Privacy Policy

Last updated: October 11, 2026

This policy explains what SEO Flashlight collects when you use seoflashlight.com or order an audit, why we collect it, where it's stored and how long we keep it. SEO Flashlight is a service of SquareStair Media, based in Toronto, Ontario ("we", "us"). We handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and we follow Canada's Anti-Spam Legislation (CASL) for marketing email.

We don't sell your information.

1. What we collect

When you place an order

Your email address
The website address you want audited
The plan you chose
Whether you ticked the box to receive SEO tips by email
Your IP address, which we use to stop abuse and enforce daily ordering limits

When you pay

Stripe processes your payment on its own secure checkout page. Stripe collects your card details and billing information. We never see or store your full card number. Stripe tells us whether the payment succeeded, the amount and a payment reference number.

When you download your report

Before you download, you confirm that you understand the report was generated automatically. We record that confirmation with your email, website address, plan, amount paid, payment reference, IP address, browser details (user agent), the date and time, and the exact wording you agreed to.

If you ask us to contact you

If you use the "Have someone contact me" button, we keep the request and any message you write.

Your website

To produce your report, our software reads the public pages of the website you submitted. We store the finished report. We don't access anything behind a login.

2. How we use it

To confirm your email address before you pay
To take your payment and run your audit
To deliver your report and let you download it
To reply when you ask for help
To keep accounting and tax records
To keep evidence that you acknowledged the automated-report notice
To prevent fraud, spam and abuse of the service
To send occasional SEO tips, only if you ticked the box when ordering

Emails about your order (your confirmation link, receipt and report) are part of the service, so we send them whether or not you ticked the box. You can stop SEO tips at any time, using the unsubscribe link in any tips email or by writing to us.

3. Cookies and tracking

seoflashlight.com doesn't use advertising or analytics cookies.

To keep bots out, our order form uses Cloudflare Turnstile, which checks your browser for signs of automation. Stripe's checkout page sets its own cookies to process payments and prevent fraud. Each of these services follows its own privacy policy.

4. Who processes your information, and where

We use these service providers to run SEO Flashlight. Each receives only what it needs for its job.

Provider	What it does	Where
Supabase	Stores order records and your report	Canada
Render	Hosts the website and the software that runs your audit	United States
Stripe	Processes payments	Canada and United States
Resend	Delivers our emails to you	United States
Cloudflare	Checks for bots on the order form	Worldwide network
Anthropic	AI analysis of your website's public pages. It receives your website address and public page content, not your email address or payment details.	United States

Information processed outside Canada is subject to the laws of the country where it's processed, and may be accessible to authorities there.

5. How long we keep it

Email confirmation links expire after 24 hours.
Report links expire 30 days after we send them.
Order and payment records, including your IP address, are kept for at least six years, because Canadian tax law requires us to keep business records.
Your acknowledgment record is kept for the same period, as evidence of what you agreed to.
Your report is kept so we can answer questions about it. You can ask us to delete it at any time.

6. Your choices and rights

You can ask us to:

show you the personal information we hold about you
correct anything that's wrong
delete your information, except records the law requires us to keep
stop sending you SEO tips

Email legal@squarestairmedia.com from the address you ordered with. We may need to confirm it's you before we act, and we'll reply within 30 days.

If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

7. How we protect it

All traffic to seoflashlight.com is encrypted. Our database can't be reached from your browser, and only our own servers can read it. The private links we email you are long, random and expire, and we store only a scrambled version of each one. Report downloads use short-lived links.

No system is perfectly secure. If we ever learn of a breach that puts your information at real risk of significant harm, we'll tell you and the Privacy Commissioner, as Canadian law requires.

8. Children

SEO Flashlight is a service for businesses and website owners. It isn't meant for anyone under 18, and we don't knowingly collect information from children.

9. Changes to this policy

If we change this policy, we'll post the new version here and update the date at the top.

10. Contact

SquareStair Media
Toronto, Ontario, Canada
legal@squarestairmedia.com