Privacy Policy

Introduction

Oasbit ("we," "our," or "us") operates oasbit.com and related booking, checkout, and report pages. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our website, submit forms, book a call, request a visibility report, subscribe to email, or purchase services.

This policy covers our marketing site and the services we sell through it (including End to End, web, apps, ads, SEO, GEO, consultation, social, white-label, and related applications we market). Separate products we operate or link to (for example myOasbit CRM, Portal, Trading Agents at trade.oasbit.com, or Render Reno at renderreno.ai) may have additional notices. Where those products collect data on their own domains, their policies also apply.

We offer business-to-business (B2B) digital services to companies and professionals, including clients in the European Union, European Economic Area, and United Kingdom. When we offer services to or monitor the behaviour of people in those regions, the EU/UK GDPR applies in addition to Canadian and other applicable laws (PIPEDA, Quebec Law 25 where it applies, and US state laws such as the CCPA/CPRA).

1. Who we are

Controller: Oasbit, 2967 Dundas St W #931, Toronto, ON M6P 1Z2, Canada. Privacy requests: privacy@oasbit.com. General: info@oasbit.com. Phone: +1-888-884-9891.

Privacy Officer (PIPEDA / Law 25): privacy@oasbit.com. You may also write to dpo@oasbit.com.

1.1 EU / UK representative (Art. 27)

Because we are established in Canada and offer B2B services to the EU/EEA and UK, GDPR Article 27 (and the UK equivalent) may require a local representative. Until a representative is appointed and published here, EU/EEA and UK privacy requests should be sent to privacy@oasbit.com or dpo@oasbit.com. When appointed, we will list the representative's name, address, and contact email below without changing how you can also contact us in Canada.

EU representative: Not yet appointed — contact privacy@oasbit.com.
UK representative: Not yet appointed — contact privacy@oasbit.com.

2. Information we collect

2.1 Information you give us

We collect what you submit on our site and in booking widgets. That typically includes:

• Identity and contact: name, email, phone, business name, country, website URL, Google Business Profile URL.
• Newsletter and exit-intent: email, and optionally first and last name.
• Get Started / Growth Strategy Session: priorities, country (including a detected country from your connection when shown), whether you have a website, how soon you want to start, business type, marketing channels, budget, business description, current and target revenue, and biggest obstacle.
• Cart and checkout: name, email, phone, business name, selected service and package. Card details are entered with Stripe; we do not store full card numbers on our servers. Online checkout is offered in USD or CAD. We do not collect EU VAT on this website; invoices and receipts show our Canadian entity details. EU/EEA/UK business clients are billed in the currency shown at checkout (USD or CAD).
• White-label partner applications: contact details, target audience, website, volume tier, and requested services.
• Free SEO/GEO visibility reports: name, phone, email, business name, website and/or Google Business Profile URL.
• Booking calendars: name, email, phone, and appointment details entered in the HighLevel / LeadConnector calendar iframe.
• Support and other messages: emails, calls, and form notes you send us.

2.2 Information collected automatically

• Device and log data: IP address, user agent, approximate location (city/region/country from IP), browser, device type, referring URL, and pages viewed.
• Session identifier: a session ID stored in your browser session storage for analytics event correlation.
• Advertising and analytics events: page views, clicks, form and checkout events, and conversion events sent to Google Analytics 4, Meta (Facebook/Instagram) Pixel, OpenAI / ChatGPT Ads pixel, and Vercel Analytics.
• Tracking parameters: we preserve query parameters such as utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, msclkid, ttclid, li_fat_id, am_id, affiliate_id, partner_id, promo/discount/referral codes, and similar tags. During your visit we may keep them in memory so navigation works; we write them to local storage and attach them to your lead record only after you grant analytics or advertising consent in Cookie settings (or where local law allows without a banner).
• Form and bot-protection signals: Google reCAPTCHA tokens, honeypot fields, and related bot-detection flags. reCAPTCHA may collect device and interaction data as described in Google's policies.
• Local storage: we store your cookie consent choice, and may store contact-form progress and tracking parameters only as described above and in our Cookie Policy.

2.3 Information from third parties

• Stripe: payment status, customer identifier, billing email, and whether a checkout completed.
• HighLevel / LeadConnector: booking confirmations and CRM contact records created from calendars and webhooks.
• Google: Analytics, reCAPTCHA, and public Google Business / review data we display or use when you ask for a listings audit.
• Meta and OpenAI Ads: conversion match feedback and campaign measurement (we send hashed identifiers; they may match them to their user graphs).
• Visibility-report generation: an automated audit of the website and/or Google Business Profile you submit. The audit output (scores, findings, charts) is stored and shown on a report page.

2.4 Visibility reports

If you request a free SEO or GEO visibility report, we process your contact details and the URLs you provide in order to generate the report. We send the request to our report-generation partner (currently Cursor Automations) and store the finished report in our database, linked to your contact record. We also notify our CRM (LeadConnector) when a report is requested and when it is ready, and we may email or SMS you a link when it is complete.

