Legal
Privacy policy.
Plain-language summary of how Virtual Zero Unbound Inc. ("VZU", "we", "us") handles your data under PIPEDA (Canada), GDPR (EU/UK), CCPA (US-CA), and LGPD (Brazil). Effective 27 July 2026. Last updated 27 July 2026. Version 1.0.
01 Who we are
Virtual Zero Unbound Inc. ("VZU", "we", "us") is a Canadian company headquartered in Vancouver, BC, with regional operations in Dubai (UAE) and Mumbai (India). VZU is the flagship brand domain of AdaptUs Group Inc. Our legal entity details, including our Data Protection Officer, are listed at the bottom of this page.
02 What data we collect
We collect three categories: (1) data you give us — your name, email, organization, and the contents of any brief or form you submit; (2) data from your use of the site — IP address, browser, device class, pages visited, and timestamps; (3) data from our communications — email open/click metadata when you receive our briefings. We do not collect data we do not need. We do not sell data. We do not share data with ad networks.
03 Why we collect it (the legal basis)
Under GDPR Article 6, our legal bases are: (a) consent — for analytics, marketing, and AEO/AI-crawler signals; (b) contract — for engaging with you on a brief or delivering a service; (c) legitimate interest — for security, fraud prevention, and basic service operation; (d) legal obligation — for tax, accounting, and anti-money-laundering records we are required to keep.
04 How long we keep it
Inquiry data: 24 months. Customer data: 7 years (the standard accounting retention period in Canada). Analytics data: 13 months. Logs: 90 days. We delete data on request unless we have a legal obligation to retain it. Deletion happens within 30 days.
05 Where the data lives
Primary storage is in Canada (Toronto region, via Cloudflare R2 + Workers + Pages). The ME Research product (me-hub.netwit.pages.dev) is hosted on Cloudflare Pages globally. AI inference for VZU OS is regional: Canada/EU/US, your pick. We do not transfer data outside the jurisdictions you select without explicit notice.
06 Your rights
Under GDPR (EU/UK residents), CCPA (US-CA residents), PIPEDA (Canadian residents), and LGPD (Brazilian residents), you have the right to: access, correct, delete, port, restrict, object to processing, withdraw consent, and lodge a complaint with your supervisory authority. Exercising any of these is free. We respond within 30 days. To exercise, email privacy@netwit.ca or use the form at /contact/.
07 Sub-processors
We use a small set of trusted sub-processors. The current list is published at /sub-processors/ and updated within 7 days of any change. Major sub-processors today: Cloudflare (hosting, CDN, edge compute), Resend (transactional email), Anthropic / OpenAI (AI inference, no training on your data by default), Linear (customer support ticketing).
08 Children
VZU is a B2B product. The site is not directed at children under 16. We do not knowingly collect data from children. If we learn we have, we delete it within 7 days.
09 Security
We enforce TLS 1.3+ on every endpoint, RBAC at the agent level, audit trails by default, and SOC 2 / HIPAA / ISO 27001 controls. We do not claim certification; we claim the controls and the audit posture. Material security incidents are disclosed within 72 hours, with a clear summary, scope, and remediation timeline.
10 Changes to this policy
Material changes are versioned. Each version is dated and archived. Non-material changes (typos, formatting) are made silently. You can see all past versions at /privacy/changelog/.
11 Contact
Data Protection Officer: privacy@netwit.ca. Postal: Virtual Zero Unbound Inc., 1055 W Hastings St, Vancouver, BC V6E 2E9, Canada. EU representative: appointed on request. UK representative: appointed on request. Brazilian representative (DPD): appointed on request.
Previous versions of this policy are archived at /privacy/changelog/. This policy is licensed under CC BY 4.0. Adapt it for your own use.