Legal

Privacy Policy

Last updated: October 28, 2026

1. 1. Who we are
2. 2. What we collect
3. 3. How we use it
4. 4. Service providers
5. 5. Analytics, cookies and browser storage
6. 6. Share links and reports
7. 7. Where data is stored
8. 8. How long we keep it
9. 9. Security
10. 10. Your choices and rights
11. 11. If you add your clients' details
12. 12. Children
13. 13. Changes
14. 14. Contact

1. Who we are

Elevate SEO is run by Elevate Digital Marketing ("we", "us"), based in British Columbia, Canada. This policy explains how we handle personal information when you visit seo.elevatedm.ca or use Elevate SEO, including the dashboard, MCP server and API (the "Service"). We handle personal information in line with British Columbia's Personal Information Protection Act (PIPA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, and other privacy laws that apply to our customers. We've designated a Privacy Officer who is responsible for our privacy practices and answers privacy questions and requests; their details are in section 14.

2. What we collect

Information you give us

• Account details: your email address and the plan you choose.
• Billing details: Stripe collects your payment card and billing address. We receive your Stripe customer and subscription references, your subscription status, and the amounts paid, tax charged and any refunds. We never receive or store full card numbers.
• What you add to the Service: domains, page addresses, keywords, locations, business names, AI prompts, client names and notes, branding details (agency name, logo, website, email, phone, report footer) and questions you ask the results assistant. Please only add personal information the tools need. The Service isn't designed for sensitive information such as government ID numbers, financial account details or health information, so please don't add it.
• Messages: anything you send us by email.

Information created when you use the Service

• Results: audits, rankings, local results, AI visibility checks, reports and their history.
• Usage records: which tools ran, when, and how many credits they used, plus credit pack purchases.
• API keys: stored only as a one-way hash.
• Technical data: IP address, browser type and request details in server logs, and IP-based counters used for rate limiting and security.

Information on our public pages

When you visit our public pages (the home page, Terms and this policy), Google Analytics collects usage data. See section 5.

3. How we use it

• to create and run your account, sign you in and provide the tools you ask for;
• to bill you, calculate sales tax, track credits and handle refunds and disputes;
• to answer your questions and send service messages, such as sign-in links, billing and security notices;
• to send occasional product news to customers, no more than a few times a year. Every such email has an unsubscribe link, and opting out doesn't affect service messages. If you unsubscribe, we keep a record of that so your choice continues to be honoured, including if you open a new account later;
• to keep the Service secure and prevent abuse;
• to understand how visitors find and use our public pages, and to improve the Service;
• to meet legal, tax and accounting duties.

We don't sell personal information, and we don't use your data or your clients' data for advertising.

4. Service providers

We use the providers below to run the Service. Each receives only what it needs for its part of the work.

Provider	What it does	What it receives
Stripe	Payments, subscriptions, invoices and sales tax	Email, payment and billing details, purchases
Render	Hosting and database	All Service data, stored on our behalf
DataForSEO	Search, maps, keyword, backlink and business listing data	Domains, keywords, locations and business names you check
OpenAI, Anthropic and Perplexity	AI visibility checks; Anthropic also powers the results assistant and content suggestions	Prompts, business names and domains you check; for the assistant, your question and the results it explains
Resend	Account emails (welcome, sign-in links, low-credit and security notices) and occasional product news	Your email address and the message content
Google PageSpeed Insights	Page speed and performance checks	Page addresses you audit
Google Analytics	Visitor analytics on public pages only	Page views, device and browser information, approximate location and signup events
Cloudflare Web Analytics	Cookieless visitor counts on public pages only	Page views, referring site, device and browser information and approximate location

AI providers. We use the commercial APIs of OpenAI, Anthropic and Perplexity. What's sent to them is limited to what a feature needs: the prompt, the business name and domain being checked, and for the results assistant, your question and the results it explains. Under those providers' API terms, that data isn't used to train their general models, and we don't opt into any program that would allow it. They may keep it for a short time to run the service, detect abuse and meet their legal duties.

