Privacy policy

Susanoo Inc. ("Susanoo," "we," "us," and "our") respects your privacy and is committed to protecting it. This Privacy Policy describes how we collect, use, share, and protect your Personal Information when you visit our website at susanoo.ai and related subdomains (including app.susanoo.ai and link.susanoo.ai), or otherwise use our platform and services (together, the "Platform"), and information you provide to us in messages.

Susanoo Inc. is a Canadian company headquartered in Ontario, Canada, with its registered office at 100 King Street West, Suite 5700, Toronto, ON M5X 1C7. We serve clients in both Canada and the United States. Our customer operations platform is a white-labeled version of GoHighLevel, provided by LeadConnector LLC, which acts as our service provider. We describe that relationship below.

By accessing or using the Platform, you agree to this Privacy Policy. If you disagree with it, do not use the Platform. We may change this Privacy Policy from time to time. The "Last updated" date shows when it last changed, and your continued use after a change means you accept it. This Privacy Policy is governed by our Terms of Service.

We collect two types of information: Personal Information and Non-Personal Information (together, "Information").

a) "Personal Information" means information that identifies you or can be associated with you, such as your name, email address, phone number, employer, job title, billing information, and the contents of messages you send us.

b) "Non-Personal Information" means information that does not identify you specifically, such as aggregated usage data. If you only browse the Website without submitting information, we gather limited technical data about your visit (for example, general analytics) that does not identify you personally.

We collect Information in four ways:

a) Directly from you. When you request a roadmap, apply to work with us, book the discovery call, request a guide, subscribe to our newsletter, create an account, or contact us, we ask for information such as your name, email, phone number, business, province or state, and the details of your request, and, where you apply or request a roadmap, your industry, your region, which parts of the business you handle yourself, your annual revenue band, and how many people have, or would have, their own login to the tools you use. When you use one of our free tools, we ask only for what the tool needs to give you an answer; the calculators do not save or send your numbers. For a website report, we ask for your business's website address, your industry, and your confirmation that it is your business's website, and, only if you choose to give them, your email and your province or state, as described under WEBSITE REPORTS in Section 3. If you provide Personal Information about other people (for example, your own customers), you are responsible for having the authority and consent to do so.

b) Automatically. As you use the Website, we collect technical information such as your IP address, device and browser type, and how you interact with pages, using cookies and similar technologies. Please see our Cookie Policy for the specific cookies and technologies we use and how to control them, including Google Analytics, which runs only if you accept analytics cookies.

c) From third parties and our processors. We receive information from service providers that operate parts of the Platform on our behalf (for example, LeadConnector and GoHighLevel for CRM, scheduling, and messaging; Netlify for hosting and forms; Google for analytics), and, where lawful, from business data providers. We take steps to confirm such information was collected with appropriate consent. We may also collect business contact information, such as a name, job title, business name, business email address, and business telephone number, that a person or their business has published, for example on the business's own website or in a professional directory, or that a business data provider supplies. We do not use software designed to harvest email addresses.

d) From public sources, about businesses. We are not building benchmarks at present. When we start, to build the benchmarks described in Section 3, we will collect publicly available information about businesses in an industry and region, such as the number and average rating of public reviews, whether a business is running ads shown in public ad libraries, the measured speed of its public website, and its public job postings. We collect this at the level of the business. We do not collect the names of individual people, the text of reviews, or the identities of reviewers for this purpose, and we do not combine this information with what you tell us about yourself.

We use the Personal Information we collect for the following purposes:

a) To provide and improve the Platform and our services, including answering calls and messages, following up on leads, scheduling appointments, requesting reviews, billing, and personalizing your experience. Some features use artificial intelligence to do this work. We do not use your Personal Information to develop, improve, or train generalized artificial intelligence or machine learning models, and we do not retain Personal Information obtained through third-party APIs (including Google Workspace APIs) for that purpose.

b) For customer support, service updates, security, and reporting.

c) For business operations such as accounting, auditing, billing, fraud prevention, protecting our legal rights, and meeting our contractual and legal obligations.

d) To communicate with you, including responding to requests and, in line with your preferences, sending marketing or informational messages. You can opt out of marketing at any time. Where we ask for your consent to marketing messages, the checkbox is unticked and optional, and we keep a record of the wording you agreed to, its version, and the date and time.

