Privacy Policy

Fourdots Digital Inc. ("Fourdots", "we", "us") respects your privacy. This policy explains what information we collect when you visit fourdots.io, how we use it, who we share it with, and the choices you have.

Who we are

Fourdots Digital Inc. is a Toronto-based marketing agency. Our office is at 80 Atlantic Avenue, Suite 400, Toronto, ON M6K 1X9. Reach our privacy contact at hello@fourdots.io.

What we collect

Information you provide

When you submit our strategy session form, book a call, or otherwise contact us, we collect your name, email address, phone number, company name, industry, monthly revenue range, marketing goals, and any details you include in open-text fields.

Information collected automatically

When you visit the site, our analytics and advertising tools may collect:

• IP address and approximate location (city / region)
• Browser type, device type, operating system
• Pages viewed, referring URL, time on page
• Click and scroll behaviour
• Cookie identifiers (subject to your consent — see Cookies below)

We do not sell your personal information.

TurfMap-specific data

If you use TurfMap (our geo-grid local-SEO product, available at turfmap.ai), we additionally collect:

• Business profile data you provide: business name, street address, city, region, postcode, country, phone, website, primary and additional Google Business Profile categories, business description, hours, and photo URLs.
• Tracked keywords you ask us to monitor.
• Geo-grid coordinates we generate from your location to query the Local Pack at each cell of the 81-cell scan area.
• Scan results and derived metrics: rank positions per cell, TurfScore family metrics, competitor leaderboards, NAP-audit findings, and AI Coach playbook output.
• Account and billing data: account email, Stripe customer and subscription identifiers, billing address, and the last four digits of the card on file. Full card numbers (PANs) are handled by Stripe directly via Stripe Checkout — we never see them.

How we use your information

We use the information to:

• Respond to your inquiry and deliver the services you've requested
• Qualify and route your inquiry to the right team
• Run geo-grid scans on your behalf and generate the resulting heatmaps, scores, competitor leaderboards, and AI Coach playbook (TurfMap)
• Submit your business information to third-party citation directories on your behalf (TurfMap Pulse+ only)
• Process payments, manage subscriptions, and send transactional notifications related to your purchase
• Measure marketing performance and improve our advertising
• Operate, maintain, and secure our website and the TurfMap application
• Comply with legal obligations

Our legal bases under PIPEDA and (where applicable) the GDPR are: your consent (for marketing cookies and email follow-up), performance of a contract (when you become a client), and our legitimate interest in operating and improving our business.

Who we share with

We share information only with vetted service providers that help us deliver our services:

• Google (Tag Manager, Ads, Analytics, Fonts) — analytics and advertising measurement
• Pabbly Connect — securely routes form submissions into our internal systems
• GoHighLevel / LeadConnector — calendar booking and CRM
• DreamHost — website hosting
• Reb2b — B2B visitor identification. When you visit fourdots.io we send your IP address and browser fingerprint to Reb2b; if your IP resolves to a business profile in their database, Reb2b returns the company name and (in some cases) contact details to us so we can follow up about agency services. Used only for B2B prospect research, not consumer profiling. Reb2b privacy policy.

Each provider processes data under its own privacy terms and only for the purpose of supporting Fourdots. Google's data may be processed in the United States; the other providers process data in jurisdictions disclosed in their respective privacy policies.

We may also disclose information when required by law, to enforce our terms, or to protect the rights, property, or safety of Fourdots, our clients, or the public.

Sub-processors and third-party services (TurfMap)

The following third-party services process buyer data when you use TurfMap. Each has its own privacy policy, linked below. By using TurfMap you consent to the data flows described.

