Legal
Privacy Policy — Kove Studios
Version 1.0 · Effective August 2026
Kove Studios Inc. (“Kove,” “we,” “us,” “our”) is a corporation incorporated under the laws of Ontario, Canada, operating from Ottawa, Ontario. We design, build, host and manage websites for small businesses.
This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to kovestudios.com, to the enquiry and onboarding forms on it, and to the email we send you. Questions, requests and complaints go to privacy@kovestudios.com, and we respond within 30 days.
1. What this policy does not cover
If you are a customer of one of our clients — that is, you filled in a form on a website Kove built for another business — that business decides what happens to your information. We host and operate the site on their instructions and process that data on their behalf. Please contact that business first; their own privacy notice applies. We will forward any request we receive to them. This policy also does not cover third-party websites we link to.
2. Information we collect when you contact us
Our enquiry form collects your name and email address, which are required, and optionally your business name, type of business, the package you are interested in, your existing website address, what you would like to keep from your current site, your message or project description, and your brand colours, colour swatches and branding notes. We also record how you found us: the utm_source, utm_medium, utm_campaign, utm_term and utm_content values in the link you arrived through, the website that referred you, and the first page you landed on. Section 8 explains how that is stored in your browser.
3. Information we collect to stop spam and abuse
When you submit the enquiry form we separately record your IP address and email address, with a timestamp, in a rate-limiting log. We use this only to detect automated submissions and to limit how many messages a single sender can submit in a short window — currently five per IP address in ten minutes and three per email address in an hour. We do not use it to profile you or to track you across the web. Our form also uses a hidden field and a submission-timing check to identify bots; neither collects information about you.
4. Information we collect when you become a client
After you pay, we send you an onboarding questionnaire. It collects your primary contact name, phone number, domain name and registrar situation, the pages you want, what content you already have, notes about your content, your brand direction, example sites you like, the features you need, and your target launch date, plus anything else you choose to tell us. We also keep a record of the project itself: your account, the websites and mockups we build for you, notes on our conversations, your subscription status, and a log of the emails we have sent you.
5. Payment information
Payments are processed by Stripe. Your card number never reaches our servers and we never store it. We receive from Stripe only what we need to run your account: whether a payment succeeded or failed, the amount, the plan, and your subscription status. Stripe's own privacy policy governs the card data itself and is available at stripe.com/privacy.
6. Businesses we research for outreach
Kove maintains a separate database of businesses we may approach about our services. It is not built from website visitors. Business listings come from Google's Places API, and where we hold an email address or Instagram handle, a person at Kove has copied it by hand from a listing or website the business publishes itself — we do not scrape or harvest contact details. For each business we may hold the business name, address, public phone number, website address, Google rating and review count, business category, technical measurements of their website such as whether it loads, whether it has a valid certificate and whether it works on mobile, a publicly listed email address or Instagram handle, and a draft outreach message. Where this identifies an individual, such as a sole proprietor, it is personal information and this policy applies to it. If you have received a message from us and want your details removed, email privacy@kovestudios.com and we will delete the record and add you to our do-not-contact list.
7. Information we do not collect
To be explicit: we do not run Google Analytics, advertising pixels, Meta or Facebook trackers, session recording, heat-mapping, or any third-party analytics on kovestudios.com. We do not buy personal information from data brokers. We do not sell or rent your information to anyone, and we do not use it for cross-context behavioural advertising.
8. Cookies, local storage and tracking
kovestudios.com uses no tracking cookies, no advertising cookies and no third-party analytics. There is no cookie banner because there is nothing to consent to for advertising or analytics purposes. We use your browser's local storage for two things. The first, kove_attrib_v1, stores the campaign parameters, referring website and landing page from your first visit, so that if you fill in the enquiry form later we know which campaign or referral brought you; it stays until you clear your browser storage, and the values are transmitted to us only if and when you actually submit the form. The second is a Supabase sign-in token, set only when Kove staff sign in to the admin area and never for ordinary visitors. You can block or clear local storage at any time and the site works normally either way. Two third parties are contacted by your browser: our pages load fonts from Google Fonts, so Google receives your IP address, and Stripe sets its own cookies on its checkout pages when you pay. Cloudflare, which serves the site, may set a security cookie to distinguish visitors from bots.
9. Why we use your information
We collect personal information only for purposes a reasonable person would consider appropriate in the circumstances, as Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) requires. We use it to reply to your enquiry and prepare a mockup, on the basis of the consent you give by submitting the form; to deliver, host and support your website, and to process payments and manage your subscription, to perform our contract with you; to send service and account emails; to send follow-up email about an enquiry you started, on the basis of implied consent under Canada's anti-spam law; to prevent spam, fraud and abuse of our forms, and to approach businesses about our services, on the basis of our legitimate interests; and to keep records the law requires us to keep. Where the EU or UK GDPR applies to you, “legitimate interests” means we have weighed our interest in running the business against your privacy rights, and you have the right to object.