Report pages live at a unique URL on oasbit.com. They are marked noindex (not listed in sitemaps or search results), but anyone with the link can view that report. Do not share the link if you want it kept private. You should only submit websites and profiles you are authorized to have audited.

3. How we use information

• Respond to inquiries, run strategy sessions, and deliver the services you request or buy.
• Create and update CRM records, assign account teams, and schedule calls.
• Process payments, send receipts, and handle refunds through Stripe.
• Generate SEO/GEO visibility reports and notify you when they are ready.
• Send service messages (booking confirmations, report-ready notices, project updates).
• B2B sales follow-up about an inquiry, quote, report, or engagement you requested (contract or legitimate interests), separate from promotional newsletters.
• Send marketing email or SMS where permitted (CASL / CAN-SPAM / GDPR consent / similar), including newsletters and offers, only when you opt in (for example an unticked marketing checkbox on the form). You can unsubscribe using the link in the message or by emailing privacy@oasbit.com.
• Measure site performance and advertising (including Google Ads, Meta Ads, and ChatGPT / OpenAI Ads) and improve conversion of our forms and checkout.
• Prevent spam, fraud, and abuse (reCAPTCHA, honeypots, IP and device signals).
• Comply with law, enforce our Terms, and protect our rights and users.

4. Legal bases (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we process personal data for the purposes below. Each row lists the typical data involved, our lawful basis, how long we keep it (where stated elsewhere in this policy), and the main processors or platforms involved on this website (verified from our current site implementation).

You may withdraw consent for cookies or marketing at any time via Cookie settings, unsubscribe links, or privacy@oasbit.com. You may object to processing based on legitimate interests as described in Section 10.

5. Cookies, pixels, and similar technologies

We use cookies, pixels, local/session storage, and similar technologies. Essential technologies load to run the site. Analytics and advertising technologies load only after you opt in via our cookie banner or Cookie settings. Details, durations, and category lists are in our Cookie Policy. You can change or withdraw cookie consent anytime from the footer link "Cookie settings."

5.1 What we use

• Essential: consent preference cookie, session and security cookies needed to run the site, cart, and forms; Stripe cookies on checkout; HighLevel calendar cookies inside booking iframes; reCAPTCHA.
• Analytics (consent): Google Analytics 4 (measurement ID G-0XSZJBMHLT) with Google Consent Mode v2; Vercel Analytics.
• Advertising (consent): Meta Pixel (ID 506453365007346) plus Meta Conversions API; OpenAI / ChatGPT Ads pixel plus OpenAI Conversions API. These technologies support cross-context advertising measurement and may be treated as a "sale" or "share" of personal information under California law.
• Fonts and media: Google Fonts and similar CDNs may receive your IP address when pages load.

5.2 Server-side conversion matching

When you have granted advertising consent and you submit a form or complete checkout, we may send hashed identifiers (for example SHA-256 of email or phone), IP address, and user agent to Meta and OpenAI so they can measure ads. Hashed values are used for matching, not to publish your contact details in ads. Without advertising consent, we do not send these conversion events.

5.3 How to opt out of advertising cookies

• Site Cookie settings (footer) — Reject all or turn off Advertising (and/or Analytics).
• Browser settings: block third-party cookies or use a tracking blocker.
• Global Privacy Control (GPC): where required, we treat GPC as an opt-out of advertising / sale-share for that browser until you explicitly allow Advertising.
• Google: Ads Settings and GA opt-out.
• Meta: Ad preferences.
• Industry tools such as the Digital Advertising Alliance opt-out pages where available.
• California / similar US state rights: email privacy@oasbit.com with the subject "Do Not Sell or Share My Personal Information." See Section 11.

6. Who we share information with

We do not sell personal information for money. We do share personal information with service providers that process it for us, and with advertising platforms as described above. Categories of recipients:

• Hosting and storage: Vercel (website), our PostgreSQL database provider, and Vercel Blob for uploaded media such as blog images.
• CRM, email, and SMS: HighLevel / LeadConnector (including calendar widgets on leadconnectorhq.com). They may email or text you about bookings and follow-up.
• Payments: Stripe. See Stripe's privacy policy.
• Analytics and ads: Google, Meta Platforms, OpenAI (ChatGPT Ads), and Vercel Analytics.
• Security: Google reCAPTCHA.
• Report generation: Cursor Automations (and related AI tooling) to produce visibility reports from the URLs you submit.
• Professional advisors: accountants, lawyers, and insurers as needed.
• White-label / partners: only when you apply as a partner or we have a contract that requires it, and only as needed to perform that relationship.
• Legal: if required by law, to protect rights or safety, or in a merger, acquisition, or asset sale (we will require the successor to honor this policy or give you notice).

