Privacy

Last updated 16 October 2026. Applies to three7.digital.

1. Who this policy is from

This policy covers ThreeSeven Digital, operating at three7.digital. We are a small, remote business based in Ontario, Canada, working with clients across Canada and the United States. There is no office you can visit and no call centre; the person handling your enquiry is the person who does the work.

We are responsible for the personal information described below. The relevant law for us is Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and for the newsletter, Canada's Anti-Spam Legislation (CASL). Where you are in a jurisdiction whose law gives you stronger rights, we will honour those rights rather than argue about jurisdiction.

2. What we collect

Information you type into a form

This site has three forms: the contact form, the free Standards Report request, and the newsletter signup. When you submit the contact form or the Standards Report request, we record:

• Your name, as you enter it
• Your email address
• Your business name and website address, where the form asks for them
• The message or details you write
• The date and time of the submission
• Your IP address, and the page on this site you submitted from

The IP address is not there to profile you. It is how the forms block automated submissions: the same address is limited to a handful of submissions per hour, and the count is discarded automatically after that hour passes. The address itself is stored alongside the message so that if a wave of spam arrives, it can be identified and removed.

The forms do not ask for your phone number, postal address, date of birth, financial information or any government identifier. Please do not send them through a form.

If we talk by phone

Some conversations go better as a call. If so, we may ask for your phone number by email, and giving it is up to you. If you do, we use it only to arrange and hold that call. It is kept with the rest of our correspondence with you, under the same retention and deletion rules as everything else in sections 5 and 6.

If you subscribe to the newsletter

The signup form asks for your email address and nothing else. Nothing is sent to you except a single email asking you to confirm, and you are not subscribed unless you click the link in it. To show that you asked to be on the list, which Canadian anti-spam law requires us to be able to do, we record:

• Your email address
• The exact wording you agreed to when you signed up
• The date, time, IP address and page you signed up from
• The date, time and IP address when you clicked the confirmation link
• The date you unsubscribed, if you do

The free tools

The website expiry check and the AI-friendly filename generator run entirely in your browser. What you type into them is not sent to us or stored anywhere.

The website grader is different, because it runs Google's PageSpeed test for you. When you use it, we record:

• The website address you test, and the results Google returns
• Your email address
• Whether you ticked the box asking for occasional notes, and when
• The date and time, your IP address, and the page you used it from

The address you test is sent to Google's PageSpeed Insights service, which loads that page to measure it. Results for a site are reused for 24 hours, so the same site is not tested over and over.

Your results show on the page. The grader does not email them to you. If you ticked the box, you get the newsletter's confirmation email, and you are only subscribed if you confirm. If you did not tick it, we may contact you about that result within six months, and you are not added to any list. If you ask for the free Standards Report from the results, it is sent to the email you gave.

Information your browser sends automatically

Like every website, the server that hosts this site records standard technical request data: IP address, browser and operating system identifiers, the page requested and the time. This is generated by the hosting infrastructure, is used for security and diagnostics, and is not combined with anything you submit.

Analytics

This site uses Google Analytics 4 to count visits and understand which pages are useful. Analytics is loaded only after you interact with the page, or three seconds after it loads, whichever comes first, and not at all if your browser sends a Global Privacy Control or Do Not Track signal. It records the pages you view, roughly where in the world you are, and what kind of device you are on. It does not record your name or email, and we have no way to connect an analytics session to a form submission.

What we never do

• We do not sell personal information. There is no scenario in which we would.
• We do not share it with advertisers, data brokers or list buyers.
• We do not add you to a mailing list because you used the contact form, requested a report or used the website grader. The only way onto the newsletter is to sign up for it, or tick the grader's box, and then confirm by email.
• We do not use your information to train machine-learning models.

3. Why we collect it

To answer you. You send an enquiry, we reply to it, and if it turns into work, the same thread becomes the record of what was agreed. If you subscribe, it is to send you the newsletter you asked for, and nothing else. Server logs exist to keep the site up and to keep attackers out. That is the whole purpose.

We rely on your consent, which you give by choosing to submit a form, and for the newsletter, by confirming your subscription. You can withdraw it at any time; see section 6.