10. Who we share it with
We do not sell your personal information. We share it only with the service providers we need to operate, each bound to protect it and to use it only for the services they provide to us: Supabase, via Lovable Cloud, for our database and back-end; Lovable, the platform that hosts and deploys our application; Cloudflare, which serves the website and routes requests; Stripe, for payment processing and subscriptions; Resend, which delivers our email; Google, for the Places API business data and for web fonts; and Anthropic, which generates draft text for our outreach messages from the business information described in section 6. We may also disclose personal information where the law requires it, to establish or defend a legal claim, or to a purchaser if the business is sold, in which case it stays subject to a policy no less protective than this one.
11. Information stored outside Canada
Our providers store and process personal information in the United States. This means it may be accessible to United States courts, law enforcement and national security authorities under the laws of that country, and those laws differ from Canada's. By using the site and our services you acknowledge this transfer. Under PIPEDA we remain accountable for your information while it is in our providers' hands, and we rely on contractual protections, including the standard contractual clauses our providers offer where the GDPR applies.
12. Email and unsubscribing
If you submit an enquiry, we may send you a confirmation, and if we do not hear back we may send up to two follow-up emails. If we have shared a mockup with you and you have not responded, we may send up to two reminders. Clients also receive account, onboarding and project emails, which are part of the service and are not marketing. We will not send you marketing email unrelated to an enquiry you made or a service you bought. You can unsubscribe from any non-essential email at any time using the unsubscribe link, your mail app's one-click unsubscribe, by replying and asking, or by emailing privacy@kovestudios.com. Unsubscribing adds your address to a suppression list checked before any message is sent, so it takes effect immediately and permanently. We will still send you essential messages about an active account, such as a receipt, a service notice or a security alert.
13. Commercial messages under CASL
Canada's Anti-Spam Legislation governs commercial electronic messages. When we contact a business that has not asked to hear from us, we rely on implied consent — either because the business has conspicuously published the address without indicating that it does not want unsolicited messages and our message is relevant to its business, or because of an existing business relationship. Every such message identifies us by name, business name, mailing address and email address, and gives you a way to opt out. We honour opt-outs promptly and in any case within the ten business days the law allows.
14. How long we keep it
We keep personal information only as long as necessary for the purposes described in this policy, or as long as the law requires us to keep it. Payment, billing and tax records are kept for the periods Canadian tax law requires. Records of an unsubscribe are kept indefinitely, because we need them to keep honouring your request. When information is no longer needed we delete it or irreversibly anonymise it. You can ask us at any time what we still hold about you.
15. Your rights and choices
You can ask us to give you access to the personal information we hold about you and tell you how we have used it and who we have disclosed it to; to correct anything inaccurate or incomplete; to delete your information where we are not required to keep it; and to stop emailing you. You can withdraw your consent at any time, subject to legal and contractual restrictions, and we will tell you the consequences before you do. To exercise any of these, email privacy@kovestudios.com. We will verify your identity first, usually by confirming you control the email address on the record. There is no charge. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.
16. If the GDPR or California law applies to you
If you are in the EU or the UK, you also have the right to a portable copy of the information you gave us, to restrict how we use it, and to object to processing based on our legitimate interests, including our follow-up emails and our outreach. You have the right to complain to your national data protection authority. If you are a California resident, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA and CPRA.
17. How we protect it
We use safeguards appropriate to the sensitivity of the information. These include encryption in transit across the whole site and at rest with our database provider; row-level security so records are reachable only by authorised accounts; access limited to those who need it; secrets held in a managed secret store rather than in code; rate limiting and bot detection on public forms; and payment card data handled entirely by Stripe, a PCI-DSS Level 1 provider, so it never touches our systems. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we keep records of breaches for 24 months.
18. Children
Our services are for businesses. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email privacy@kovestudios.com and we will delete it.
19. Automated decision-making
We do not make decisions with legal or similarly significant effects about you using automated processing alone. We do use automation to score the websites of businesses in our research database and to draft outreach text, but a person reviews and sends every message.
20. Changes to this policy
If we change this policy we will update the version and effective date shown above. Where a change materially affects how we use information you have already given us, we will tell you by email or by a notice on the site before it takes effect.
21. Contact
Kove Studios Inc., Ottawa, Ontario, Canada. For any privacy question, request or complaint, email privacy@kovestudios.com.