Privacy notice.

This notice covers the NEXFORA Digital Innovation website and the two forms that submit information to us: the Start a Project inquiry form and the SmartCard beta signup form. Both are live, and both store what you submit.

It does not cover work carried out under a separate written agreement with a client, or any third-party website reached through a link here.

We use what you submit to:

• receive and review your inquiry or beta signup
• reply using the contact details you supplied
• send you a confirmation that we received your submission
• protect the forms from spam and automated abuse

We do not sell your information, and we do not use it for advertising or automated decision-making. Submitting a form does not by itself create a client relationship, and we do not promise a reply within any particular timeframe.

The form asks for your full name, email address, business or profession, the SmartCard type you are interested in, how you plan to use it, and your preferred contact method. A phone number and a website or social profile are optional, except that a phone number is required if you choose phone as your preferred contact method.

Accepted signups are stored in our Supabase database with the consent record, the timestamp, and a note that the record came from the SmartCard beta form. Resend then sends a notification to NEXFORA Digital Innovation and a confirmation to you.

If you submit twice with the same email address, we keep the existing record rather than creating a duplicate. A signup records your interest only: it does not confirm selection for the beta, guarantee access or a card, or set pricing or a release date.

Both forms are rate limited so a single source cannot submit repeatedly in a short period. To do this without keeping your network address, the server converts your address into an irreversible identifier using a secret key, and stores only that identifier. Your raw network address is not written to the inquiry, beta signup, or rate-limit records.

The security check works differently: to verify it, the server sends the check's one-time token and your network address to Cloudflare. We are telling you this because that address does leave our server for verification, even though we never store it. The token is used once and is not stored by us.

Each form also contains a hidden field that people never see. A submission that fills it in is treated as automated and is quietly discarded rather than stored.

When something fails, our error logs record operational details such as which step failed and the provider's error code. They are not used to record the contents of your submission, and email addresses are filtered out of provider diagnostics before logging.

The database tables holding inquiries and beta signups are not readable from the browser. Access is denied to public and visitor roles and granted only to the server, and the rate-limit records are reachable only through a restricted database function rather than directly.

NEXFORA Digital Innovation generally retains project inquiry information for up to 12 months after the last meaningful communication relating to the inquiry.

NEXFORA Digital Innovation generally retains SmartCard beta application information for up to 12 months after the last meaningful beta-related communication.

If an inquiry becomes an active client engagement, or a beta applicant becomes an active SmartCard user or customer, the information needed for that active relationship may be handled separately as part of that business relationship rather than under the limits above.

To be clear about how this works in practice: the 12-month limit is an operational retention policy that we apply and act on manually. Stored submissions are not removed by an automatic scheduled deletion job. The short-lived security records described in section 07 are the exception, as each one expires automatically once its window has passed.