Privacy

§ 01

What I collect

• The address you scan. Kept for 24 hours so reopening the page doesn't re-run the test, then deleted. If you ask for the result by email, a copy of that result (your site's scan, not your email) is kept for 14 days so the link in the email still opens.
• Your email, if you type it in. The free result never needs one; it is on the page and you can close the tab. Two places on this site ask, and both are optional: "Email me this result" on a scan result, and a scan that Google's daily quota pushed to tonight's run. Either way you get one email with the result and one follow-up a week later if I don't hear back, nothing more. I keep the address with the date and the page you were on when you gave it. That pairing is what Canada's anti-spam law asks me to keep. If you buy the written audit, your email is typed on Stripe's payment page instead and reaches me from there.
• Your IP address, counted against a limit of five scans, three emails left for a scan result and three orders an hour. The counter expires after an hour.
• A page view, counted by Cloudflare Web Analytics. It sets no cookie and stores no identifier, so it cannot recognize you on a second visit or follow you anywhere else. I see how many people opened a page and which site sent them, never who.
• The bot check. Cloudflare's Turnstile runs on the scan form, on the result email form, on the order form on the home page, and on the order page's button. Cloudflare sees the IP address and the browser making the request. It is there to keep bots out, not to advertise to you.
• What you type if you order the written audit. The address of the site you want audited, if you order from the home page; the order page already has it and asks for nothing. Your email, name, business and billing address are typed on Stripe's page. If the payment page does not open, because my queue is full or the payment service did not answer, you can leave your email instead, so I can write to you about that order. Afterwards, on your own order page, you can name up to three competitors, and those are typed here and kept with your order. See the next section.

§ 02

If you order the written audit

Ordering asks for the site and nothing else. On the home page you type the address of the site you want audited; on the order page it is already filled in and there is one button. Either way, pressing it records the site you asked about, the IP address and the browser the request came from, so I can tell a real order from a bot, and sends you to Stripe.

What Stripe collects, and passes to me. Your email, your name, your business name and your billing address, all typed on Stripe's own page. Your billing address is also what works out the tax you are charged. Stripe tells me those four things once the payment goes through, along with the line of work you pick there.

If no payment page opens. When my queue is full, or the payment service does not answer, your order is kept and no payment page opens. You can then leave your email on this site. It is optional. It goes into your order record, I use it to write to you once about that order, and it fills in the email field on the payment page when I send you one. It is not added to any list and no contact record is made from it.

Typed on this site after you have paid. Your order page asks for up to three competitors. It is optional, the audit happens either way, and if you skip it the scan picks the three nearest from Google. What you type goes into the same order record as everything else, in Cloudflare Workers KV, and nowhere new.

Why. To write the report, to raise an invoice with the right tax on it, and to set up the call if you book one. Nothing on this list is sold, and nothing on it is used to write to you about anything other than your order.

Your card never touches this site. You pay on Stripe's payment page, and Stripe processes the card. I see that the payment went through, and the four things above. I never see the card number.

Not sold in Quebec. I do not sell the written audit or a website build to a business billed in Quebec. The free scan is open to everyone, and so is its result by email, but a business in Quebec gets the result only, with no follow-up. If a payment from a Quebec billing address reaches me anyway, I refund it rather than deliver.

Your order page. The link I send you carries a key that nothing else has. It is not listed, not linked from anywhere, and search engines are told to stay off it. Treat it like a receipt.

No advertising network is told that you bought anything. There is no Google Analytics here, no Meta pixel and no ad-conversion tag, so nothing about your purchase leaves for one.

Where it goes.

• The order record: Cloudflare Workers KV, inside this site.
• The payment, and your email, name, business and billing address: Stripe, which is where you type them and where the card details go.
• The invoice and your contact record, raised once the payment has gone through: Zoho Books, on its Canadian data center.
• The emails about your order: automations I run on my own computer in Ontario write them, and they are sent from support@digicatalyst.ca through Zoho Mail, on its Canadian data center, which keeps the sent copy. The automations keep a copy of an email only when sending it fails, for 14 days.
• My contact record for you: Notion.
• Only if you book the readout call: Cal.com gets your name, your email and the order number, a mobile number if you give one, and the email of anyone you add as a guest. Cal.com puts the booking, with those details, on my Google Calendar, and its confirmation and any change reach my Gmail inbox. That number gets a text reminder on the day of the call, sent from my business line through VoIP.ms, a Canadian phone company. The reminder says when the call is and where to join, nothing else. Reply STOP and no more automated texts go to that number.
• The call you book, and my notes from it: your contact record in Notion. The automations on my computer in Ontario copy the booking there, with the mobile number, so a later text from you finds the same record. I text that number only for the reminder, unless you text me first, and never for marketing.
• The readout call is a sales call, so it is not recorded. I use a note-taking tool, and I say so at the start. While we talk, the sound of both sides goes to Deepgram, which turns it into text as the call happens; every request is opted out of Deepgram's model improvement program, and Deepgram states it keeps an opted-out request only as long as it takes to process it. The last few things you said go as text, with no name or number attached, through OpenRouter to Jev, a model made by TypeSafe, which picks the prepared answer that fits so the tool can prompt me; it writes nothing. No audio is recorded or kept, by me or by Deepgram. When the call ends I keep the transcript, or a summary of it, on your contact record. Ask me not to use the tool, during the call or after it, and I stop it and keep nothing from it.
• The AI assistant I work with: Claude, made by Anthropic. It reads your contact record, including my call notes and any transcript, to draft a summary, a proposal or a follow-up, and it drafts the written audit you ordered from your order and your website. Nothing it drafts reaches you until I have read it and sent it myself. My account is set so that it is not used to train Anthropic's models.

