Privacy Policy

1. Who We Are and the Scope of This Policy

Seekly is based in Ontario, Canada. We sell to businesses (this is a business-to-business, or "B2B", service). Our clients are typically local service and experience businesses - for example recreation venues and home-services companies.

Because our service runs marketing and customer-communication automation on our clients' behalf, we handle two very different kinds of personal information, and our role and responsibilities differ for each:

• Information about our clients and our own business contacts - for example the business owner or staff member who signs up, uses the portal, or corresponds with us. For this information, Seekly acts as the business that decides how it is used(a "controller" under laws that use that term).
• Information about our clients' end customers - for example the names, phone numbers, email addresses, and booking or purchase events of the people who buy from our clients. Seekly processes this information only on our client's behalf and under the client's instructions, as a service provider(a "processor" under laws that use that term). The client is the business responsible for that information; our handling of it is also governed by our agreement with that client.

This policy describes both roles. Where an end customer of one of our clients has questions or requests about their information, the client (the business they dealt with) is usually the right first point of contact, and we will support that client in responding - see Section 12 (Your rights and choices).

2. Information We Collect

3. How We Use Information (and Why)

We use information only for the purposes described below, which we identify at or before the time of collection. We limit our use to what is reasonably necessary for these purposes:

• To provide and operate the service - run the automation engines (review requests and replies, speed-to-lead responses, reactivation campaigns, content and social posts, directory synchronization, and competitor research), configured per client.
• To communicate on our clients' behalf - send SMS and email to their customers as described in Section 8, and route replies back to the right conversation.
• To communicate with our clients - onboarding, support, service notices, dashboards, reports, and billing.
• To secure, maintain, and improve the service - monitor performance and reliability, prevent fraud and abuse, debug problems, and improve our automations and configurations.
• To comply with legal obligations - including record-keeping, messaging-compliance, and responding to lawful requests.

We rely on consent and on the other lawful bases available under applicable law. For our clients' end customers, the client is responsible for having a valid basis (such as consent) for us to message them on the client's behalf - see Section 8 and our Terms of Service.

4. Google User Data and the Limited Use Disclosure

When a client connects their Google account, Seekly requests access - through Google's OAuth consent flow - only to the Google data needed to deliver specific features. What we access and why:

• Google Business Profile(business management scope): to read the client's business locations, hours, posts, and reviews, and to publish review replies, posts, and hours updates that the client has approved. This powers our reputation, visibility, and social-syndication features.
• Google Search Console(read-only): to read search-performance metrics for the client's site, used to inform the content engine and visibility reporting.
• Google Analytics 4(read-only): to read website analytics reports, used for the client's visibility dashboards.

We request the narrowest scopes needed for these features, and a client can disconnect Google at any time (see Section 9).

Limited Use.Seekly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain language, this means:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not sell Google user data, and we do not transfer it to others except as needed to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to affected users.
• We do not use Google user data for serving advertisements.
• No humans read your Google user dataexcept: (a) with the client's consent (for example to troubleshoot a specific issue at the client's request); (b) where necessary for security purposes (such as investigating abuse); (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized so it can no longer identify a person.

Google access tokens are stored encrypted (see Section 10) and are used only by our automated systems to make the API calls that power the features above.

5. Meta (Facebook and Instagram) Platform Data

When a client connects their Meta (Facebook/Instagram) account, we receive and process data such as the client's Facebook Page information, Page posting access, and leads submitted through the client's Lead Ads. We use this data only to deliver the service the client has enabled - for example, texting back new leads within seconds (speed-to-lead) and publishing approved social updates.

We handle Meta data in accordance with Meta's Platform Terms and Developer Policies. We use it only to provide these features, we do not sell it, and when a client disconnects Meta or an integration is removed, the associated tokens are revoked and deleted (see Section 9).

6. Wix Platform Data

When a client connects their Wix account, a single connection may cover their website content and, where the client uses Wix for it, their bookings, forms, and contacts. Depending on what the client uses, we may receive booking or order events, form submissions (leads), and contact records. We use this data only to deliver the service the client has enabled - for example detecting completed bookings to trigger review requests, capturing new leads, and building reactivation audiences.

We handle Wix data in accordance with Wix's applicable terms and developer policies. We use it only to provide these features, we do not sell it, and when a client disconnects Wix, the associated tokens are revoked and deleted (see Section 9).

7. Other Integrations and Service Providers

To deliver the service, Seekly uses the following categories of third-party providers. We share only the information necessary for each provider to perform its function, and we require these providers to protect information and use it only to provide services to us.