e) For statistical and analytics purposes to understand and improve the Platform.

f) To contact businesses about our services. We may send a business email to a person at a business, using business contact information described in Section 2, about how our services relate to their business. We do this only where the law allows: in Canada, with consent, including consent implied where an address has been conspicuously published and the message relates to the person's business role, and in the United States, in line with the CAN-SPAM Act. Every such email identifies Susanoo Inc., gives our mailing address, and includes a way to unsubscribe, and we act on unsubscribe requests within the time the law requires.

g) To create, show, and send the roadmap, website report, and guides you ask for, and, once we start sending them, the benchmark, as described under ROADMAP REQUESTS, WEBSITE REPORTS, and GUIDES AND NEWSLETTER below.

h) To assess applications and prepare for the discovery call, as described under BOOKINGS below.

LEGAL BASIS. In Canada, we rely on your consent (express or implied, as appropriate) and on other bases permitted by PIPEDA and Quebec's Law 25, such as performing a contract with you, meeting a legal obligation, or a legitimate business purpose that a reasonable person would consider appropriate. For visitors in the European Economic Area or the United Kingdom, our legal bases are consent, performance of a contract, legal obligation, or legitimate interests not overridden by your rights. We will tell you if information is required to provide a service and the consequences of not providing it.

ROADMAP REQUESTS. When you request a roadmap, we use your email address, your industry, your region, and the parts of the business you handle yourself to build a personalized draft roadmap, which we email to you. We are not sending benchmarks at present; when we start, we will update this section first. The roadmap is generated automatically from your answers and a person can review it on request; it is not a decision about you. If you give us your business's website address, we also email you a website report, described under WEBSITE REPORTS below. We send these emails because you ask for them, on your consent. We do not add you to our marketing emails unless you tick the separate, optional box on the form, and you can unsubscribe from any email we send.

BENCHMARKS FROM PUBLIC INFORMATION. Once we start sending benchmarks, each benchmark is built from the public business information described in Section 2(d), combined across many businesses. A benchmark never names a business, and we show a benchmark figure only where it combines information from at least five (5) businesses. The figures are estimates from public information on the date we collected it and may be incomplete or out of date. We keep the business-level information used to build benchmarks for no more than ninety (90) days after we combine it, and then delete it, keeping only the combined figures, which do not identify anyone.

BOOKINGS. When you book the discovery call, you use a booking calendar run for us by LeadConnector (GoHighLevel). We use your name, email, phone number, and answers to arrange the booking, to confirm it and remind you of it by email, and to prepare for the call. We do not send booking texts at present.

GUIDES AND NEWSLETTER. When you request a guide that we send by email, we email it to you; a guide that is not yet ready to send is shown on its page instead, and we tell you so on the screen. When you subscribe to our newsletter, we email you once to confirm, and then send each issue until you unsubscribe. We keep a record of what you asked for, the wording you agreed to, its version, and the date and time.

WEBSITE REPORTS. Our free website report checks a website that you confirm is your business's own, either on our website or as a step in the roadmap request. We read the public page at the address you give us, plus the site's robots.txt and sitemap files, as the site delivers them, and we ask Google's PageSpeed Insights service to load the page to measure its speed, how it displays on mobile, and some accessibility basics, so Google receives the page's address but not your email or other contact details. We also send the results of the checks, but not your website's address, your email or other contact details, to Anthropic's AI service to write the short summary at the top of your report. We do not log in, fill in forms, follow other links, or read a site whose robots.txt file names our report and asks it not to. We do not keep the text of any page we read. On our website, the report shows on screen, and if you do not give us your email there, we do not keep your website's address or your report, and we do not contact you. When you ask for the report by email, through the roadmap or with the box on our website, we keep your website's address, your industry and the results of the checks with your request, email the report to you, and keep it as described in Section 8. We send the report because you ask for it, and we do not add you to our marketing emails unless you tick the separate, optional box. To limit the number of free reports, we keep daily counts under a coded form of your IP address and of the website's address, not the addresses themselves, and we delete them within two (2) days. If you give us your email and tick the box to receive marketing messages, we keep your email, your website's address (without any page path), your industry, the date, a one-line summary of the report, your country, and your province or state, with a record of the wording you agreed to, its version, and the date and time, and we use them to send you marketing messages until you unsubscribe. If you are in Quebec, we do not keep your email or send you a report or anything else; on our website, the report shows on screen only.

