Privacy Policy

1. Scope and accountability

Pagely is a Canadian-operated website creation and hosting service. This policy explains how the service handles personal information about account holders, prospective customers, business representatives, people contacting support or reporting sites, and visitors to Pagely-hosted sites. The organization responsible for personal information under this policy is The Bomb Enterprises Inc., 2-4114 Crozier Road, Spallumcheen, British Columbia V4Y 0X1, Canada. Write to hello@pagely.ca for privacy questions, requests or complaints.

British Columbia's Personal Information Protection Act and, where applicable, Canada's Personal Information Protection and Electronic Documents Act or other mandatory privacy laws govern our handling of personal information. This notice does not waive those protections. Acknowledging it is not blanket consent to every possible use, optional marketing or unrelated processing.

A business using Pagely determines the purposes for collecting messages from its visitors and is responsible for its own privacy notice and practices. Pagely processes hosted content and form messages to provide the service to that business, and also handles information for its own account administration, billing, security and legal obligations. For a question about a business's use of your message, contact that business; we can assist with requests involving our handling of it.

2. Information we receive

Account and sign-in information: name, email, profile image where supplied, provider identifiers, account links, authorization or session records and verification messages. Available sign-in methods may include Google, Apple, Facebook, Microsoft, GitHub and email. The chosen provider handles its own credentials; Pagely's sign-in flow does not ask you to create a Pagely password. Session records may include an IP address and user-agent information.

Website and generation information: business names, locations, listing identifiers, public website or listing content, photos, reviews, contact details, your prompts and edits, uploaded assets, generated output, saved versions and usage records. Information comes from you, people you authorize, public websites and Google Places. Public business information can still include personal information about an owner or employee.

Forms and communications: the sender's name, email, optional phone number, message and any additional fields the site collects; delivery status, timestamps and a hashed IP address; support messages; and report details, the reported address and an optional reporter email. Do not include passwords, payment-card information, medical records or other highly sensitive information in prompts, reports or general contact forms.

Billing and service records: Stripe customer, subscription and transaction identifiers, payment status, invoices or billing details retrieved from Stripe, credit balances and usage. Stripe collects payment details directly. Where payment verification is used for abuse prevention, we may receive payment-method identifiers and limited card metadata, rather than the full card number.

Technical and security information: IP addresses received by our infrastructure, request metadata, approximate country, network operator, device cookie identifiers, browser characteristics, browser and operating-system family, timezone, timing signals, error logs, administrative actions, abuse decisions and records of policy acceptance or privacy acknowledgement.

3. Purposes, consent and choices

We use information to authenticate users, research businesses, generate and edit sites, host content, route domains, deliver and display form submissions, operate integrations, measure usage, enforce plan limits, bill for services, answer requests, troubleshoot, prevent fraud and abuse, enforce service rules and meet legal obligations. We do not sell personal information.

We collect, use and disclose personal information with appropriate consent or another authority permitted by applicable law, for purposes a reasonable person would consider appropriate. Some processing is necessary to provide the feature you request. You may decline optional connections, avoid submitting unnecessary personal information, edit your site or contact us about withdrawing consent. Withdrawal may prevent an affected feature from working but does not retrospectively invalidate lawful handling or override required retention.

A separate choice or notice will be provided when required for a materially new purpose or optional marketing. Your contract acceptance does not itself authorize unrelated processing. We may process information without consent in the limited situations permitted or required by law, such as certain investigations, emergencies or legal demands.

4. AI and business research

Generation and editing send relevant prompts, site content, research and instructions to AI services. These include OpenAI, Cloudflare AI Gateway, OpenRouter and the model providers it routes to, such as Anthropic and Google, and Cloudflare Workers AI. Generated images come from OpenAI or Google models. The provider and model depend on the feature and service configuration. Google Places and public business websites supply research and listing material.

Do not place secrets or unnecessary personal information in prompts or content sent for AI processing. AI providers may process request data and service metadata, including through logging or caching, under the applicable service arrangement. We do not make a blanket promise of zero retention or that every provider configuration excludes training. Contact hello@pagely.ca for information about the providers and handling applicable to your request before submitting sensitive material.

AI output can be wrong and may expose information you choose to publish. Review and correct it before publication. Private form messages are stored and delivered as messages; submitting a form is not permission to use its contents to train an AI model.

5. Google user data

This section describes the information Pagely receives from Google when you sign in with Google or connect Google Search Console or Google Business Profile, and how Pagely accesses, uses, stores and shares it. Each is optional, and each asks for your permission on Google's own consent screen.

Google sign-in: Google shares your name, email address, profile image and Google account identifier. Pagely asks only for these basic profile permissions, never for access to your Gmail, Drive, contacts or calendar. Pagely uses them to create your account and sign you in, show your name and image in the dashboard, email you about your account and sites, link your sign-in methods and detect duplicate or abusive accounts as described in section 6. They are stored with your account record, along with the sign-in tokens Google issues.