• Stripe Inc. (United States) — payment processing for all paid tiers and subscription management for Pulse and Pulse+. Stripe receives your card details directly via Stripe Checkout (we never see the PAN), along with your buyer email, billing address, and business name. Privacy policy.
• Resend (United States) — transactional email delivery. Receives your email address and the contents of messages we send you (order confirmations, scan-ready notifications, portal invites, Pulse+ welcome, Stripe Checkout links, weekly competitor digests, monthly PDF reports). Privacy policy.
• Supabase (United States) — primary database and authentication backend for the TurfMap application. Stores all buyer-provided business data (NAP, keywords, locations), all scan results, all derived metrics (TurfScore family, competitor leaderboards), Stripe customer and subscription identifiers, and AI Coach insights. Privacy policy.
• DataForSEO (United States / European Union) — Google Local Pack SERP retrieval at each cell of the geo-grid. Receives the geo-grid coordinates (81 per scan), the tracked keyword strings, and a business name pattern (used to identify your own listing in the SERP results). We do not send your email, phone number, or street address as a string to DataForSEO. Privacy policy.
• BrightLocal (United States / United Kingdom) — citation building and citation status tracking, available on Pulse+ only. Receives your full NAP profile (business name, street address, city, region, postcode, country, phone, website, primary GBP category, additional categories, business description, hours, and photo URLs). BrightLocal submits this profile to approximately 25 third-party industry directories on your behalf — those directories then host your listing under their own privacy and terms. This is a meaningful onward sharing; please review BrightLocal's privacy terms and the policies of the directories where your listing propagates. Privacy policy.
• Anthropic PBC (United States) — AI Coach playbook generation via the Claude API. Receives your business name and location label, the 81-cell rank grid (rank numbers per coordinate, no other PII), the top 10 competitor names observed in the scan, and any NAP-audit findings. Anthropic operates zero data retention for API customers by default — prompts and responses are not retained beyond request processing. Privacy policy.
• Mapbox (United States) — address autocomplete on onboarding forms. Receives partial address strings as you type and your IP address (for Mapbox's own usage tracking). Privacy policy.
• Cal.com (United States / European Union) — strategist-call scheduling for Visibility Audit and Strategy Session purchasers only. Receives your buyer email, business name, and any optional notes you include with the booking. Cal stores the booking record and sends calendar invites. Privacy policy.
• Slack Technologies LLC (United States) — Pulse+ alert delivery, opt-in only. When you connect a Slack workspace via OAuth, we post alert messages (TurfScore movements, new competitor entries, and similar) to the channel you authorized via its incoming-webhook URL. We do not access other content in your Slack workspace. Privacy policy.
• Vercel Inc. (United States) — hosting and CDN for the TurfMap application. Receives standard server logs (IP address, user agent, request path, response time) and runs the application code that serves the dashboard and APIs. Privacy policy.
• OpenStreetMap (Nominatim) (European Union) — server-side geocoding fallback when Mapbox autocomplete is unavailable. Receives address strings only on fallback paths. Privacy policy.

If we add or change sub-processors, we update this list and notify existing TurfMap subscribers via email at least 30 days before the change takes effect, except where immediate change is required by law or to prevent service disruption.

Cookies and tracking

We use three categories of cookies:

• Necessary — required for the site to function (load balancing, session security, consent state). Always on.
• Analytics — help us understand how visitors use the site, which pages perform, and where to improve. Off by default; loaded only with your consent.
• Marketing — measure the performance of our paid campaigns (Google Ads) and let us reach the right audiences. Off by default; loaded only with your consent.

You can change your preferences any time using the Cookie settings link in our footer, or by clearing your browser's site data.

How long we keep it

• Form submissions and CRM records: while we provide services and for up to 7 years afterwards (for tax and contract purposes), or until you ask us to delete them.
• Analytics data: aggregated and retained per Google's defaults (up to 14 months).
• Server logs: up to 90 days.
• TurfMap scan history, business profile, and account data: retained indefinitely by default while your account is active (so historical comparisons and trends remain available). On request to hello@fourdots.io, we delete your account and associated scan data within 30 days, subject to billing records we are required to retain for tax purposes.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your information (subject to legal record-keeping obligations)
• Withdraw consent for marketing communications or non-essential cookies
• Object to or restrict certain processing
• Lodge a complaint with the Office of the Privacy Commissioner of Canada or your local data protection authority

To exercise these rights, email hello@fourdots.io. We respond within 30 days.

International transfers

Some of our service providers (notably Google) process data in the United States. We rely on standard contractual clauses or comparable safeguards as required by applicable law.

Security

We use industry-standard practices to protect your information — encrypted connections (HTTPS), access controls, and vetted sub-processors. No system is perfectly secure, but we work to reduce risk.

Children

Our site is intended for businesses and adults. We do not knowingly collect information from children under 16.

Third-party links

Our site may link to third-party websites. We're not responsible for their privacy practices — review their policies before submitting information.

Changes

We may update this policy. The "Last updated" date at the top reflects the most recent change. Material changes will be highlighted on the homepage or via email if appropriate.