When we run customer operations on behalf of a business client (for example, answering that client's calls, following up with that client's leads, and booking that client's appointments), the personal information of that client's customers is processed by Susanoo on the client's behalf. In that context the client is the controller (or, under PIPEDA, the organization responsible) for that information, and Susanoo acts as a service provider/processor under our agreement with the client. Our handling of that information is governed by our client agreements. This Privacy Policy governs information we collect as a controller, such as information about visitors to our Website and about our own clients and prospects.

We use reasonable and appropriate administrative, technical, and organizational safeguards to protect Personal Information against loss, misuse, and unauthorized access, alteration, or disclosure, and we require our service providers to apply comparable protections. No method of transmission or storage is completely secure. If you believe your interaction with us is no longer secure, contact us using the details in Section 14.

We share Personal Information only as described here:

a) With affiliates, for purposes consistent with this Privacy Policy.

b) With service providers and processors who operate the Platform and our business for us, such as LeadConnector LLC (GoHighLevel) for CRM, scheduling, tracking, and messaging; Netlify for hosting, forms, and the functions that run our free tools; Google for analytics, for our business email, documents, and calendars (Google Workspace), and for the speed test in our free website report (PageSpeed Insights); Functional Software, Inc. (Sentry) for error monitoring, which receives technical diagnostic information such as the page address, browser type, and IP address when something on our Website or in our forms fails; Stripe for payments; Supabase for our records of consent, of the emails we send, of unsubscribe requests, and of the website reports you ask for, and for the software we build; Resend for the emails our website sends and for email sent by the software we build; Notion for internal documents; Anthropic and ElevenLabs for artificial intelligence features; email and sales-engagement providers we use to send business emails; and other payment, communications, and IT providers. Our contracts limit their use of your information to providing services to us. PageSpeed Insights receives only the address of the page being tested, never your email or other contact details, and Google may use that address under its own terms and privacy policy. We configure our error monitoring to remove email addresses and telephone numbers before a report is sent, and it does not set cookies on your device.

c) With partners, where we work together on a specific offering, study, or promotion, with a lawful basis and, where required, additional notice.

d) For advertising and marketing, with partners who help us deliver and measure campaigns, in line with your preferences and our Cookie Policy.

e) For connections to third-party services you authorize, such as a calendar, social account, or, if you connect it, YouTube (in which case Google's Privacy Policy also applies, and you can revoke access through Google's security settings).

f) In a sale, merger, financing, or other corporate transaction involving our business or assets.

g) When required by law or legal process, to protect rights, safety, and the security of the Platform.

h) With your consent, in any other case.

MOBILE AND SMS DATA. Susanoo does not share mobile-originated data or consent information, including SMS opt-in data, text-message consent records, and mobile phone numbers provided through the Platform, with third parties or affiliates for their own marketing or promotional purposes. Such information is shared only with subcontractors and service providers that help deliver the messaging service itself (for example, appointment reminders and service communications). This is intended to comply with carrier and toll-free messaging requirements.

BUSINESS EMAIL AND UNSUBSCRIBE RECORDS. When we email a business, we keep a record of where we found the address, the basis on which we contacted the person, what we sent and when, and any unsubscribe request. If you unsubscribe or ask us to delete your information, we delete it from our prospect records but keep your email address on a suppression list, so that we can keep honoring your request. We do not sell or transfer an address after an unsubscribe request, except to a provider that helps us honour it.

We may share Non-Personal Information, such as aggregated or anonymized data, for analysis and product development. Susanoo does not sell your Personal Information for monetary compensation.

Susanoo operates in Canada and the United States, and our service providers may store or process information in either country or elsewhere. As a result, your Personal Information may be transferred to, stored in, and processed in a country other than the one where it was collected, including the United States, and may be subject to the laws of those countries, including lawful access by courts, law enforcement, and government authorities. We use contractual and other appropriate safeguards for these transfers, consistent with PIPEDA, Law 25, and other applicable laws.

Our platform provider, LeadConnector LLC (GoHighLevel), maintains its own certifications and safeguards for the data it processes, which may include certification under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework. Susanoo Inc. is not itself certified under the Data Privacy Framework. For transfers of information that we control, we rely on our service providers' safeguards and on contractual measures rather than on a Susanoo certification.

