Legal
Privacy policy
What I collect, why, where it's stored, how long I keep it, and how you can see or delete it. Last updated October 19, 2026.
Starting template. This policy is written in plain language as a starting point and is pending review by a lawyer licensed in the United States and Canada. If anything here is unclear, ask through the contact form.
Who is responsible
BigRed (bigred.agency) is a remote SEO, Google Ads and website-rescue business serving clients in the United States and Canada. There is no office and no phone line. The person in charge of protecting personal information is Vlad, Co-founder. You can reach him about any privacy question through the contact form.
What I collect
Information you give me
- Contact form: your name, email address, website address (optional) and your message.
- Service questionnaires: your contact details, your business name and website, what you need help with, your goals, timeline and budget range, and anything else you choose to write.
- Project work: emails, shared documents and notes from video calls. When we work together, I ask you to add me as a user on your own accounts. I never ask for passwords through a form.
Information collected automatically
- Security and server logs: the site is hosted on Cloudflare, which processes technical data such as IP address, browser type and the pages requested, to deliver the site and block attacks.
- Spam protection: forms may use Cloudflare Turnstile, which checks that a real person is submitting the form.
- Submission record: when you send a form, I log the time, the page, your IP address and your consent choices with your answers, as proof of what you agreed to and to block spam.
- Analytics, only if you accept: see Analytics and cookies below.
Why I use it
- To reply to you, prepare a plan and a quote, and do the work you hire me for.
- To send invoices and keep the business and tax records the law requires.
- To keep the website and forms secure and free of spam.
- To understand which pages are useful, only if you accept analytics.
I don't sell or rent personal information. I don't add you to a marketing email list unless you clearly ask to be added, and every marketing email would include a way to unsubscribe, as Canada's anti-spam law (CASL) requires. Replies to your own questions and quotes are not marketing.
Who helps me process it, and where
I use a small number of service providers. Each one only gets what it needs to do its job.
| Provider | What it does | Where data is processed |
|---|---|---|
| Web3Forms | Delivers form and questionnaire submissions to my inbox | United States |
| Google Workspace (Gmail, Sheets, Docs) | Email, a lead and project log, and project documents | United States |
| Cloudflare | Website hosting, security, spam protection (Turnstile) | Global network, US company |
| Google Analytics 4 | Visit statistics, only after you accept | United States |
Because these providers are in the United States, your information may be stored outside your province or country, and authorities there may be able to access it under their laws. Before using a provider, I check its security and privacy commitments, as Quebec's Law 25 expects for transfers outside Quebec.
Analytics and cookies
By default, this site sets no analytics or advertising cookies. If analytics is switched on, a banner asks first, with "Accept" and "Reject" given equal weight. Google Analytics only loads after you click "Accept". It uses Google Consent Mode, with storage denied until you agree. Advertising features stay off either way.
Your browser's local storage keeps two small preferences: your light or dark theme and your analytics choice. While you fill in a questionnaire, it also keeps a draft of your answers (not your name, email or consent choices) so you can finish later; the draft is deleted when you submit, and expires after 30 days. All of this stays on your device and is not sent to me until you submit. You can change your analytics choice at any time with the "Cookie settings" link in the footer, or by clearing your browser's site data.
How long I keep it
- Inquiries that don't become projects: deleted or anonymized within 24 months of our last contact.
- Client project records: kept while we work together and afterwards for as long as tax and accounting law requires (typically six years in Canada and up to seven years in the US). Working notes that aren't needed for those records are deleted sooner.
- Analytics data: Google Analytics retention is set to 14 months.
Your rights
Wherever you live, you can ask me to:
- tell you what personal information I hold about you and give you a copy;
- correct information that's wrong or incomplete;
- delete your information, unless I must keep it by law;
- withdraw a consent you gave, such as analytics or a mailing list;
- receive information you gave me in a structured, commonly used format (data portability).
Send requests through the contact form. I'll confirm who you are, then answer within 30 days. There's no charge for a reasonable request.
If you're not satisfied with my answer, you can complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec if you're in Quebec, or to the privacy regulator where you live.
Security
Accounts that hold your information use strong unique passwords and two-factor authentication, and access is limited to what the work needs. If a privacy incident creates a risk of serious harm to you, I'll tell you and notify the regulators as the law requires.
Children
This site and its services are for businesses. They're not directed at children, and I don't knowingly collect information from anyone under 16.
Changes to this policy
If this policy changes, the new version goes on this page with a new "last updated" date. Important changes will be pointed out at the top of the page.