Privacy Policy
SEO AZ · seoaz.ca · Last updated September 15, 2026
SEO AZ ("we", "us") helps small businesses in Canada be found online, collect and answer customer reviews, keep their business listings accurate, and stay in touch with their own customers. This policy explains what personal information we collect, why, and what your choices are. It is written to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).
1. Two kinds of people we deal with
Business owners who sign up for SEO AZ, and their customers, whose information a business owner asks us to hold and message on their behalf. If you are a customer of a business that uses SEO AZ, that business is responsible for having a lawful basis to contact you, and we act only on its instructions.
2. What we collect
From business owners: name, business name, business address, email, phone, timezone, login credentials (passwords are hashed), Google Business Profile authorization tokens (encrypted at rest), and payment status. Payments are processed by Stripe; we never see or store card numbers.
About a business's customers (on the business's behalf): name, mobile number, email, language, date of last visit or job, consent records, and the messages sent to and received from them.
From the contact form on seoaz.ca: the name, business, email, phone and message you type in.
Automatically: server logs (IP address, browser, pages requested) kept for security, and a session cookie needed to stay logged in. We do not use advertising or tracking cookies.
3. Why we use it
To run the service: keeping a Google Business Profile up to date, requesting and replying to reviews, sending messages a business owner has asked us to send, producing reports for the business owner, billing, support, and security. We do not sell personal information and we do not use a business's customer list for anything other than that business's own messaging.
4. Messages and consent (CASL)
Every text or email we send on a business's behalf identifies that business, includes its mailing address, and includes a way to stop receiving messages (reply STOP, or an unsubscribe link). We only send when the business has recorded a lawful basis — express consent, or an existing business relationship such as a recent purchase or visit — and our system refuses to send otherwise. Unsubscribe requests take effect immediately and are recorded permanently.
5. Google data
When a business owner connects a Google Business Profile, we access only that profile's information (details, reviews, posts, performance data) to provide the features above. Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google at any time from Settings, which deletes the stored tokens.
6. Who we share it with
Service providers that process data for us under contract: DigitalOcean (hosting, Toronto, Canada), Cloudflare (network security), Stripe (payments), Twilio (text messages), our email delivery provider, Google (Business Profile APIs), and Anthropic (drafting suggested replies and posts — drafts are reviewed by the business owner or governed by rules the owner sets). We may disclose information if required by law.
7. Where it is stored and how long
Our servers are in Canada. Some providers listed above operate in the United States. We keep account data while the account is active and for up to 12 months after; we keep records of messages sent and consent received for as long as required to demonstrate compliance with CASL, and we anonymize customer contact details on request.
8. Security
Encrypted connections (HTTPS), encrypted storage of authorization tokens, hashed passwords, firewalled servers, access limited to what each business needs, and regular backups. No system is perfectly secure; if a breach creates a real risk of significant harm we will notify affected people and the Privacy Commissioner as the law requires.
9. Your rights
You can ask what personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw consent. Business owners can do most of this themselves in Settings; customers of a business can use the STOP or unsubscribe option in any message or contact the business directly. For anything else, email [email protected]. We aim to respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada.
10. Changes and contact
We will post changes here and update the date above. Questions: [email protected].