We do not sell your contact list to unrelated third parties for their independent marketing.

7. International transfers

We are based in Canada and offer B2B services to clients in the EU/EEA and UK. Personal data you provide is transferred to Canada and may be processed in the United States and other countries by our processors (Vercel, Stripe, Google, Meta, OpenAI, HighLevel, and others listed in Section 6). Those countries may not offer the same legal protections as your home country. Where GDPR requires it, we rely on appropriate safeguards such as the EU Standard Contractual Clauses used by those providers, plus their security and transfer documentation. Canada is recognised under EU adequacy arrangements for many transfers to Canadian organisations; we still use processor SCCs where required for onward US processing.

8. Retention

• Leads and CRM records: while we have an active sales or client relationship, then as needed for follow-up and legal claims (typically up to 3 years after last meaningful contact, unless you ask us to delete and no legal hold applies).
• Client project and contract files: for the engagement plus at least 7 years where tax or professional record-keeping requires it.
• Payment records: at least 7 years for tax and accounting.
• Visibility reports: stored with the related contact until deleted on request or as part of routine CRM hygiene.
• Analytics: according to each platform's settings (Google Analytics is commonly retained for up to 26 months unless we configure otherwise).
• Marketing lists: until you unsubscribe or we suppress the address after prolonged inactivity.

9. Security

We use HTTPS/TLS in transit, access controls on admin systems, hashed passwords for staff accounts, and provider-side encryption for databases and blobs. No method of transmission or storage is completely secure. If a breach is likely to result in a real risk of harm, we will notify affected individuals and regulators as required (including, where GDPR applies, without undue delay and generally within 72 hours of becoming aware of a notifiable incident).

10. Your rights (Canada, EU/UK, and generally)

Subject to exceptions in applicable law, you may request access, correction, deletion, a portable copy, restriction or objection to certain processing, and withdrawal of consent. Canadian residents may complain to the Office of the Privacy Commissioner of Canada (and, in Quebec, the CAI). EU/UK residents may complain to their local supervisory authority (ICO in the UK).

Email privacy@oasbit.com. We will verify the request and respond within the time required by law (generally 30 days in Canada and under GDPR; some US state laws allow up to 45 days).

11. US state privacy notices (including California)

In the last 12 months we have collected the following categories of personal information from website visitors and leads: identifiers (name, email, phone, IP, cookie/pixel IDs); commercial information (services viewed or purchased, package interest); internet/network activity (pages, clicks, session IDs, tracking parameters); coarse geolocation (from IP); professional/business information (company, role, website, marketing budget and similar form fields); and inferences used for sales and ads measurement. We do not collect Social Security numbers, driver's licenses, precise geolocation, or biometric identifiers through this website.

We disclose those categories to the service providers and advertising platforms listed in Sections 5 and 6. Under the CPRA, sending identifiers and device data to advertising networks (Meta, Google, OpenAI Ads) can be a "share" for cross-context behavioral advertising. We do not sell personal information for money and we do not sell or share personal information of consumers we actually know are under 16.

California (and similar state) rights include: know/access, delete, correct, opt out of sale/share, limit use of sensitive personal information (we do not use sensitive PI to infer characteristics beyond what is needed for the form you submitted), and non-discrimination. To opt out of sale/share, email privacy@oasbit.com with "Do Not Sell or Share My Personal Information." We will honor Global Privacy Control (GPC) signals as an opt-out of sale/share for that browser where required by law.

We do not use or disclose sensitive personal information for purposes that require a separate "Limit the Use" link beyond the form, payment, and security uses described here.

12. Children

Our site and services are for businesses and adults. They are not directed to children under 16 (or under 13 where COPPA applies). We do not knowingly collect personal information from children. If you believe a child provided information, contact privacy@oasbit.com and we will delete it.

13. Automated decision-making and profiling

We use analytics and advertising platforms to measure and retarget interest in our services. We do not make solely automated legal or similarly significant decisions about you (for example, we do not automatically refuse service without human review of paid engagements). Visibility reports are generated with automated tools; they are informational audits, not credit, employment, or insurance decisions.

14. Client work and third-party platforms

When you hire us, we may process additional business data (brand assets, analytics logins, ad accounts, CRM records, store catalogs) under our contract with you. You are responsible for having a lawful basis to give us access to those systems. We use that data only to perform the engagement, and we follow the access and deletion terms in the contract and this policy.

15. reCAPTCHA

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

16. Changes

We may update this policy. The "Last updated" date at the top will change. Material changes that affect how we use personal information already collected will be announced on this page and, where appropriate, by email. Continued use of the site after an update means you accept the revised policy except where consent is required by law.

Related documents: Cookie Policy, Terms and Conditions, and Lifetime Development Warranty.

17. Contact

If we cannot resolve your concern, you may contact the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec (if you are in Quebec), the ICO (UK), your EU supervisory authority, or the California Attorney General / CPPA, as applicable.