Privacy Policy

SRS Tool operates the website at srstool.com and provides the SRS Tool software-as-a-service platform. We are based in Toronto, Ontario, Canada. For privacy questions, contact us at support@srstool.com.

Information you provide directly:

• Account information: Name, email address, and password when you register
• Business information: Business name, Google Business Profile URL, logo
• Billing information: Handled by Stripe — we receive only your billing email and subscription status, not your raw card number
• Support communications: Any messages you send to us via contact form or email

Information collected automatically:

• Usage data: Pages visited, QR code scans, Google review link clicks (aggregated counts, not linked to individual identities)
• Device data: Browser type, operating system, device type — used for analytics and display compatibility
• IP address: Used for security, fraud prevention, and approximate location (country/region level)
• Cookies and session data: See Section 9 for details

We use your information for the following purposes, consistent with PIPEDA's requirement for a legitimate purpose:

• To create and manage your account
• To provide and improve the Service features you use
• To process payments and manage your subscription via Stripe
• To send transactional emails (account creation, receipts, trial reminders, feedback alerts)
• To send marketing emails — only with your consent and with an easy opt-out (see Section 12)
• To monitor for abuse, fraud, and security issues
• To analyze how the Service is used (in aggregate, anonymized form) to improve it
• To respond to your support requests

We do not sell your personal information. We do not use your data for targeted advertising.

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

We may share your information in these limited circumstances:

• Service providers: Companies that help us operate the platform (see Section 5). They are contractually bound to only use data to deliver their services to us.
• Legal requirements: If required by law, court order, or government authority in Canada
• Business transfer: If SRS Tool is acquired or merged, your data may transfer to the new entity, who must honor this Privacy Policy
• With your consent: For any other purpose you explicitly approve

We use the following third-party services to operate SRS Tool. Each has its own privacy policy:

Some of these providers are located outside Canada. By using SRS Tool, you consent to the transfer of your information to these countries, which may have different data protection standards than Canada. We rely on standard contractual clauses and equivalent protections where applicable.

When your customers submit private feedback through your SRS Tool review page, they may provide their name, email address, and message. This information is stored securely in your dashboard and is visible only to you (the business account holder) and SRS Tool staff as needed for technical support.

As a business using SRS Tool, you are responsible for handling your customers' personal information in compliance with applicable privacy laws. You should not use their contact details for purposes beyond responding to their feedback without their separate consent.

We do not use end-customer feedback data for advertising, profiling, or any purpose other than delivering the feedback to you and providing you with aggregated analytics.

We retain your personal information for as long as your account is active or as needed to provide the Service. You may request deletion of your account and data at any time by emailing support@srstool.com.

After account deletion, we may retain anonymized, aggregated usage data (with no personally identifiable information) for up to 2 years for analytical purposes. Billing records may be retained for up to 7 years to meet Canadian tax and accounting requirements.

We implement reasonable technical and organizational measures to protect your personal information, including:

• TLS/HTTPS encryption for all data in transit
• Row-level security on the database (Supabase RLS)
• Passwords are never stored in plain text — authentication is handled by Supabase Auth
• Payment information is never stored on our servers — managed by Stripe's PCI-DSS certified infrastructure
• Limited staff access to production data, on a need-to-know basis

No method of electronic transmission or storage is 100% secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how the Service is used. We do not use third-party advertising cookies.

• Essential cookies: Required for authentication and core functionality. Cannot be disabled.
• Analytics cookies: Help us understand usage patterns. These are anonymized.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in to the dashboard.

Under PIPEDA and applicable Canadian law, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Ask us to correct inaccurate or incomplete information
• Deletion: Request deletion of your account and personal data
• Withdrawal of consent: Withdraw consent for non-essential uses (such as marketing emails) at any time
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise any of these rights, email us at support@srstool.com. We will respond within 30 days.

SRS Tool is intended for use by business owners and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us at support@srstool.com and we will promptly delete it.

We comply with Canada's Anti-Spam Legislation (CASL). We will only send you commercial electronic messages (such as product updates or promotional offers) if you have given express or implied consent.

Every marketing email we send includes an unsubscribe link. You can opt out at any time, and we will process your opt-out within 10 business days.

Transactional emails (such as account confirmations, subscription receipts, and feedback alerts you requested) are not subject to CASL opt-out requirements, as they relate directly to your use of the Service.

We may update this Privacy Policy periodically. When we make significant changes, we will notify you by email and/or by posting a notice on the Service. We encourage you to review this page regularly.

Your continued use of SRS Tool after any changes to this policy constitutes your acceptance of those changes.

If you have any questions, requests, or complaints about this Privacy Policy or our privacy practices, please contact us:

You may also contact the Office of the Privacy Commissioner of Canada:
www.priv.gc.ca  ·  1-800-282-1376