We may also share information if the law requires it, to protect people or the Service, to establish or defend legal claims, or as part of a sale, financing or reorganization of the business, in which case this policy would continue to apply to it. We don't sell or rent personal information, and we don't share it with anyone for targeted advertising.

5. Analytics, cookies and browser storage

• Google Analytics runs only on our public pages. Google's advertising features and Google signals are turned off. Visitors from the European Economic Area, the UK, Switzerland and Quebec aren't given analytics cookies; for them, Google receives limited cookieless data. To opt out everywhere, you can use your browser's privacy settings or Google's opt-out add-on.
• When you start checkout, we pass your anonymous Google Analytics ID to Stripe so we can record a completed signup in Google Analytics. We don't send your email address or payment details to Google.
• Cloudflare Web Analytics also runs only on our public pages. It doesn't use cookies or local storage and doesn't track individual visitors across sites; it counts page views and reports totals.
• The dashboard, checkout success page, client share links and reports don't use analytics.
• Browser storage: the dashboard saves your API key in your browser's local storage so you stay signed in. Logging out removes it. Don't sign in on a shared computer you don't trust.

6. Share links and reports

If you turn on a client share link or share a report, anyone with that link can see the results it contains. You control these links from your dashboard and can turn them off or create a new link at any time.

7. Where data is stored

Our servers and database are hosted by Render in the United States. Some of our other providers process data in the United States or other countries. Data processed outside Canada is subject to the laws of those countries and may be accessible to their authorities. We choose providers that commit to protecting the data they handle for us, and we stay responsible for personal information in our care wherever it's processed, as Canadian privacy law requires.

8. How long we keep it

• We keep account data and results while your account is open, so your history and reports stay available.
• After you cancel, we keep your account and its history for 90 days, so you can come back without losing anything and so billing questions can be resolved. After 90 days, the account and everything in it (keys, projects, results, reports, tracking, client details and branding) is deleted automatically. If you'd like it deleted sooner, email us.
• What we keep after that: your Stripe customer and subscription references, because the invoices and tax records live with Stripe and must be kept for the period tax law requires; and, if you unsubscribed from product news, a hashed form of your email so that choice is still honoured. Deleted data can remain in our hosting provider's backups for a limited time until those backups expire.
• We keep billing and tax records for as long as tax and accounting laws require. In Canada, that's generally six years.
• Server logs are kept for a limited time by our hosting provider.

9. Security

We use HTTPS for all traffic, store API keys only as hashes, separate each account's data, limit request rates, and use browser security protections on our pages. No system is perfectly secure, so please keep your API key private and tell us right away if you think it's been exposed. If a security incident affects your personal information, we'll notify you and any regulator we're required to notify.

10. Your choices and rights

You can ask to access, correct or delete your personal information, ask for a copy of your data, or withdraw consent to optional uses. Some requests may mean we can't keep providing the Service, and we may need to keep some records for legal reasons. Email hello@elevatedm.ca and we'll respond within 30 days, or tell you if the law allows us more time. We may need to confirm it's really you before giving access to or deleting account information; we'll ask for no more than that takes.

If you're not satisfied with how we handled your request, you can contact the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada where PIPEDA applies, or the privacy regulator where you live.

11. If you add your clients' details

If you're an agency or consultant, you decide which client information goes into the Service, and you're responsible for having the right to share it with us. We use it only to provide the Service to you. Please keep personal information about your clients to what the tools need, such as a business name, domain and location, and don't add sensitive information about your clients or their customers. We don't use your clients' details to market to them. If one of your clients contacts us about information you added, we may need to involve you to answer them.

12. Children

The Service is for businesses and isn't directed at children. You must be 18 or older, or old enough to enter a binding contract where you live, to open an account. We don't knowingly collect personal information from anyone under 18; if you think a child has given us information, email us and we'll delete it.

13. Changes

We may update this policy. For material changes, we'll email account holders or post a notice in the dashboard before they take effect. The date at the top shows when it last changed.

14. Contact

For privacy questions, access or correction requests, deletion requests or complaints, contact our Privacy Officer:

Privacy Officer
Elevate Digital Marketing
[mailing address to be added]
British Columbia, Canada
hello@elevatedm.ca