Privacy Policy

Last updated: September 2, 2026

This Privacy Policy explains how DAHO ("DAHO," "we," "us," "our") — a sole proprietorship owned and operated by Isaac Gounton and based in London, Ontario, Canada — collects, uses, discloses, and protects personal information when you visit daho.ai(the "Site"), contact us, engage our services, or use a product we operate that links to this policy — including DadSEO (see section 3). DAHO is the organization responsible for the personal information described below.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where they apply to you, we also honour the rights granted by the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA.

1. Who we are and how to reach us

DAHO is a one-person AI systems studio based in London, Ontario, Canada. For any question, request, or complaint about privacy — including the rights described in section 10 — email [email protected]. We do not operate a public walk-in office; email is the fastest route to us, and we will provide a postal address on request.

2. Information we collect

Information you give us

• Contact form — your name, email address, and the message you write. The form also contains a hidden anti-spam field that people never fill in; if it is completed, the submission is discarded and nothing is sent to us.
• Booking a call— your name, email address, selected time, and anything you add to the booking form. Scheduling is operated by Cal.com and is also subject to Cal.com's own privacy policy.
• Email and other correspondence — whatever you choose to include when you write to us directly.
• Client engagements — if we work together, the business contact details, project information, and any materials or access you deliberately share with us for the purpose of delivering the work.

Information collected automatically

When you browse the Site, our hosting infrastructure and analytics collect standard technical information, including:

• your IP address, and the approximate city or region derived from it;
• browser type and version, operating system, device type, screen size, and language preference;
• pages you view, time spent on them, the referring URL, and links you click;
• date and time stamps and other standard server and security log data;
• a randomly generated identifier stored in a cookie, used to tell one visit apart from another.

We use this information in aggregate to understand how the Site is found and used. We do not use it to identify you personally, and we do not attempt to link it to your name or email address.

Information we do not collect

The Site does not take payment card details — invoicing for client work happens outside this website. There are no user accounts or passwords. We do not collect sensitive categories of personal information such as health data, biometric data, government identifiers, or precise geolocation. We do not knowingly collect personal information from children (see section 12).

3. Google user data (DadSEO)

DAHO builds and operates DadSEO, an SEO product that offers "Sign in with Google" and can connect to your Google Analytics account. This section describes how DadSEO handles information received from Google APIs. It applies in addition to the rest of this policy, and where the two differ, this section governs for Google user data.

What DadSEO asks for

• openid, profile, and email — your Google account email address, name, and profile picture. Used to create your DadSEO account and sign you in.
• https://www.googleapis.com/auth/analytics.readonly — permission to see and download your Google Analytics data. Used to show you your own traffic and performance reports inside DadSEO. The scope is read-only: DadSEO cannot create, change, or delete anything in your Google Analytics account.

DadSEO does not request access to Gmail, Google Drive, Google Calendar, your contacts, or any other Google API scope. Google shows you these permissions on its consent screen before you grant them, and you can decline any of them.

How DadSEO uses it

Your Google profile information is used only to create and secure your account, sign you in, identify you inside the product, and send you service messages about your account. Your Google Analytics data is used only to produce the reports, audits, and recommendations you ask for inside DadSEO, and is shown only to you and to anyone you have invited to your workspace.

We do not use Google user data for advertising. We do not sell it, and we do not transfer it to data brokers or use it to build advertising profiles. We do not use it to train AI models, our own or anyone else's; where DadSEO uses AI to turn your data into a recommendation, the data is processed only to produce that result for you and is not retained by the model provider for training.

How DadSEO stores it

• Your name, email address, Google account identifier, and profile picture URL are stored in DadSEO's database for as long as your account exists.
• Google Analytics reporting data is fetched from Google when you request a report. Results may be cached briefly so that pages load quickly and to stay within Google's rate limits.
• OAuth tokens are stored encrypted at rest and used only to retrieve the Google Analytics data you have asked DadSEO to show you.

Revoking access and deleting your data

You can disconnect DadSEO from your Google account at any time from your Google Account permissions page, or by disconnecting the integration inside DadSEO. Revoking access stops all further data retrieval immediately. To delete your DadSEO account and everything associated with it — including your stored profile information, any cached Google Analytics data, and your OAuth tokens — email [email protected] and we will complete the deletion within thirty days.

Limited Use

DAHO's and DadSEO's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Cookies and similar technologies

The Site sets a small number of cookies:

• Analytics cookies (_ga, _ga_*) — set by Google Analytics to distinguish visitors and sessions. Stored for up to two years.
• Security cookies (__cf_bm, and cf_clearance where issued) — set by Cloudflare to distinguish humans from automated traffic and protect the Site from abuse. Stored from roughly thirty minutes up to one year.

The Site does not set advertising, retargeting, or cross-site behavioural-advertising cookies, and it does not run advertising networks.

You can block or delete cookies in your browser settings — the Site remains fully usable without them. To opt out of Google Analytics specifically, you can install the Google Analytics Opt-out Browser Add-on. We also honour the Global Privacy Control (GPC) signal where your browser sends one.

