Privacy policy

Last updated 17 September 2026

VanillaSEO is a one-person SEO business in Calgary, Alberta. This policy covers vanillaseo.ca, the free scorecard tool and the client dashboard. It is written to be read. If anything here is unclear, email hello@vanillaseo.ca and we will explain it.

What we collect

When you request a free scorecard

• Your website address — so we can measure it.
• Your email address — so we can send you the report.
• Your IP address — stored so we can stop one person generating a thousand reports. Nothing else.
• The measurements themselves — your page speed scores and the issues we found.

When you become a client

• Your name, business name and website.
• Your password, stored as a bcrypt hash. We cannot read it, and neither can anyone who steals the database.
• Records of the work we do: fixes deployed, monthly reports, uptime checks.
• Billing details, which are held by our payment processor and never touch our server.

When you just visit the site

Standard server logs: IP address, page requested, timestamp, browser. Every web server keeps these; ours are rotated and deleted, and we do not build profiles from them.

Why we collect it

To deliver what you asked for, and for nothing else. We do not sell data, we do not rent mailing lists, and we do not run advertising trackers. There is no third-party ad pixel anywhere on this site — the footer says so, and it is true.

Cookies

We set as few as we can:

• Session cookie — keeps you signed in to your dashboard. Deleted when you sign out or after 30 minutes of inactivity.
• "Remember me" cookie — only if you tick the box. Lasts 30 days and holds a random token, not your password.
• Analytics — if enabled, a privacy-respecting measure of how many people visit which pages. No cross-site tracking, no advertising identifiers.

All of them are HttpOnly and SameSite=Strict, which means other websites cannot read them and JavaScript cannot either.

Who else sees it

The short list, and exactly what each one gets:

• Google PageSpeed Insights — receives the website address you submit, so it can run the audit. Not your email.
• Google Search Console — for clients who connect it, we read their search performance data. Read-only; we never change anything in your property.
• Microsoft Clarity — for clients, records heatmaps and sessions on their site. Clarity masks text input by default, so what visitors type into forms is not recorded.
• Our email provider — receives the address we are sending to, and the message.
• Our web host — stores the database and files, in Canada or the United States.

Each of these has its own privacy policy. We have chosen them because they are ordinary, boring and widely audited, not because they offered us anything.

How long we keep it

• Scorecard reports — the link works for 7 days. The PDF is deleted after 30 days; the record stays so we do not re-run the same audit twice.
• Client records — for as long as you are a client, plus one year, which is what our accountant needs.
• Server and email logs — 90 days.
• Failed login records — 24 hours, then deleted.

Your rights

Under Alberta's Personal Information Protection Act and Canada's PIPEDA, you can ask us to:

• Tell you what we hold about you.
• Correct anything that is wrong.
• Delete it.
• Send you a copy in a format you can use elsewhere.

Email hello@vanillaseo.ca. You will get an answer within 24 hours and the request done within 30 days, which is the legal maximum and much longer than it actually takes. There is no charge and we will not ask you why.

Every email we send has a one-click unsubscribe link. It works immediately and does not require signing in.

How we protect it

• The whole site is served over HTTPS.
• Passwords are hashed with bcrypt, never stored or logged in readable form.
• Database queries use prepared statements, so submitted text is never executed as a command.
• Configuration and credentials live outside the public web folder and cannot be fetched over the web.
• Forms carry anti-forgery tokens, and sign-in attempts are rate-limited.

No system is perfect. If we ever discover a breach affecting your information, we will tell you what happened and what to do about it — directly, not in a press release.

Contact

VanillaSEO
Calgary, Alberta, Canada
hello@vanillaseo.ca
(587) 893-8163

Not satisfied with how we handled a privacy question? You can complain to the Office of the Information and Privacy Commissioner of Alberta, or to the Office of the Privacy Commissioner of Canada. We would rather you told us first, but it is your call.