4. Who else can see it

Your information is handled by us and by the small number of service providers needed to run a website. Each of them sees only what their function requires:

• Our hosting provider stores the site and its database, which is where form submissions and the newsletter list live, and generates the server logs described above.
• Email delivery. A notification containing your submission is sent to our own inbox so we see it. Your email address is set as the reply address so a response goes back to you directly. Newsletter confirmation emails are sent from the same server.
• Google, as the analytics provider, in the limited form described in section 2.
• Google, which runs the PageSpeed test on the website address you enter in the website grader. Only that address is sent.
• Cloudflare, which runs a check on the forms to tell people apart from automated spam. When you use a form, it sees your IP address and technical details about your browser, and decides whether you are likely to be a person. It does not see what you type into the form.

The newsletter list is not held by any email marketing service. If we start using one to send the newsletter, it will be named here before any address is moved to it.

Some of these providers operate servers outside Canada, including in the United States. Information stored there is subject to the laws of that country, which can include lawful access by its authorities. We mention this because PIPEDA requires it, not because we have any reason to expect it.

We will disclose information if a court order or a law compels us to. If that ever happens and we are permitted to tell you, we will.

5. How long we keep it

Form submissions are kept for as long as they are useful, whether that is an active conversation or the record of a project, and are reviewed periodically. Enquiries that went nowhere are deleted once they are clearly stale. Obvious spam is deleted as soon as it is identified.

Website grader records are kept under the same rules as form submissions.

Newsletter subscriptions last until you unsubscribe. A signup that is never confirmed is removed automatically after 30 days. When you unsubscribe, we keep your email address and the dates you subscribed and unsubscribed, so we can show that you opted out and make sure you are never emailed again. If you want that record deleted too, ask.

If you would rather not wait for a review cycle, ask and we will delete yours. See the next section.

Server logs are retained by the hosting provider on its own schedule, typically a matter of weeks, and are not under our day-to-day control.

6. Your rights, and how to use them

You can ask us to:

• Show you what personal information we hold about you
• Correct anything that is wrong
• Delete it
• Stop using it, by withdrawing your consent

Email info@threesevendigital.com and say which. There is no form to fill in and no account to log into. We will respond within 30 days, and normally much sooner, at no charge. To leave the newsletter, use the unsubscribe link in any email, or email us and we will do it for you.

We may need to confirm you are who you say you are before handing over information, usually by replying to the address the original message came from. If we cannot verify it, we will explain why rather than simply refuse.

Withdrawing consent does not undo what has already happened, and if we are in the middle of delivering work for you, we may need to keep enough information to finish it and to meet our own record-keeping obligations. We will tell you if that applies.

7. How it is protected

The site is served over HTTPS, so what you type into a form is encrypted in transit. Access to the database and the mailbox is limited to the people who need it, protected by strong unique credentials and multi-factor authentication. The site software is kept current.

No system is perfectly secure, and anyone who tells you otherwise is selling something. What we can commit to is that if a breach occurs that creates a real risk of significant harm to you, we will tell you and we will report it, as PIPEDA requires.

8. Cookies and tracking

The site itself sets no cookies. Google Analytics sets its own to tell repeat visits apart. You can block or clear these in your browser settings with no loss of functionality. Nothing on this site requires a cookie to work.

We honour Global Privacy Control and Do Not Track signals by default. If your browser sends either one, Google Analytics is not loaded, so it sets no cookies and records nothing about your visit.

9. Children

This is a service for businesses. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us something, email us and it will be deleted.

10. Changes to this policy

This policy is part of the website's source code, not a document pasted into an admin panel, so it changes when the site's behaviour changes. The "last updated" date at the top is the honest date of the most recent change. We will not quietly broaden what we collect and backdate the page.

11. Contact and complaints

Questions, requests, or something in here that does not match what you have observed: info@threesevendigital.com. That address reaches a person, not a queue.

If we handle a privacy concern badly, you can escalate to the Office of the Privacy Commissioner of Canada at priv.gc.ca. We would rather you gave us the chance to fix it first.

This page describes our actual practice. If you find something on this site that contradicts it, that is a bug and we want to know about it.