Privacy Policy & Cookie Notice

This notice applies to my personal website, mehnaztabassum.com, and its professional enquiries. “I” refers to Mehnaz Tabassum, the site privacy contact; “we” refers to the people responsible for operating this website. Privacy enquiries about this website should be addressed to Mehnaz Tabassum using the contact details below.

This website’s activities are subject to applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies to commercial activity, and relevant provincial laws. The applicable framework depends on the activity and jurisdiction. This notice and the consent controls are not a certification of compliance.

CogniCo, NL Eats and FOOD FORWARD operate independent websites and activities. This notice does not automatically cover them. Please review their own notices when you visit their websites.

If you contact me by email, you may provide your name, email address, organization, role, enquiry details and attachments. Email links open your own email application; your email service and the receiving email service process the message. The audited site has no site-hosted contact form, user accounts or payment collection. Please do not send sensitive personal details that are not needed for your enquiry.

“Book a Career Consultation” opens an external Calendly Career Consulting appointment, not an NL Eats or speaking appointment. Calendly may collect your name, email, appointment date and time, time zone and meeting details and share booking information with the organizer. Any payment requested for the consultation occurs through Calendly and its chosen payment processor, not this website. Review the booking page and Calendly’s notice before providing information.

An enquiry, booking or cookie choice does not subscribe you to a newsletter or authorize marketing email. LinkedIn newsletter subscriptions and Spotify or other external services have their own notices. If I later send direct commercial electronic messages, applicable CASL requirements include valid consent, sender identification and an unsubscribe mechanism; unsubscribe requests must be acted on within the applicable deadline.

The site is built and hosted through Lovable. Owner photographs, downloads and the founder film are delivered through the site’s /__l5e/assets-v1/ media paths; fonts are self-hosted. Hosting, asset delivery/CDN, security and troubleshooting services necessarily receive technical connection and request details, which may include an IP address, requested page, browser/device information, date and time, a referrer if sent, and errors. This does not mean I receive or retain every field.

Lovable’s visitor analytics is currently enabled for the published site, including click measurement. The editor preview is not counted. It uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors or recognize a returning visitor. It records pages visited, where visitors came from, country, browser, operating system and device type, time on page, page speed and errors.

On this website, optional click measurement is allowed only after you grant Optional analytics, everywhere, and never when your browser sends Global Privacy Control. Page visits, time on page, page speed and errors continue for every visitor without cookies and without identifying anyone. Detailed data is retained for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.

No Google Analytics, advertising pixels, remarketing code, or newsletter collection service was found in the audited application. No app-authored interaction events are sent. The platform’s own hosting and anonymous diagnostics are distinct from optional media. Preview-only developer tooling may report errors to Lovable and is not controlled by media preferences.

Information is used to operate, deliver and secure the website, troubleshoot problems, respond to enquiries, arrange meetings you request, manage professional correspondence and meet applicable legal obligations. Information should be limited to what is reasonably necessary for those purposes. Materially different uses require a new explanation and consent where required.

No first-party targeted advertising or sale-of-data mechanism is installed in this site. I do not authorize the sale of enquiry information through this website. Optional third-party players may apply their own measurement or advertising practices even though I do not monetize their embedded players. Their independent practices are not a promise made by me.

Cookies are small browser files. Local and session storage also let a site keep information in your browser. Necessary functions deliver the website, protect services and remember your selections. The router uses sessionStorage key tsr-scroll-restoration-v1_3 for temporary scroll position within the tab; the site does not use it as a tracking identifier.

Your saved privacy record uses localStorage key mehnaz_privacy_preferences and contains only selections, a policy version, a timestamp and an expiry. It has no unique ID and is not sent to a consent database. It expires after 180 days (a design choice, not a statutory rule). A changed material policy version or expired record prompts a new choice. If storage is unavailable, optional services remain off.

YouTube, LinkedIn and Instagram players load only after explicit provider permission and a separate play action, or a specific “Allow this media once” choice. Preview images remain visible without media consent: public YouTube thumbnail copies and site-served LinkedIn and Instagram posters are served through this site, not requested from those providers by your browser. Remote provider images, scripts and frames are not requested by this application before permission. Each enabled provider may receive your connection, device and media-interaction information and use cookies or similar technologies. Once-only permission lasts only for the active player; it is not saved as a general preference. Global Privacy Control keeps optional players and optional analytics off.

