Privacy Policy

1. Overview

This Privacy Policy explains how Scotell ("Scotell", "we", "us") collects, uses, shares and protects personal information when you use scotell.com, Scotell reports, Scotelligence and Telli. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Our Privacy Officer is accountable for how we handle personal information and can be reached at info@scotell.com.

2. Information we collect

We collect only what we need for the purposes in section 3:

• Account information: name, email address, and how you sign in (Google or email and password, through Firebase).
• Profile and preferences: what you use Scotell for, onboarding answers, time zone and email preferences.
• Research inputs: business ideas, locations, budgets, intake answers, and the business websites and details you give us.
• Telli conversations: your messages, files you attach, and the drafts, plans and tasks Telli prepares.
• Safety records: for each message you send to Telli, the result of our automated safety check (allowed, redirected or blocked, and which rule matched), any review by our staff, and any suspension or ban of your account.
• Generated content: reports, scores, budgets, plans and monitoring results.
• Purchases: what you bought, amounts, taxes, and your billing country and province. Card details go directly to our payment provider; we never see your full card number.
• Technical and usage data: IP address, approximate location derived from it, browser and device, pages and features used, and error logs.
• Email delivery data: whether an email we sent was delivered or bounced.

3. How we use your information

We use your information to:

• Run the Service: generate and store your reports, run monitoring scans, answer you in Telli, and show your history.
• Keep your account secure: sign you in, prevent fraud and abuse, enforce usage limits, and investigate incidents.
• Keep Telli safe: check each Telli message automatically against our safety rules, show fixed safety messages and helplines chosen by the country you gave at sign-up, and let authorized staff review messages that match a safety rule and suspend or ban accounts that break our Terms.
• Suggest a city and currency when you start a report, using the approximate location from your IP address. We do not track your precise location.
• Send emails: report-ready and account emails that are part of the Service, and digests, check-ins and product news as described in section 6.
• Process payments, send receipts, and handle refunds and taxes.
• Improve the Service, mostly with aggregated data, such as which features are used and what each report costs us to produce.
• Meet our legal, tax and accounting obligations.

4. Service providers we share data with

We share personal information only with service providers that process it on our behalf, and only as much as each one needs:

• Google Firebase: sign-in and identity (name, email, login tokens).
• Vercel: hosting for the website and API (every request to the site).
• Supabase: our main database (everything stored in your account).
• Railway: the servers that generate reports, run scans and render PDFs (report inputs and generated content).
• Upstash: the job queue that hands work to those servers (job details such as report and scan IDs).
• OpenRouter, and the AI model providers it routes requests to, and OpenAI: AI analysis, report writing and Telli (report inputs, business details and Telli messages). This includes the automated safety check on each Telli message, which runs on a classification model (TypeSafe JEV) through OpenRouter.
• Tavily, Exa, Brave Search, Mojeek, DataForSEO and Zyte: web search, search-demand data and page fetching (search queries built from your idea, location and business details).
• Google Maps Platform and Foursquare: maps, competitor and place data (locations and business categories).
• IPinfo: approximate location from your IP address.
• Resend: sending email (your email address and the email content).
• Our payment provider, when paid plans launch: payments and sales tax (billing details).

5. Processing outside Canada

Most of our service providers store or process data outside Canada, mainly in the United States. While your information is in another country it is subject to that country's laws, and may be accessible to its courts, law enforcement and national security authorities. We choose providers with strong security practices and contractual privacy commitments.

6. Emails and your choices

Transactional emails, such as report-ready notices, receipts and security or account notices, are part of the Service. Digests and check-ins (the weekly digest, alert digest and Telli launch check-in) can be switched off one by one in Settings, or all at once with the unsubscribe link in any email, and opt-outs take effect immediately. We send promotional emails only with your consent, and each one includes a working unsubscribe link and our mailing address.

7. How long we keep it

We keep your account, reports, Scotelligence data and Telli conversations while your account is open. When you delete your account, your data is removed from our live systems right away and from backups as they cycle out. Technical logs and AI usage records are kept for a limited period and then deleted or aggregated. Purchase and tax records are kept for six years after the tax year, as Canadian tax law requires. Telli safety records are kept while your account is open. Records of messages that matched a safety rule, and of any suspension or ban, may be kept after you delete your account for as long as we need them to prevent the same abuse, to defend legal claims, or to meet a legal duty to report or preserve them. Shared report links stop working when they expire or you revoke them.

8. Your rights

You can:

• Access the personal information we hold about you, and download it as a file from Settings.
• Correct inaccurate or incomplete information.
• Delete your account and its data from Settings.
• Withdraw consent to optional uses, such as digests and promotional email.
• Ask us questions or make a complaint at info@scotell.com. We reply within 30 days and may need to verify your identity first.
• If you are not satisfied with our answer, complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

9. Security

We use encryption in transit (TLS), verify sign-in tokens on the server for every request, restrict who can access production data, and review our security regularly. No system is completely secure. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as soon as feasible, as the law requires.

10. Cookies & Session Data

We use only strictly necessary cookies: "__session", which holds your authentication token and keeps you signed in, "scotell_device", which remembers this device so you stay signed in for up to 12 months, "scotell_session", which tells the page a session exists, "scotell_cookie_consent", which records that you accepted the cookie notice, and "scotell_unlocked", which records that you have been granted access to a restricted preview. We do not use advertising, analytics or tracking cookies, and we run no third-party tracking scripts. Our full Cookie Policy is at /cookies.

11. Children's Privacy

The Service is for people 18 and older. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

12. Changes to This Policy

If we make a material change, we will update the date above and tell account holders in the app, and by email where practicable, before it takes effect.