Privacy notice

What we collect, and only when you send it

This site does not use advertising, analytics, tracking pixels, or profiling. It sets no cookies. Simply reading the site does not send us a form record; hosting providers may process ordinary request logs.

We collect personal information in one place only: the enquiry form. When you submit it, we receive the fields you filled in, and our server additionally records the network address the submission came from and the time it arrived. The fields are:

• Your name (up to 100 characters)
• Your work email address (up to 254 characters)
• Your company (up to 100 characters)
• What you would like to create (up to 2,000 characters)
• The enquiry type, which this form always records as a partnership enquiry

We use that network address to detect and limit automated abuse of the form, not to identify or profile you.

Please do not send us skin images, health or medical information, or anything confidential through this form. The form is a first point of contact, not a secure channel, and the page says so above the fields.

Why we collect it

We use what you send for one purpose: to read your enquiry and respond to it, including any follow-up correspondence that enquiry leads to.

• We do not sell personal information.
• We do not share it for advertising or marketing by anyone else.
• We do not use it to build a profile of you.
• We do not use it to train machine-learning models.

Bot protection

To keep the form usable, we use Cloudflare Turnstile, a bot check. It loads only when you first interact with the form, not when you open the page, and it runs in your browser. Cloudflare receives technical signals from your browser and device in order to decide whether the submission is automated. Cloudflare processes those signals under its own terms as a service provider to us.

If you do not interact with the form, Turnstile never loads and Cloudflare receives nothing.

Where it is stored, and who can reach it

Submissions are sent over HTTPS to our contact interface and stored in Amazon Web Services in the Canada (Central) region. That storage location does not by itself establish that all provider processing, support access or email handling stays in Canada.

Access is restricted to authorized people handling enquiries. Amazon Web Services provides hosting and storage, and Cloudflare provides the bot check. Their processing is governed by their applicable service terms and our agreements.

As with any website, our hosting and content-delivery providers may keep their own operational request logs, which are controlled by them under their own terms.

How long we keep it

We mark enquiry records to expire 90 days after receipt. DynamoDB removes expired records asynchronously, so removal from the underlying table may occur later. Expired records are excluded from the active admin inbox. Backups, recovery copies and operational logs can have separate retention periods.

If your enquiry turns into ongoing correspondence or a business relationship, the resulting email and records are kept for as long as that relationship needs, and then for any period the law requires us to retain business records.

Your choices and your rights

Under Canadian federal privacy law (PIPEDA), you may ask us what personal information we hold about you, ask us to correct it if it is wrong, and withdraw consent to our holding it, subject to legal or contractual limits, which we will explain if any apply.

To make any of those requests, email hello@baolaboratory.ai. We will verify your identity as needed. For an access request under PIPEDA, we will respond within 30 calendar days or notify you of a permitted extension. Please tell us enough to find your record: normally the email address you used, and roughly when you wrote.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Children

This site is directed at businesses and is not intended for children. We do not knowingly collect personal information from children. If you believe a child has sent us information, email us and we will delete it.

Security

Submissions travel over HTTPS. The site enforces a Content Security Policy and a strict set of security headers, sets no cookies, and loads no third-party code except the bot check described above. Storage is access-controlled and records expire automatically.

No system is perfectly secure. We do not ask for, and you should not send us, passwords, payment details, government identifiers, or health information.

Changes to this notice

If we change what we collect or why, we will change this page and update the effective date below. Material changes will be described at the top of the page.

Contact

Questions about this notice, or a request about personal information we hold: hello@baolaboratory.ai.

You can also write to us at BAO Life Brand Inc., 2750 14th Ave, Unit G08, Markham, ON L3R 0B6, Canada.

BAO Life Brand Inc. is incorporated in Ontario, Canada.