Privacy Policy
How we handle your information.
In plain language: what we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.
Last updated — June 29, 2026
This policy applies to drivon.ca, the application process, and every Drivon engagement under Vallon Studios Limited. Drivon is a boutique protected-identity service. We collect what we need to do the work, hold it under the access controls described below, and delete or return it when the work is done.
If anything below is unclear or you want to exercise a right described in Section 06, email support@vallonstudios.com with subject line “Privacy.”
01 — What we collect
Information we receive directly from you
When you apply
The application form (hosted on Tally Forms) collects:
- Your name and the verified social channels you operate under
- A brief description of what’s happening or what you’re protecting against
- Your agent, manager, or legal representative’s verified contact, if applicable
- Any documentation you choose to share — screenshots, URLs, news links
- A contact email for our response
We do not ask for original photos, biometric data, government identification, or financial details at the application stage.
When you are accepted as a Protected Client
After acceptance, an engagement agreement is signed and the following may be collected as the case requires:
- Identity verification through Holanox — your verified LinkedIn profile, or a selfie with a short verification video (you say a phrase generated on the spot and perform a simple action, recorded plainly), used to establish that you are the person being protected
- A reference face for face-match operations, established at verification through Holanox — taken from your verified LinkedIn profile photo, or from the selfie you provide during verification
- Billing details processed by Stripe; we do not see or store your full payment card numbers
- Case correspondence — email, signed documents, screenshots and URLs you provide as the engagement progresses
When you visit drivon.ca
The website itself is static. We do not run analytics, advertising trackers, or third-party session recording. The only third-party assets the page loads are Google Fonts (CSS only, no JavaScript) and the Tally application form when you choose to apply. See Cookie Policy for the small set of cookies involved.
02 — What we generate
Information produced during a case
As part of monitoring under a Drivon engagement, we produce derived information about findings on third-party platforms. This may include:
- URLs and content metadata from the platforms scanned
- Operator handles, account names, and channel identifiers identified during monitoring
- Risk and monetization signals extracted from finding pages
- Face-match scores computed against your verified reference imagery
- Evidence captures — archived URLs, hashes, timestamps, and screenshots, preserved to a defensible evidentiary standard
- Takedown correspondence with platforms, registrars, hosting providers, and other parties
This information is kept in case files locked to your verified identity and accessible only to the founder and to authorized counsel you have referred us to.
03 — Why we collect it
Lawful basis and purpose
We collect and process information for these purposes only:
- Performance of the engagement agreement — detection, evidence capture, takedown coordination, monthly reporting
- Identity verification — confirming the person we are speaking with is the person we are engaged to protect
- Evidence preservation — producing documented records to a defensible evidentiary standard that can support takedown filings, FTC escalations, or civil litigation
- Application review — assessing whether we can serve a case before accepting it
- Billing and account administration
- Legal and regulatory compliance — including responses to lawful requests from courts and competent authorities
We do not use your information for marketing, do not sell it to third parties under any circumstances, and do not use it to train AI models.
04 — Who we share with
Third parties that touch your information
The following service providers process information on our behalf under written data processing agreements:
- Tally Forms — hosts the application forms. Receives application content directly when you submit. Tally privacy policy.
- Stripe — processes payments. Receives billing details when an engagement begins. Stripe privacy policy.
- Supabase — data platform hosting client records and case data. Hosted in the United States. Supabase privacy policy.
- Zoho Mail — transactional email for case correspondence and support routing. Zoho privacy policy.
- Internet Archive — evidence preservation. URLs and captures of public third-party content are archived to support takedown filings. We do not submit client identity or case file content.
- Secure infrastructure providers operated under EU and Canadian data residency for case-data processing. Specific providers are not disclosed publicly to reduce the attack surface for clients we protect.
We disclose information to plaintiff-side legal counsel only when you have referred us to that counsel and only to the extent needed to support your matter. We disclose information to law enforcement and courts only in response to lawful process or to prevent imminent harm.
We never sell, rent, or trade your information. We do not run advertising. We do not use case data to train AI models. We do not share findings with other clients, even when patterns suggest a common operator.
05 — How long we keep it
Retention periods
- Application data (declined or withdrawn applications) — retained for 90 days for fraud prevention and case-pattern analysis, then deleted
- Active case files — retained for the duration of the engagement
- Face-match reference embeddings — deleted within 90 days of engagement termination
- Evidence packages and case correspondence — retained for 7 years after engagement termination, in case of litigation arising from the matters documented
- Billing records — retained as required by Canadian tax law (currently 6 years)
- Website analytics — not collected
You can request earlier deletion of any category except billing and evidence package retention required by law or required to defend pending claims. See Section 06.
06 — Your rights
What you can ask us to do
Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA), you have the right to:
- Access the information we hold about you and request a copy in portable form
- Correct information that is inaccurate or incomplete
- Delete your information, subject to the retention exceptions in Section 05
- Restrict or object to specific processing activities
- Withdraw consent at any time, with the understanding that withdrawing consent during an active engagement terminates the engagement
- Lodge a complaint with a supervisory authority — the Office of the Privacy Commissioner of Canada, or the Office of the Information and Privacy Commissioner of Alberta
To exercise any of these rights, email support@vallonstudios.com with subject line “Privacy.” We respond within 30 days. We do not charge for these requests.
We may need to verify your identity through the same verified-channel process used at engagement onboarding, to prevent impersonation requests that would otherwise expose your case file to third parties.
07 — Security
How we protect it
Case data is processed and stored on secure infrastructure with the following controls:
- Encryption in transit — TLS 1.3 for all client-facing endpoints and inter-service communication
- Encryption at rest — full-disk encryption on storage holding case files
- Access control — case files locked to the verified identity of the client, accessible only to the founder and authorized counsel referred by the client
- Audit logging — access to case files is logged and reviewable
- Network isolation — infrastructure providers are not disclosed publicly to reduce reconnaissance surface against clients
We do not maintain a SOC 2 or ISO 27001 certification at this time. Drivon operates as a boutique service: the founder is personally accountable for security posture and case-file integrity. If your matter requires certified-environment processing, tell us at application and we will refer to a partner organization that holds those certifications.
08 — International transfers
Where your information is processed
Vallon Studios Limited is based in Alberta, Canada. The service providers listed in Section 04 process information in Canada, the European Union, and the United States. Where information moves between jurisdictions, we rely on:
- Canada’s adequacy decision under the EU General Data Protection Regulation for transfers between EU and Canadian processors
- Standard Contractual Clauses for transfers to US-based service providers
- Service-provider-specific safeguards documented in the data processing agreements with each party in Section 04
09 — Children
Age requirements
Drivon engagements are for adult women in public life and the agencies, federations, and legal counsel that represent them. We do not knowingly accept applications from individuals under 18. If a parent or guardian is engaging Drivon on behalf of a minor in an active synthetic-content matter, the engagement must be signed by the parent or guardian and the matter handled with additional safeguards. Email support@vallonstudios.com for those engagements.
10 — Changes
Updates to this policy
When this policy materially changes, we update the “Last updated” date above and, for active Protected Clients, notify by email. Continued use of Drivon after notification constitutes acceptance of the updated policy. Prior versions are available on request.
11 — Contact
Reach us
Privacy questions, requests to exercise rights, and concerns about how we have handled your information:
support@vallonstudios.com — subject line “Privacy.”
Postal address:
Vallon Studios Limited
Edmonton, Alberta, Canada