Tessvo
Privacy Policy
Effective: August 13, 2026 · All Spark Enterprises Ltd.
1. Introduction
All Spark Enterprises Ltd. (“we”, “us”, or “our”) operates Tessvo at https://tessvo.com (the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Canadian Anti-Spam Legislation (CASL), and applicable provincial privacy law.
By using the Service, you consent to the practices described in this Policy.
2. Who We Are
All Spark Enterprises Ltd.
Devlin, Ontario, Canada
Privacy contact: support@tessvo.com
3. Applicable Privacy Legislation
- Federal — PIPEDA: applies in all provinces without substantially similar legislation.
- Quebec — Law 25: stricter than PIPEDA. Requires mandatory PIAs for cross-border transfers, 72-hour breach notification to the CAI, and expanded individual rights (portability, de-indexing, automated decision review). Quebec residents have these additional rights.
- British Columbia — BC PIPA: applies to private-sector organizations in BC.
- Alberta — Alberta PIPA: applies to private-sector organizations in Alberta.
- Ontario — PHIPA: governs personal health information only. Tessvo does not collect health information; PHIPA does not apply.
We apply the highest applicable standard across all provinces we serve.
4. Information We Collect
4.1 Information You Provide
- Account registration: name, email address, password (hashed — never stored in plain text)
- Business profile: company name, industry, province of operation
- Payment information: billing details processed by Stripe Inc. (we do not store card numbers)
- Business plan content: text, data, and documents you input to generate plans
- Support communications: messages and inquiries sent to our team
4.2 Information Collected Automatically
- Session cookies: authentication tokens issued by Supabase
- Usage data: pages visited, features used, session duration, timestamps
- Device information: browser type, operating system, IP address, referring URL
- Server logs: retained for security and debugging
4.3 Cookies
We use first-party session cookies (Supabase auth tokens) for authentication, and may use optional analytics cookies. See our Cookie Policy for details and opt-out instructions.
5. How We Use Your Information
- To create, manage, and secure your account
- To generate AI-assisted business plans based on your inputs
- To process client payments and issue receipts (Stripe)
- To send transactional emails (account confirmation, receipts, security alerts) via SendGrid — exempt from CASL opt-out requirements
- To send commercial electronic messages (promotions, newsletters) only with your express or implied consent under CASL — see Section 6
- To detect fraud, abuse, and unauthorized access
- To improve the Service using anonymized, aggregated analytics
- To comply with Canadian tax law, PIPEDA, and CASL
6. CASL — Commercial Electronic Messages
- Express consent: we obtain and record your consent before sending promotional emails.
- Implied consent: we may send CEMs without express consent where CASL permits (e.g., existing business relationship within the past 2 years).
- Unsubscribe: every commercial email includes a functioning unsubscribe mechanism processed within 10 business days.
- Transactional messages (verification, password reset, receipts, security alerts) are not CEMs and are sent regardless of marketing consent.
- We do not harvest email addresses by automated means or purchase email lists.
7. Third-Party Service Providers
- Supabase Inc. — authentication and database hosting (US/EU)
- Stripe Inc. — inbound payment processing (PCI-DSS Level 1; US)
- Twilio SendGrid — transactional and commercial email delivery (US)
- Vercel Inc. — web application hosting and cookieless analytics (US)
- Railway Corp. — backend API hosting (US)
- Anthropic PBC and OpenAI — AI processing of the plan content you submit, used solely to generate your documents (US)
- Microsoft Corp. — Clarity analytics, only if you consent to analytics cookies (US)
Plan content you submit is sent to our AI providers to generate your documents. These providers process it under their commercial terms and do not use it to train their models.
We do not sell, rent, or trade your personal information for marketing purposes.
8. Cross-Border Data Transfers
Our service providers are primarily US-based. Personal information they process is protected through their published data protection terms, industry certifications (SOC 2 / PCI-DSS where applicable), and encryption in transit and at rest.
Quebec Residents — Law 25
Personal information is processed outside Quebec, including in the United States. Because all Service infrastructure is US-hosted, restricting cross-border transfer would prevent use of the Service. Contact us with any questions about how your information is protected in transit.
9. Data Retention
- Account data: duration of account + 3 years after closure
- Business plan content: until deleted or account closed
- Payment records: 7 years (CRA / Income Tax Act)
- CASL consent records: 3 years after withdrawal or end of relationship
- Security breach logs: 24 months (PIPEDA Security Breach Regulations SOR/2018-64)
- Server logs: 90 days
10. Security Breach Notification
Under PIPEDA Security Breach Regulations (SOR/2018-64) we are required to notify the OPC of any breach posing a real risk of significant harm, notify affected individuals, and maintain a breach log for 24 months.
Quebec residents: the CAI must be notified within 72 hours of a breach likely to cause serious injury (Law 25).
Suspected breach? Contact us immediately at support@tessvo.com.
11. Your Privacy Rights
Under PIPEDA you have the right to access, correct, delete your personal information, and withdraw consent. We respond within 30 days.
Additional Rights for Quebec Residents (Law 25)
- Data portability: receive your data in a structured, technology-based format
- De-indexing: request removal of information that may harm your reputation
- Automated decision review: request human review of automated decisions
Contact support@tessvo.com to exercise any right, or file a complaint with the Office of the Privacy Commissioner of Canada.
12. Children
The Service is not directed to individuals under 18. We do not knowingly collect personal information from minors.
13. Changes to This Policy
We will notify you of material changes by email and by posting an updated Policy with a revised effective date. Continued use constitutes acceptance.
14. Contact
All Spark Enterprises Ltd.
Devlin, Ontario, Canada
OPC: www.priv.gc.ca | 1-800-282-1376