, and we ask again after 12 months. For 2.0 your choice is kept in your browser only. Staff who sign in to the site's administration also receive a session cookie; visitors never do.

Who Receives Your Information

We share personal information only with the providers we use to run the website and our business, each bound to use it only for us:

• Amazon Web Services (United States): Hosting the website and its database, and sending our emails.
• Cloudflare (Global network): Delivering the site and protecting it from attacks, including checking that our forms are sent by people (Turnstile Privacy Addendum).
• Google Workspace (United States and elsewhere): Our email, including notices of new inquiries.
• An analytics provider (United States): Usage statistics, only with your consent.
• Salesforce (United States): Managing client relationships, when we take an inquiry forward.

We may also disclose information when the law requires it, or to a buyer if our business is sold, in which case this policy continues to apply.

Data Security

We take the security of your personal information seriously and have implemented appropriate technical and organizational measures to protect it: encrypted connections, an encrypted database, strong passwords for our administration, and access limited to the people who need it. However, please note that no method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. If a breach puts your information at risk of serious harm, we will tell you and the authorities as the law requires.

Data Retention

We will retain your personal information only for as long as necessary to fulfill the purposes outlined in this privacy policy or as required by law. In practice:

• An inquiry marked as spam: 180 days.
• An inquiry we do not take forward: 12 months.
• An inquiry we take forward: Your name, email, company and message are removed from the website 90 days after it moves to our client-management system.
• The IP address a form came from: 1 year, then erased; the country stays with your message.
• Newsletter subscription: Until you unsubscribe; afterwards only a one-way code of your address, so we never email you again by mistake.
• Proof of newsletter consent: While you are subscribed, plus 3 years.
• Server and security logs: 14 to 30 days.
• Analytics data: 14 months.
• Backups: 7 days.

Your Rights

You have the right to:

• Access the personal information we hold about you.
• Rectify any inaccuracies in your personal information.
• Erase your personal information.
• Restrict or object to the processing of your personal information.
• Receive your personal information in a structured, commonly used, and machine-readable format.
• Withdraw your consent at any time, without affecting what we did before.

Residents of California and other US states with privacy laws also have the right to know what we collect and to opt out of its sale or sharing. We do not sell or share it, we honor Global Privacy Control as described under "Analytics, only if you agree", and we will not treat you differently for using any of these rights.

To exercise any of these rights, please contact us using the information provided below. We may need to confirm your identity, and we answer within 30 days. If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, your data protection authority in the European Union or the United Kingdom, or, in California, the California Privacy Protection Agency.

SMS and Text Messaging

If you provide your mobile phone number and consent to receive text messages, EvolveDash may send you SMS messages relating to your inquiry, scheduled calls, or ongoing projects. Consent to receive text messages is not a condition of any purchase or of using our services. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for assistance.

No mobile information will be shared or sold to third parties or affiliates for marketing or promotional purposes at any time. Mobile opt-in data and consent records are not shared with third parties for any purpose other than delivering the messages you requested.

Contact Us

If you have any questions or concerns about our privacy policy or the way we handle your personal information, please contact us at:

EvolveDash
privacy@evolvedash.com (or hello@evolvedash.com)

Our person in charge of the protection of personal information is our Privacy Officer, reachable at the same address.

Please note that while our headquarters are located in Canada, with a company in the United States, our operations and services are conducted in Pakistan, and our providers are mostly in the United States, so your information may be processed outside the province, state or country where you live. Before transferring personal information outside Quebec we assess whether it will be adequately protected, and for information from the European Union or the United Kingdom we use the safeguards the law provides, such as standard contractual clauses.

Children

This website is for businesses and is not directed to children; we do not knowingly collect personal information from anyone under 16.

Changes to This Privacy Policy

We reserve the right to update or change our privacy policy at any time. Any changes will be posted on this page with an updated effective date, and if a change materially affects information we already hold, we will tell you before it applies.