Privacy Policy

1. Scope and roles

This policy applies to the sites, forms, accounts and services operated by Weberly, including the free preview, Weberly Sites, RankLift, Weberly Ads, Weberly Calls, Advanced SEO and Weberly AEO.

Weberly is responsible for the information collected for its own business relationships, accounts, billing, support and service improvement. When we process the information of a client business’s customers, callers, employees or contacts solely to provide that business with a solution, Weberly acts as a service provider; the client business remains responsible for its own notices, consents, instructions and obligations toward those individuals.

2. Information we may collect

• Identity and contact details: name, business, role, email, phone, address and communication preferences.
• Account and client relationship: credentials, access rights, activated services, support requests, approvals, contract, billing and history of exchanges.
• Business and content: domain, services, service areas, hours, text, images, trademarks, offers, reviews and other elements provided or accessible on the properties you ask us to analyze.
• Technical data: IP address, device, browser, logs, date and time, pages viewed, visit source, actions and errors.
• Performance data: campaigns, keywords, queries, budgets, clicks, conversions, calls, forms, site statistics and local presence.
• Communications: emails, messages, review requests, support notes and, where configured and announced, calls, recordings and transcripts.

We ask that you avoid sending us sensitive information that is not necessary for the service.

3. How the information is collected

We collect it directly from you, your team or your customers; from the accounts you connect; through our sites, forms, numbers and applications; from authorized providers; and from public sources you ask us to analyze, such as your website or your business listing.

Our technologies may identify a browser or an account, measure an action, attribute a request to an advertising source, estimate a general location from the IP address, or analyze and classify the content of a call. Non-essential identification, location or profiling functions are disabled by default where consent is required and can be enabled through the choice presented. They are not used to establish a credit profile or to make a legal decision about you. Certain functions automate a recommendation or an action only according to the configuration authorized by the client.

4. Why we use the information

• provide, configure, personalize and support the requested services;
• create a preview, communicate with the prospect who requested it and carry out the related sales follow-up;
• build, host, maintain and measure a website;
• manage a Google presence, a campaign, a reputation, content or calls;
• authenticate users, prevent fraud, protect systems and resolve incidents;
• process billing, meet our obligations and document authorizations;
• improve our functions, processes and quality, including through aggregated or de-identified data;
• comply with a legal obligation or respond to a valid request from an authority.

You can ask to stop receiving our commercial communications by using the unsubscribe mechanism or by writing to [email protected]. Messages necessary for the service may continue.

5. Data processed by product

6. Data from Google services

6.1 Google Business Profile — RankLift

With the authorization of an owner or manager, RankLift uses Google OAuth and the https://www.googleapis.com/auth/business.manage scope. It may access account and location information, reviews, replies, media, posts and metadata in order to select locations, sync and reply to reviews, publish, monitor changes and display the connection status.

OAuth tokens are encrypted at rest and exchanges are protected in transit. Weberly does not sell Google user data, does not use it for advertising, does not transfer it to data brokers and does not use it to train generalized artificial-intelligence models or make credit decisions.

You can disconnect Google Business Profile in RankLift or revoke access in your Google account permissions. Disconnecting deletes the tokens and stops synchronization. Cached Google Business Profile data is deleted within 30 days, except where a legal obligation or a documented security need applies.

6.2 Google Calendar

With your authorization, Weberly may access the list of calendars, availability and the information needed to create, modify or delete the appointments generated by the site or an activated function. We do not access the content of events unrelated to the appointment beyond what is necessary to determine availability. Availability data is checked at the moment of the request and is not retained.

Tokens are encrypted and exchanges protected in transit. Disconnecting deletes the tokens and stops future access. Google Calendar data is not sold, not used for advertising or credit, and not used to train generalized AI models.

Weberly’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Calls, recordings and communications

Depending on the Weberly Calls configuration, a call may be recorded, transcribed, summarized, tagged and linked to a campaign or a source. A notice must be presented before or at the start of the recording, with the relevant purposes. If a person refuses the recording, the client business must offer a reasonable alternative where the law requires it.