Google Search Console: available on Pro for a site published on your own domain. Google asks you to allow Search Console access and site verification (the webmasters and siteverification scopes) and shares your email address. Pagely uses this access only for the website it hosts at that domain: it obtains a verification token, publishes it as a meta tag on your site, asks Google to verify the site, adds it as a property in your Search Console account, submits its sitemap, checks whether its home page is indexed and reads its total clicks, impressions, click-through rate and average position for the last 28 days. The checks repeat about once a day while you stay connected. Pagely stores the connecting account's email address, encrypted access credentials, the verification token, the latest index status and the 28-day totals, and shows them on the Search visibility page of your dashboard. It does not read data for any other property in your Search Console account.

Google Business Profile: Google asks you to allow Business Profile management (the business.manage scope) and shares your email address. Pagely uses the connection only to list the businesses your Google account manages so you can choose the one to build a site from; it reads those listings and does not edit them. Pagely stores your Google account identifier and email address, encrypted authorization credentials, the connection status and the identifiers of the business you select. The list of businesses you manage is used only in that picker and is not stored in your site. Where available, the selected business's public Place ID is used to retrieve its public listing details through the research described in section 4, and those public details may reach AI services like any other research.

Use and sharing: Pagely uses Google user data only to provide the features described in this section, which you can see and control in your dashboard, and to keep accounts secure. Pagely does not sell Google user data, does not use or transfer it for advertising, and does not use it to develop, improve or train generalized AI or machine learning models. Google access credentials, Search Console results and the list of businesses you manage are not sent to AI providers. Cloudflare stores and processes this information as Pagely's hosting provider, and Google receives the requests Pagely makes on your behalf. People at Pagely look at Search Console results or Business Profile data only when you ask for help, to investigate security or abuse, or to comply with the law.

Pagely's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Disconnecting and deleting: disconnect Search Console on the Search visibility page and Business Profile in dashboard Settings, or remove Pagely's access at any time at https://myaccount.google.com/connections. Disconnecting Search Console deletes the stored credentials and verification token and stops the checks; the property stays in your Search Console account, and the last results stay with the site until you delete the site or your account. Disconnecting Business Profile disables Pagely's access while a failed revocation is retried. Unused Business Profile selections expire after seven days, and authorization requests for either connection after ten minutes. Deleting your account removes its Google connections; encrypted Business Profile credentials may remain briefly to complete a pending revocation. Disconnecting does not remove public details already included in your site; edit or delete that content separately.

6. Cookies, analytics and security signals

Pagely uses cookies and related browser storage for sign-in, an in-progress site, request integrity and abuse prevention. A first-party device cookie called pg_d helps recognize returning devices. Browser-characteristic hashes, keyed hashes of IP addresses and device identifiers, network and country information, timezone, request timing, verified identity links and business identifiers help detect duplicate or abusive activity. Hashing reduces exposure but does not make linked information anonymous.

Security signals may lead to an automated verification step, usage restriction or risk flag and may support human investigation. Contact hello@pagely.ca if you believe a decision is mistaken or want a person to review it. Sharing a network or device does not by itself establish wrongdoing.

Hosted-site analytics record page views and interactions such as calls, forms, map links and calls to action, together with the site, page path, referring hostname, approximate country and device class. A hash derived from an IP address, user agent, site and date is used to estimate daily visitors. It changes by site and day; raw IP addresses are not written into these analytics events. Infrastructure and security processing can still receive an IP address.

You can control browser storage through browser settings, but blocking necessary cookies may prevent sign-in or other features. Cloudflare Turnstile processes request and browser signals to detect automated activity. Customer-selected links, embeds and external services may have their own data practices; consult the relevant site's notice and those providers.

7. Service providers and other disclosures

Cloudflare provides application hosting, network delivery, databases, object storage, queues, email delivery, analytics, security services and some AI processing. OpenAI, AI Gateway, OpenRouter and model providers process generation requests as described above. Google provides public listing data and the optional Search Console and Business Profile connections described in section 5. Your selected sign-in provider authenticates you. Stripe handles payments, subscriptions and billing. These providers receive the information needed for their roles and may also handle information under their own applicable privacy terms.

Site owners receive visitor submissions and associated delivery information. Emails pass through sending and recipient email providers and can remain in recipient inboxes after a message is deleted from Pagely. Published content and intentionally shared preview links are accessible to their audience and may be copied, indexed or cached.

Authorized administrators may access account records, site content, reports and operational records for support, security, moderation and service management. Administrative access and actions are recorded. We may disclose relevant information to professional advisers, insurers, a prospective or actual successor in a legitimate business transaction, or authorities where necessary and permitted by law. Any business-transfer disclosure remains subject to applicable confidentiality, purpose and notice requirements.

We may preserve or disclose information to respond to a valid legal requirement, investigate unlawful activity, protect rights or safety, or resolve a dispute, only to the extent authorized by applicable law. We do not promise absolute anonymity for reports when a lawful disclosure obligation applies.

8. Processing outside Canada

Canadian operation does not mean all information stays in Canada. Cloudflare's distributed services and other providers may process or store information in the United States and other countries. Foreign laws may permit access by courts, law enforcement or national-security authorities. We remain responsible for our obligations when using service providers and must use appropriate contractual and other safeguards; no contract can override a lawful foreign demand.