Stripe, Cloudflare, Notion, Cal.com, Google, Anthropic, Deepgram, OpenRouter and TypeSafe store or process data outside Canada, in the United States. The record of a reminder text sits with my phone records in Cloudflare and is kept for three years, the time a consent record has to last. Zoho Books, Zoho Mail and VoIP.ms keep their copies in Canada.

How long. The invoice and the payment record stay for six years, because tax law requires it, and I cannot delete those on request. The order record in Workers KV, with an email you left when no payment page opened, goes after 180 days, which is long past the last day a card payment can be disputed. Everything else follows the rules below.

Getting it back or deleted. Email support@digicatalyst.ca and quote your order number. I aim for same day and within ten business days at the outside. I will send you what I hold about you. What I can delete, I delete, and I will tell you plainly what is left in the accounting record and why it has to stay there.

§ 03

Why

To write and send what you ordered, or to send the scan result you asked for and one follow-up if I don't hear back, and to see which pages people actually read. No list, no sequence, no selling your address to anyone.

§ 04

Where it lives

Scan results and your email sit in Cloudflare Workers KV, inside this site. If you buy the audit, your details are typed on Stripe's page and come back to the order record here, and an invoice is raised in Zoho Books on its Canadian data center. Contacts are copied to my Notion workspace and to automations I run on my own computer in Ontario. Order emails go out through Zoho Mail in Canada; a booked readout call also lands on my Google Calendar and in my Gmail inbox. A scan result you asked for by email, and its follow-up, go out from kaustubh@digicatalystsystems.ca, my outreach mailbox on Zoho Mail in Canada. Claude, the AI assistant I work with, made by Anthropic in the United States, reads a contact record when it drafts something for me, and AI agents I run on Claude on my own computer in Ontario write and send the scan result emails and my outreach emails for me, one at a time, under rules I set. Google's PageSpeed service sees the address you scanned, because it is the one loading your site. Nothing about you goes to an advertising network.

§ 05

How long

Scan results: 24 hours, or 14 days for a result you asked to have emailed. Rate-limit counters: one hour. An email you left for a scan result: 180 days in Workers KV, then deleted there; the copy on your contact record follows the contact rule below. The IP address and browser your order came from: 30 days, and I clear them the moment the order is paid or expires. Your order page, with what Stripe sent back: 180 days, after which the page stops opening. Your report stays at its own link. An audit I send to a business that did not ask for one comes down 90 days after I send it, and its link stops opening; I keep a note of which business it went to and when, and for three years who I sent it to, as the record of that email. Your contact record, with your email, the audit context and any call notes and call transcript: deleted three years after we were last in touch, or sooner if you ask. The audio of a recorded call: deleted once its transcript is on your contact record, never later than seven days after the call. A note that you asked me to stop writing stays, so I never write again. The invoice and its payment record: six years, in Zoho Books, because tax law requires it.

§ 06

Your choices

There is no cookie banner here because there is nothing to consent to. Email support@digicatalyst.ca to see what I hold or to have it deleted. I aim for same day, and within ten business days at the outside.

This site sets no cookies. The bot check before a scan hands your browser a one-time token instead of storing anything. If Cloudflare ever has to show a full challenge page to stop an attack, that page can set a short-lived security cookie, which carries no advertising identifier. digicatalyst.ca sets none either.

§ 07

If I wrote to you first

Some audits on this site go to a business that did not ask for one. If that was you: I found your business email published on your own website or business listing, and I wrote only about your business's website. The page where I found the address is kept on your contact record in Notion as its source, with the date.

I wrote from kaustubh@digicatalystsystems.ca, my outreach mailbox on Zoho Mail, on its Canadian data center, one email at a time and never from a mailing list. Since October 20, 2026, AI agents I run on Claude, made by Anthropic in the United States, write and send these emails for me under rules I set, and read your contact record to do it. The date and subject of each email to or from you, and whether it was a reply, are copied to your contact record by the automations on my computer in Ontario. The emails themselves stay in that mailbox. Reply "stop" and I will not write again; that note stays so I never do.

Your report comes down 90 days after I send it, as section 05 says. I do not send these audits to businesses in Quebec.

§ 08

Who is responsible

This site is run by DigiCatalyst Systems, a sole proprietorship registered in Ontario, Canada (Business Identification Number 1001585874), in Toronto, Ontario. For privacy questions, requests or concerns, email support@digicatalyst.ca.

Privacy Officer: the owner of DigiCatalyst Systems, designated under PIPEDA Schedule 1, Principle 1 (Accountability). The name is given on request at support@digicatalyst.ca.

If you are not satisfied with how I handle your request or concern, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.