We retain Personal Information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including legal, regulatory, tax, accounting, and reporting requirements, and to resolve disputes and enforce agreements. We may retain information longer where there is a complaint or a reasonable prospect of litigation. When information is no longer needed, we delete or anonymize it. We may use anonymized information indefinitely. We keep records of marketing consent and of the business emails we send for as long as we contact you and for three (3) years after our last message to you, and we keep an unsubscribed email address on our suppression list for as long as we need it to honour your request.

Roadmap requests, website report requests, applications, bookings, and guide requests from people who do not become clients are kept for twenty-four (24) months from our last contact with you, then deleted. Where you have agreed to marketing messages, including our newsletter, we keep a record of that consent, its wording and version, and the date and time, for as long as we contact you and for three (3) years after our last message. Business-level public information used for benchmarks is kept as described under BENCHMARKS FROM PUBLIC INFORMATION in Section 3.

Website reports we store, because you asked for one through the roadmap or asked us to email it to you, are kept for twenty-four (24) months from the date you asked for the report, then deleted. If the record of your request is deleted first, or you ask us to delete your information, the report is deleted with it. A website report you run on our website without giving us your email is not kept, and the daily counts we use to limit free reports are deleted within two (2) days.

We do not knowingly collect Personal Information from children under 16, or under the minimum age in your jurisdiction (such as 13 in the United States under COPPA). If you are under that age, do not provide us with Personal Information. If you believe a child has provided us information, contact us using Section 14 and we will take steps to delete it.

The Platform may link to third-party sites and services that we do not control. This Privacy Policy does not apply to them, and we are not responsible for their practices. Please review their policies.

If your browser sends a Global Privacy Control or Do Not Track signal and you have not made a choice on our cookie banner, we treat the signal as a choice to reject analytics cookies, and analytics stays off unless you turn it on yourself. If you made a choice on the banner earlier, that choice stays in place until you change it. Our Cookie Policy explains how. You can also control cookies through your browser settings.

Under PIPEDA and Quebec's Law 25, and subject to legal limits, you may:

• ask whether we hold Personal Information about you and request access to it;
• request correction of inaccurate or incomplete information;
• withdraw your consent to our use of your information (this does not affect processing already carried out, or processing on other legal bases);
• request that we stop sending you marketing communications; and
• in Quebec and in some other cases, request portability of your information and ask about automated decision-making.

To exercise these rights, contact us using Section 14. We may ask you to verify your identity, and we will respond within the timeframes required by law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d'accès à l'information du Québec.

These sections apply to residents of US states with comprehensive privacy laws. Susanoo does not sell your Personal Information. Where these laws give you the right to opt out of "sharing" for cross-context targeted advertising, you may exercise it using Section 14 or the controls on the Platform.

a) California (CCPA, as amended). California residents may request notice of, access to, correction of, and deletion of their Personal Information; opt out of any "sale" or "sharing"; limit the use of Sensitive Personal Information; and not be discriminated against for exercising these rights. You may use an authorized agent. We verify identity before responding.

Categories of Personal Information we may collect from California residents in the past 12 months: identifiers (such as name, email, phone, IP address); commercial information (such as services purchased or enquired about, and the annual revenue band and number of users you give us); internet activity (such as how you interact with the Website); geolocation (general, region level); and inferences drawn from the above. We collect these to operate and improve the Platform, communicate with you, and for marketing, as described in Section 3, and we disclose them to the service providers and partners described in Section 6. We retain each category for as long as described in Section 8. We do not sell this information.

b) Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Virginia (VCDPA), and other states with comprehensive consumer privacy laws. Residents of these states have rights to be informed about, access, correct, and delete their Personal Information, and to opt out of targeted advertising, sale, and certain profiling. You may exercise these rights using Section 14, and, where the law provides, appeal a decision by contacting us again.

For questions about this Privacy Policy or to exercise your rights, contact us at privacy@susanoo.ai. Our designated Privacy Officer is Emaan Baig, Chief Executive Officer, who can be reached at privacy@susanoo.ai or by mail at Susanoo Inc., 100 King Street West, Suite 5700, Toronto, ON M5X 1C7.