5. Analytics

We use Google Analytics 4 (property G-Y83R101D6B), a service provided by Google LLC, to measure how people find and use the Site. Google processes the technical information listed in section 2 on our behalf, and truncates IP addresses before storing them. We have not enabled Google Signals, advertising features, remarketing, or any cross-device advertising identifiers on this property.

Event-level analytics data is retained by Google for a maximum of fourteen months, after which it is deleted automatically. You can read more about how Google handles data from sites that use its services in Google's partner-sites notice and its privacy policy.

6. How we use your information, and our legal bases

• To respond to your inquiry and discuss a project — because you asked us to; under GDPR, to take steps at your request before entering a contract.
• To deliver, support, and invoice the services you engage us for — performance of our contract with you.
• To operate, secure, and maintain the Site and prevent spam and abuse — our legitimate interest in running a functioning, secure website.
• To measure and improve the Site through analytics — your consent where consent is required, and otherwise our legitimate interest in understanding how the Site performs.
• To meet legal, tax, and accounting obligations — compliance with a legal obligation.

We do not sell your personal information, we do not use it to send you marketing you did not ask for, and we do not use it for advertising. We do not use your personal information or your project materials to train AI models, our own or anyone else's. No decision that produces a legal or similarly significant effect about you is made by automated means.

7. How we share your information

We do not sell personal information, and we have not sold or shared personal information for cross-context behavioural advertising in the preceding twelve months. We share limited information with a small number of service providers who process it on our behalf, only to the extent each one needs to do its job:

• Resend — delivers contact-form submissions to our inbox by email (privacy policy).
• Cal.com— handles call bookings made through the "Book a call" link (privacy policy).
• Cloudflare — provides DNS, content delivery, and protection against attacks and abusive traffic (privacy policy).
• Google — provides the analytics described in section 5 (privacy policy).

We may also disclose personal information where we are required to by law, a court order, or a lawful request from a public authority; where necessary to establish, exercise, or defend legal claims or to protect the rights and safety of DAHO or others; and, if DAHO's business is ever transferred to another owner, to that successor, in which case this policy continues to apply until you are notified otherwise.

8. Where your information is processed

DAHO operates from Canada, and the service providers listed above process data in the United States and other countries. Personal information stored or processed in another country is subject to that country's laws and may be accessible to its courts, law-enforcement agencies, and national-security authorities. Where transfers are covered by the GDPR, we rely on our providers' standard contractual clauses and equivalent safeguards. We share only what each provider needs to perform its function.

9. How long we keep your information

• Contact-form submissions — delivered to us by email. This website has no database and stores no submissions.
• Correspondence — kept for as long as there is an active or prospective engagement, and for up to twenty-four months afterwards, unless we are required to keep records longer for legal, tax, or accounting purposes (generally six years in Canada).
• Booking records — retained by Cal.com in line with its own policy.
• Analytics data — a maximum of fourteen months at Google, then deleted automatically.
• Server and security logs — retained briefly by Cloudflare and our hosting infrastructure, typically for days to weeks, and used only for security and diagnostics.

10. Your rights and choices

Everyone. You may ask us what personal information we hold about you, ask for a copy of it, ask us to correct it, ask us to delete it, and withdraw any consent you have given, at any time.

Under PIPEDA (Canada). You have the right of access to and correction of your personal information, and the right to challenge our handling of it. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

Under the GDPR (EEA and UK).You additionally have the rights to restriction of processing, to data portability, and to object to processing based on legitimate interests. You may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office.

Under the CCPA/CPRA (California). You have the rights to know, delete, and correct your personal information, to opt out of its sale or sharing, and to limit the use of sensitive personal information — we do not sell or share personal information, and we do not collect sensitive personal information. You will never be discriminated against for exercising these rights, and you may use an authorized agent to make a request.

To exercise any of these rights, email [email protected]with "Privacy request" in the subject line and tell us what you would like us to do. We may ask you for information to confirm your identity, used only for that purpose. We respond within thirty days, and we do not charge a fee.

11. Security

The Site is served exclusively over HTTPS. We keep the amount of personal information we hold deliberately small: there is no database of form submissions, no user accounts, and no payment data on this website. Access to the inbox that receives your messages is limited to DAHO, protected by strong authentication, and our providers are established vendors with their own security programs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and any other regulator we are required to inform.

12. Children's privacy

The Site is intended for businesses and the adults who run them. It is not directed at children, and we do not knowingly collect personal information from anyone under 13 — or under 16 in the EEA and the UK. If you believe a child has provided us with personal information, email [email protected] and we will delete it.

13. Links to other sites

The Site links to places we do not control, including LinkedIn, our scheduling page, and our own products hosted on separate domains. This policy does not apply to those sites; we encourage you to read the privacy policy of any site you visit.

14. Changes to this policy

We may update this Privacy Policy as our practices or the law change. The "Last updated" date at the top reflects the most recent revision. If a change materially affects how we handle personal information we already hold, we will take reasonable steps to tell you, and where the law requires it we will ask for your consent.

15. Contact us

Questions, requests, or complaints about this policy or your personal information? Email [email protected]. We read every message and reply.