Privacy policy

Who publishes this site

Naborio is published from Alberta, Canada by Paulo Araujo, who is the controller for the purposes of the GDPR and the person responsible for the protection of personal information for the purposes of Quebec's Law 25. He can be reached at contact@naborio.com. No representative has been appointed under GDPR Article 27, because this site offers no goods or services for payment and monitors no behaviour: it processes only the delivery and security logs its host generates and, where a visitor allows it, an analytics or advertising cookie.

Naborio is the publisher. Each guide is titled Live in followed by the place it describes. There are no accounts, no login, no newsletter and no contact form on this site, so there is nothing to sign up to and no profile held about you.

Why any of this is allowed, and where it goes

Analytics and advertising run on your consent and on nothing else: you give it through the controls described below, and you can withdraw it at any time. Delivery and security logs run on legitimate interest, because a page cannot be served or a site kept up without processing the request that asked for it.

Both of the companies involved operate outside Canada and outside the European Economic Area. Cloudflare and Google process data in the United States and elsewhere, under their own transfer mechanisms, which are the contractual clauses and framework certifications each of them publishes.

Before relying on either provider, their published data protection terms, sub-processor lists and transfer mechanisms were reviewed against the protection Quebec's Act requires, which is the assessment section 17 calls for. Neither provider receives anything from this site beyond the request itself, and neither is given any information a reader has typed.

Cloudflare and request logs

Cloudflare and the hosting infrastructure process standard request information needed to deliver, cache and protect the site. That can include your IP address, browser and device information, the URL you asked for, the time of the request and security signals. Naborio does not export them, does not join them to anything else and does not use them to identify individual readers.

Cloudflare retains edge request logs for a limited period set by its own service terms, currently measured in days rather than months for the plan this site runs on, and Naborio has no access to them and no copy of them. The consent cookie, if one is ever set, lasts 180 days. Correspondence sent to contact@naborio.com is kept only until the question is answered and any resulting correction is published, and no longer than 24 months.

Cookies this site sets

Naborio sets one cookie of its own. It is named li_consent, it is created only after you answer the privacy question at the bottom of the page, and it holds your answer, the date you gave it and the version of this policy it was given against. It lasts 180 days, after which the question is asked again.

Cloudflare, which serves the site, writes one more before you answer anything. Its bot check runs on the first page you open and sets cf_clearance, which records that the check was passed so it does not run again. Cloudflare lists it as strictly necessary, and it lasts a year. Nothing else on this site writes a cookie until you allow it.

The full table, including what a granted choice would add, is on the cookie policy.

Children

This site is written for adults making housing decisions. It is not directed at children, it asks no visitor for their age, and it knowingly collects nothing from anyone under 16. If advertising is enabled it will not be configured for child-directed treatment, because no part of this site is child-directed. If you believe a child has sent personal information to contact@naborio.com, write to that address and it will be deleted.

Analytics

Cloudflare Web Analytics runs on every page. It is not part of this site's own code: Cloudflare adds the script to each page as it serves it, from the account the site is hosted on, and Cloudflare processes what it collects on this site's behalf. Cloudflare's documentation states that the script measures performance through the browser's Performance API and reports visits, page views, page load time and Core Web Vitals; that it does not store or read cookies, local storage, session storage or IndexedDB; and that it does not collect visitors' personal data or track them across sites. Because it writes nothing to your browser there is nothing to switch off in the controls below. Cloudflare describes it at Cloudflare Web Analytics.

Google Analytics is not configured on this deployment. No Google measurement tag is in the pages you are reading and nothing is sent to Google. If one is added, this policy is updated before the code ships and it is off until you allow it.

Advertising

No advertising runs on this site today. There is no ad code in these pages and no ad request is made. If that changes, this policy is updated before the code ships, and what follows describes what will happen. The only planned advertising network is Google, through AdSense, and if another network is ever added it is named here first.

When advertising is enabled, third-party vendors including Google use cookies, web beacons, IP addresses or other identifiers to serve, limit, personalize and measure advertising. Google's use of advertising cookies enables Google and its partners to serve ads based on a visitor's activity on this site or other sites. Third-party vendors may place or read cookies in a visitor's browser as a result of ad serving, including cookies on Google's own domains such as doubleclick.net, and first-party cookies on this domain such as __gads and __gpi, which cap how often an advertisement is shown and detect invalid traffic.