Weberly and its providers process this data solely to route the call, provide the requested functions, support the client, secure the service and comply with the law. The client business determines who is authorized to view it and the appropriate operational retention period within the options offered. No automated system should be used on its own for a medical, legal, credit, employment or emergency decision.

8. Artificial intelligence and automated decisions

AI providers may process the content needed to produce a preview, draft or summarize content, transcribe a note or a call, analyze a campaign, classify a request or prepare a reply. We limit the data transmitted to what is necessary for the requested function and govern our providers through their contracts and available settings.

Data received from Google APIs is not used to train generalized models. Weberly does not sell personal information to train models. Automated outputs can be inaccurate; they are intended to support human work or execute a configured automation, not to produce a significant legal effect on a person on their own.

9. With whom the information may be shared

We may share it with the Weberly employees and collaborators who need it, with the client business concerned, and with providers that perform a function for us, including:

• hosting, security, authentication and storage, for example Cloudflare and cloud providers;
• Google platforms for Business Profile, Ads, Analytics, Calendar, Maps and related services;
• telephony, messaging and call management, for example Allo and Twilio depending on the configuration;
• email, support, appointments, billing and client relationship;
• analysis, transcription and artificial intelligence needed for a requested function;
• professional advisors, authorities or parties to a transaction where the law permits or requires it.

These providers are authorized to process the information only for the agreed services and according to their contractual and legal obligations. Weberly does not sell your personal information.

10. Processing outside Québec

Some providers and their infrastructure may process or store information elsewhere in Canada, in the United States or in other countries. Local laws may then allow access by their authorities. Before a transfer outside Québec, Weberly assesses the relevant factors and puts in place the contractual, organizational and technical measures deemed appropriate. You can write to us for more information about the categories of providers used for your service.

11. Retention and destruction

We keep information only for as long as necessary for the service, support, security, legal obligations and limitation periods. The duration varies by category, product, configuration and client agreement. At the end of that period, it is destroyed or de-identified in a reasonable manner.

The more specific rules stated above apply to cached Google data and disconnected tokens. Transaction, billing or consent records may be kept longer where the law or the defence of rights requires it. A client business may request the export or deletion of the data processed on its behalf, subject to these obligations.

12. Security measures

Weberly uses measures proportionate to the sensitivity and the context, including encryption in transit, access control, authentication, logs, backups and provider management. Google access tokens are encrypted at rest. No system is perfectly secure, however; we cannot guarantee the complete absence of incidents.

If an incident presents a risk of serious harm, Weberly applies its process for assessment, mitigation, record-keeping and notification in accordance with the law.

13. Cookies, local storage and measurement

Our sites and applications may use cookies or local storage that are essential for security, sessions, preferences and operation. Measurement or advertising tools may also be enabled to understand usage and attribute a conversion. Where consent is required, non-essential technologies are enabled according to the choice presented.

You can change your browser settings. Blocking essential technologies may, however, prevent certain functions. Third-party sites reached by link apply their own policies.

14. Your rights and your choices

Subject to the exceptions provided by law, you may request access to your information, its correction, its deletion where applicable, the withdrawal of a consent and, in certain cases, its portability. You may also request details about the use of an automated technology or file a complaint.

We may verify your identity and your authority before responding. Where a request concerns data held for a client business, we may direct you to that business or work with it. Withdrawing a consent may prevent a function that depends on it, without retroactive effect on processing that was already lawful.

You can also revoke a Google connection in your Google account and unsubscribe from commercial communications. Our services are aimed at businesses and are not directed at children under 14; we do not knowingly collect their information without appropriate authorization.

15. Changes to this policy

We may update this policy as our products, providers or obligations evolve. The effective date is shown at the top. If a significant change creates a new use incompatible with the consent obtained, we will provide appropriate notice and request a new consent where required.

16. Officer and contact details