This service does not promise Canada-only storage. Contact hello@pagely.ca for information about cross-border handling relevant to your use before submitting information subject to residency or sector-specific requirements.

9. Retention and deletion practices

Account and active-site information is kept while needed to provide the service. Individual form messages can be deleted by the site owner; otherwise they remain with the site until deleted with it. There is currently no automatic plan-based expiry for stored form messages. Site deletion normally removes public access and places the site in a 14-day trash period before permanent cleanup. Account deletion initiates cleanup without that site-restoration period.

Scheduled cleanup removes ordinary risk-event records older than 90 days, stale IP and browser-fingerprint identity links after 180 days, and rate-limit events after two days. Strong identity and business links generally remain while the associated account exists. These scheduled technical windows are not a substitute for any legally required retention of information used to make a decision affecting an individual.

Reporter email is scheduled for deletion 90 days after a report is closed; closed reports are scheduled for deletion 365 days after closure. Open reports are retained while unresolved. Account deletion removes reports about its deleted sites and unlinks the account from reports it filed about other sites, subject to applicable preservation duties. We normally tell a reported site's owner the category and outcome, not the reporter's identity.

Administrative audit records, certain abuse-prevention records and provider-held billing records can outlast account deletion. When account closure requires subscription cancellation, we retain the Stripe customer identifier and cancellation-attempt records separately until cancellation succeeds; failed attempts are retried. Records of policy acceptance and privacy acknowledgement remain with the account and are deleted with it. Expired, unused sign-in consent requests are removed on scheduled cleanup; browser and email identifiers in consumed requests are cleared after expiry. There is currently no single automatic expiry for all audit records, support correspondence or provider logs. Retention must be limited to a lawful operational, security, accounting or legal purpose. Analytics and provider backups or logs also follow the relevant provider's retention settings; dashboard visibility is not a guarantee that underlying information has been erased.

Where law requires preservation, including information used for a decision directly affecting a person, a court order or a valid legal hold, required records must be retained despite an ordinary cleanup schedule. We will explain applicable retention limits or exceptions when responding to a request, unless disclosure is prohibited. Deleted content can remain temporarily in caches, queues or provider recovery systems, and copies in search engines, recipient inboxes or other people's systems are outside our direct control.

10. Safeguards and incidents

We use access controls, server-side authorization, encrypted network connections and provider security controls, with keyed hashes for selected abuse identifiers and encryption for Google Search Console and Business Profile authorization credentials. Different records need different protections: account details, site content and messages are not all hashed or end-to-end encrypted. Authorized personnel and providers may need access to operate the service.

No system or transmission method guarantees complete security. Keep your sign-in provider secure, restrict access to exported messages and report suspected compromise to hello@pagely.ca. We assess suspected incidents, take appropriate containment and remediation steps, and notify affected people and regulators where required by applicable law.

11. Access, correction and complaints

You may ask what personal information we hold about you, how it is used or disclosed, request access or correction, challenge an automated or human decision, withdraw consent where available, or request deletion subject to lawful exceptions. Contact hello@pagely.ca with enough information to identify the account or interaction. We may reasonably verify identity and authority while avoiding unnecessary collection.

We will respond within the period required by the law that applies. Access may be limited where permitted or required to protect another person, privileged information, an investigation or other protected interests. Where allowed, we will explain a refusal, any lawful fee or extension, and available review rights. We will not require a waiver of mandatory rights as a condition of a request.

You may raise concerns with the person responsible for privacy at hello@pagely.ca and may complain to the Office of the Information and Privacy Commissioner for British Columbia at https://www.oipc.bc.ca or, where PIPEDA applies, the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca. You do not have to give up regulatory remedies to use Pagely.

12. Delete your account

Request account deletion in /dashboard/settings. We send an email confirmation; completing it starts removal of the account, owned sites, assets and associated records from active service systems. Export information you need and cancel renewal in Billing before proceeding. Contact hello@pagely.ca if you cannot access your account or if billing continues after closure.

Some records described in the retention section may remain for a lawful purpose. Deleting an account is not a request that your sign-in provider, Stripe, a business you contacted or an email recipient delete their independent records. Contact those organizations directly for their handling of your information.

13. Children and sensitive information

Pagely accounts are intended for people who have reached the age of majority and can enter a business-service contract. The service is not directed at children. Do not knowingly submit children's personal information or highly sensitive information unless a suitable feature and lawful basis have been established. If you believe a child has provided information improperly, contact hello@pagely.ca so we can investigate and take appropriate action.

14. Policy updates and contact

We publish a new version when this notice changes. For material changes, we provide a prominent notice or contact affected account holders as appropriate and seek fresh consent where legally required. A revised notice does not authorize incompatible new uses of previously collected information without the authority required by law.

Contact hello@pagely.ca for privacy questions, requests, complaints or details of the operator and person responsible for privacy. Please include Privacy request in the subject line and avoid sending sensitive documents until we have arranged an appropriate verification method.