Learn how Google uses information from sites that use its services. You can opt out of personalized advertising in Google's Ads Settings, and opt out of other vendors' use of cookies for personalized advertising at WebChoices.

Your choices

Neither analytics nor advertising is configured in this deployment, so there is nothing to consent to, no privacy question is shown and no consent control appears in the footer. The controls described here appear the moment either one is turned on.

When that happens, a bar at the bottom of the page on your first visit will be where the choice is made. It will have three categories: Necessary, which is the consent cookie itself and cannot be switched off; Analytics; and Advertising. Nothing outside Necessary will load until you allow it, and leaving the bar without answering will leave everything off. A Your Privacy Choices link in the footer of every page will reopen the same controls, and switching analytics off will remove the analytics cookies and reload the page.

In the European Economic Area, the United Kingdom, Switzerland and some United States states, the advertising choice will be presented instead by Google's own consent management platform, because Google requires a platform it has certified before personalized ads can be served in those places. Where that message appears it will be the one that decides what advertising does.

Do Not Sell or Share My Personal Information

Some United States state laws treat showing a personalized advertisement as sharing personal information, and give you the right to opt out of it. Setting Advertising to off in the privacy controls is that opt out on this site, and where Google's own message is shown instead, its opt out does the same thing. No advertising is configured on this deployment, so there is nothing to opt out of yet and the controls appear with it.

If your browser sends a Global Privacy Control signal, Naborio reads it and treats Advertising as off, on every page, whatever was chosen before. The control is shown as off and cannot be turned on while the signal is present. Google states that it receives the signal directly and switches to restricted data processing for the applicable states. Where Google's own consent message is shown, that is the mechanism in force: this site stops sending its own advertising signal there so that a stored answer from an earlier visit cannot overwrite what Google's message decided.

Global Privacy Control does not switch analytics off by itself. It is an opt out of sale and sharing, and reading it as a refusal of first-party page counting would be reading more into it than it says. Your stored analytics answer stands, and you can change it at any time.

Your rights

Depending on where you live you have the right to ask what is held about you, to have it corrected or deleted, to object to a use of it, to withdraw a consent you gave, to receive what you provided in a structured, commonly used and machine-readable format or have it transmitted to someone else, and to complain to a supervisory authority. The route for all of them is contact@naborio.com.

You can also complain to a supervisory authority. In the European Economic Area that is the authority for the country you live in, listed at edpb.europa.eu; in the United Kingdom it is the Information Commissioner's Office at ico.org.uk; in Canada it is the Office of the Privacy Commissioner at priv.gc.ca; in Quebec it is the Commission d'acces a l'information at cai.gouv.qc.ca; and in Alberta it is the Office of the Information and Privacy Commissioner at oipc.ab.ca. You do not have to contact this site first.

Those rights are shaped by the General Data Protection Regulation, and the same requests are answered under Canada's PIPEDA, Alberta's Personal Information Protection Act and Quebec's Law 25, whichever of them applies where you are. The publisher is in Alberta and the readers are not, so the answer is to work to whichever standard is higher rather than to argue about which one binds.

Worth saying plainly: there is very little to exercise them against. No account, no profile, no mailing list, no record that connects one page view to another. In almost every case the honest answer to "what do you hold about me" is the email you just sent.

For readers in California

The only categories of personal information this site processes are identifiers, meaning your IP address, and internet activity, meaning the page you asked for and your browser and device information. They come from your own browser and from nowhere else. They are used to deliver and secure the page, and where you allow it to count page views and to serve advertising. They are available to Cloudflare, which serves the site, and to Google, if and when analytics or advertising is enabled. Naborio does not sell personal information and has never sold it. No sensitive personal information is collected, so there is nothing to limit the use of.

External links

Links to government sources, photography sites and other external services are governed by those services' own privacy practices. Following an external link leaves this site.

Retention, contact and changes

Naborio keeps correspondence only as long as it takes to answer it, document a correction or meet an applicable obligation. Privacy questions and requests can be sent through the contact page or directly to contact@naborio.com.

Advertising preferences stored by Google or another provider are held under that provider's own retention practices and changed through the controls that provider offers.

This policy has a version number, currently 1. Changes are made by editing this page and moving the date at the top of it. Material changes, meaning a new category of data, a new recipient or a new purpose, also raise the policy version, which invalidates any stored consent and asks the question again. Earlier versions are not archived; if you need to know what a specific version said, ask at contact@naborio.com.