Security

This site provides information about byCarvalho Inc. It has no customer accounts, payment processing or file-upload feature. The enquiry form submits over HTTPS to a server-side function that validates the entry, applies basic abuse limits and passes it to our email delivery provider; the site keeps no enquiry database. Fonts and images are hosted with the website. Google Analytics, when active, measures visits as described in the Privacy Policy.

Please do not send passwords, payment-card details, identity documents, medical information or other sensitive records through the form or ordinary email. If a project requires confidential materials, contact hello@bycarvalho.com to agree on a suitable transfer method before sharing them. Do not assume email is end-to-end encrypted.

Email hello@bycarvalho.com with “Security concern” in the subject. Include the affected page, a concise description and reproduction steps that do not expose anyone’s personal information. Please avoid sending live credentials or unnecessary sensitive evidence. This page does not authorize access to other people’s information, disruptive testing or attempts to bypass access controls, and it is not a bug-bounty or safe-harbour commitment.

If a breach involving personal information under our control occurs, applicable law governs our assessment, recordkeeping and response. Under PIPEDA, breaches creating a real risk of significant harm must be reported to the Privacy Commissioner of Canada and notified to affected individuals as soon as feasible after that determination. Records of all breaches of security safeguards must be retained for at least 24 months after determining that a breach occurred.

Security depends on deployment, service providers and operational practices as well as website code. This page does not claim a security certification, completed penetration test, guaranteed uptime or absolute protection. Public hosting, HTTPS and provider controls must be verified before launch. For personal information questions, see the Privacy Policy.