Who we are

, operating as Merkat, at . Questions and requests go to , and a person reads them.

When you run a free scan

We record the business name you type, the trade and town you choose, the page you arrived on, your browser's user agent, and your IP address. The IP address is used for two specific things: limiting how many free scans come from one connection, and standing as evidence of when and where consent was given.

The scan itself asks a search provider what Google Maps shows at 9 points around your town. It does not touch your website, your Google account, or anything you own.

When you give us an email address

You give it to receive one specific report. Under CASL that is implied consent arising from your own enquiry, it covers that report and questions about it, and it does not last indefinitely.

Marketing email is a separate question with a separate, unticked box. We store the exact wording you were shown, the time, your IP address and whether you ticked it, because consent you cannot evidence is not consent. If you did not tick it, we store that refusal too. Every marketing email carries a working unsubscribe and our mailing address.

When you become a client

We hold what is needed to do the work and bill for it: contact details, your business details, the services and areas you gave us, and the measurements we take each week. Payments are handled by Stripe; card numbers never reach us and we could not see them if we wanted to.

Where you give us manager access to your Google Business Profile, every change made on your behalf is written to a log you can ask for. We ask for manager and never owner, so you can remove us yourself at any time without asking us first.

Who else sees it

These companies handle information for us, each only for the job listed. Nobody buys this data from us, because we do not sell it, and nobody receives it for their own marketing.

• Railway hosts the site and stores the database: scan results, email addresses, consent records and client records. Servers in the United States.
• Postmark delivers the emails you asked for, so it receives your email address and the message. United States.
• Stripe takes payments. Your card details go to Stripe directly and never reach us. United States, with Canadian payments handled by Stripe Payments Canada.
• Cloudflare sits in front of the site to protect it and deliver pages quickly, so it sees your IP address and the pages you request. A global network, headquartered in the United States.
• Google Analytics counts visits, as described under Cookies and analytics. United States.
• Omnisend sends our marketing emails to people who agreed to receive them, and keeps the list of who has unsubscribed. It receives your email, your business name, trade and town, and which steps you took with us (a scan, an audit, a plan). On our public pages it also records which pages a visit views, as described under Cookies and analytics. Headquartered in Lithuania; it may process data in the European Union and the United States.
• Google Fonts supplies the typefaces, so your browser fetches them from Google, which sees your IP address. United States.
• DataForSEO runs the map searches for a scan. It receives a search phrase and a map coordinate, never anything about you.
• OpenAI answers the questions we put to AI assistants for an audit or a monthly report, the way a customer would ask them, such as which companies to call for your trade in your town. It receives only the question, a trade and a town. Your name, your business's name and your email never go to it: we look for your business in the answers on our side. United States.

Because these providers operate outside Canada, the information can be stored and processed outside Canada and is subject to the laws of those countries, including lawful access by their authorities.

The list of towns in the scan comes from GeoNames, used under the Creative Commons Attribution 4.0 licence. It is a file on our own site, so nothing about you is sent to GeoNames.

How long we keep it

• Free-scan results and the addresses attached to them: 24 months from your last contact with us, then deleted
• Consent records: kept for as long as we might need to prove the consent, and then for 3 years after it ends
• Client records and measurements: for the life of the agreement and 7 years after, because tax law requires the billing records

What you can ask for

A copy of what we hold about you. A correction if it is wrong. Deletion, unless we are required to keep it. Withdrawal of consent at any time, which we record as its own event rather than by editing the original. Email and we will answer within 30 days, which is the limit BC PIPA sets.

If you are not satisfied with how we handled it, you can complain to the Office of the Information and Privacy Commissioner for British Columbia.

Cookies and analytics

We use Google Analytics to count visits and see which pages lead to a scan or a purchase. It sets cookies that tell one visit from another. Google receives the page you are on (without anything after the address, such as sign-in links or order numbers), your browser and device type, and an approximate location worked out from your IP address. We also tell it when a scan starts or finishes and when a checkout starts, with the trade and town you picked and the price. It never receives your name, your email address, your business name or anything you type into a form. Google processes this data in the United States.

On our public pages (not the scan results, sign-in, the client area or anything with an order or report in its address) Omnisend also sets a cookie and records the pages viewed. If you are on our email list, that lets us tell, for example, that you looked at the plans. It is never used to show you ads, and it follows the same switches as Google Analytics below.

Advertising features are off: nothing collected here is used to show you ads, and Google signals, which would link visits to Google accounts, is off. Google deletes analytics data after 14 months.

Analytics does not run at all if your browser sends Global Privacy Control. You can also turn it off for this browser:

Separately, the site uses your browser's session storage to remember the town you picked so you do not have to choose it twice. That never leaves your browser and is gone when you close the tab.

Changes

If this notice changes in a way that affects what we do with information already collected, we will email the people it affects rather than quietly changing the page.