• WordPress(client's own site, connected via an application password): to publish approved content to the client's website.
• Twilio(text messaging): to send and receive SMS on the client's behalf, including review requests, lead conversations, and reactivation campaigns. Customer phone numbers and message content are processed to deliver these messages.
• Email delivery providers (such as SendGrid, Resend, or a comparable inbound/outbound email service): to send emails and reports, and to receive forwarded notification emails that our system parses into events.
• BrightLocal(directory listings): to create and synchronize the client's business name, address, phone, and hours across online directories, and to audit listing consistency.
• Google Analytics 4 and Google Search Console: as described in Section 4.
• AI providers: as described in Section 8.
• Infrastructure providers (such as our hosting, database, and workflow-automation environments) and our secrets-management provider: to run and secure the platform.

These providers act as our service providers / sub-processors. When we act as a processor for a client, our engagement of these sub-processors is also governed by our agreement with that client.

8. Communications: SMS, Email, and AI-Generated Content

9. Disconnecting an Integration

A client can disconnect any connected integration at any time from the portal. When an integration is disconnected, the associated access and refresh tokens are revoked with the provider where supported and deleted from our systems, and the features that depend on that integration stop running. Data previously received through that integration is handled under our retention practices in Section 11 and our agreement with the client.

10. How We Store and Protect Information

We take reasonable technical and organizational measures to protect personal information against loss, theft, and unauthorized access, use, or disclosure, appropriate to the sensitivity of the information. These measures include:

• Encryption of credentials at rest. OAuth refresh and access tokens for connected accounts are encrypted at rest using strong encryption (AES-256-GCM). Encryption keys are held only in our server environment and are never stored in the database, so stored credentials cannot be read from the database alone.
• Encryption in transit. Connections to our website, portal, and APIs are protected using industry-standard transport encryption (HTTPS/TLS).
• Access controls. Access to client data is limited to authorized personnel and systems that need it to operate and support the service, and administrative actions are logged.
• Multi-tenant isolation.Each client's data and configuration are keyed to that client, and automations read only the relevant client's data at runtime.

No method of transmission or storage is completely secure, so while we work hard to protect your information, we cannot guarantee absolute security. We do not make any specific security certification claims in this policy.

11. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy, to provide the service to our clients, and to meet our legal, accounting, and record-keeping obligations.

• For information we process on a client's behalf, retention is governed by our agreement with that client. When a client's service ends, we return or delete client and end-customer data as described in our Terms of Service, subject to any legal retention requirements and to standard backup cycles.
• We keep certain records (for example messaging opt-out/suppression lists and compliance and audit logs) for as long as needed to honor opt-outs and meet legal obligations, even after other data is deleted.
• We may retain aggregated or de-identified information that can no longer be linked to a specific person.

12. Your Rights and Choices

13. Sharing and Disclosure

We do not sell personal information. We share information only:

• With service providers and sub-processors as described in Sections 4-8, to provide the service on our behalf.
• With the client on whose behalf we process end-customer information (that client is the business responsible for that information).
• For legal reasons - to comply with applicable law, regulation, legal process, or an enforceable governmental request, or to protect the rights, property, or safety of Seekly, our clients, or others.
• In a business transfer - if Seekly is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, with notice to affected users where required.

14. Data Location and International Transfers

Seekly is based in Canada. Some of our service providers (for example messaging, email, AI, and infrastructure providers) may store or process information in the United States or other countries. When personal information is handled outside your province or country, it may be subject to the laws of those jurisdictions, including lawful access by courts, law enforcement, and government authorities there. We take steps to ensure a comparable level of protection through our contracts with these providers. If you have questions about our providers or safeguards, contact us at [email protected].

15. Breach Notification

We maintain procedures to detect, investigate, and respond to security incidents. If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and the appropriate authorities (including the Office of the Privacy Commissioner of Canada) as required by PIPEDA, and we will notify affected clients so they can meet their own obligations to their customers.

16. Children's Information

Seekly's services are directed to businesses and are not intended for children. We do not knowingly collect personal information directly from children. If you believe a child's information has been provided to us in error, contact us at [email protected].

17. Third-Party Websites

Our website and content may link to third-party sites and services that we do not control. This policy does not apply to those third parties, and we encourage you to review their privacy policies.

18. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice where appropriate (for example through the portal or by email). Your continued use of the service after an update means you accept the revised policy.

19. How to Contact Us

For any privacy question, request, or complaint, contact us at:

Seekly
Email: [email protected]
Mailing address: 3-106 Main St., Kingston, ON K7K 3Y8, Canada
Ontario, Canada

If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.