Rejecting optional cookies leaves ordinary browsing, owner-hosted media including the founder film, email links and outbound links available. Optional players stay off with a site-served poster or title and a watch-at-source alternative. Accepting media preferences does not start autoplay or authorize marketing email. Optional analytics is a separate selection; no advertising category is offered because no advertising tag is installed.

Reopen Cookie Preferences in the footer or below to change or withdraw your choices. Saving a withdrawal immediately unloads active optional frames and prevents future loads. It cannot undo information already shared or delete another provider’s cross-origin cookies. Browser controls can clear stored preferences and cookies; a new choice will then be requested. Any future optional service requires an updated notice and renewed consent where required.

Necessary hosting/CDN and communications providers process information to deliver the website, secure services or handle correspondence. The email hosting provider has not been confirmed, so no particular email company is represented here. Calendly processes booking information when you choose to book. Third-party media companies receive information only when their player is permitted or you independently visit their website.

Information may be shared with professional collaborators only where reasonably necessary to handle your request and with appropriate authority or consent, or with public authorities where legally required or permitted. Operator service providers and independently visited media or venture sites are different relationships.

Information may be processed in Canada or other countries and may be subject to laws and lawful access in those countries. Provider processing locations and contractual arrangements vary; this website does not promise Canadian-only hosting.

Correspondence and related personal information should be kept only as reasonably needed for a request, an ongoing relationship and applicable legal or recordkeeping obligations. When no longer required, information should be deleted, anonymized or securely disposed of, subject to legal holds and backup processes.

Local privacy selections expire after 180 days. Lovable’s published-site analytics retains detailed anonymous data for 90 days and daily summaries for a year. Independently visited providers set their own retention practices.

The public website uses HTTPS. Optional media requests and preferences are controlled in this application, and no private enquiry is stored in its frontend. Administrative, technical and physical safeguards proportionate to the information’s sensitivity are required for operational email, access and records; operational arrangements are separate from these website controls. No online service can guarantee absolute security.

Where applicable law requires it, privacy incidents must be assessed and recorded, and reportable breaches notified to the regulator and affected people. Under PIPEDA, the real-risk-of-significant-harm threshold and breach-record obligations must be considered. This notice is not evidence that an operational breach-response process has already been established.

Subject to applicable law and its exceptions, you may request access to personal information held about you, information about its use or disclosure, correction, and withdrawal of consent subject to relevant legal or contractual restrictions and their consequences. Deletion requests will be considered where permitted or required; there is no unconditional promise to erase every record.

Identity may be verified as reasonably necessary to protect information. Applicable statutory deadlines govern responses. PIPEDA access requests generally require a response within 30 calendar days; permitted extensions require notice and reasons. This is not a blanket 30-day promise for every complaint or every provincial process.

Please raise a concern with the privacy contact first. You may also contact the Office of the Privacy Commissioner of Canada or the appropriate provincial regulator, including Quebec’s Commission d’accès à l’information where applicable. You are not required to consent to unnecessary optional collection to browse this website.

This website is intended for a general professional audience, not to knowingly solicit children’s personal information. Where a child cannot provide meaningful consent, parent or guardian consent is required as appropriate. Contact me if information needs to be corrected or removed. No first-party targeted advertising to children is installed.

YouTube/Google, LinkedIn and Instagram/Meta are optional embedded-media providers. Calendly, Spotify, LinkedIn newsletters, Medium, Linktree, coverage publishers and venture websites are ordinary outbound destinations: their services do not load simply because their links appear here. If you follow a link, that website’s notice and controls apply. Our preferences do not control another site after you leave.

Provider links below explain their own handling. Lovable’s notice covers its platform services, not the personal information you send to me. No guarantee is made about independent providers’ policies or activities. Review the relevant notice before interacting.

Effective and updated: 13 November 2026. Consent version: 2026-11-13-v1. Material changes should be highlighted and renewed consent obtained where required.

If you have questions about how your information is handled, wish to make a privacy request, or would like to raise a concern, please contact me at mehnaz.tabassum@nleats.com with the subject line Privacy enquiry. Mehnaz Tabassum is the privacy contact for this website.