Privacy Policy

Template — review with counsel and complete with your legal entity and contact details before launch.

What we collect

• Account data: name, email, workspace details.
• Site content: the business information, text and images you add to websites.
• Visitor submissions: names, emails, phone numbers and messages that visitors enter in booking and inquiry forms on sites built with SiteStack. We process these on behalf of the website owner.
• Domain registrant details: contact details required by registries when you register a domain.
• Billing: handled by Stripe. We do not store card numbers.
• Technical data: IP addresses used for security and rate limiting, and anonymous page-view counts for published sites.
• Google Calendar (only if you connect it): your Google account email, and OAuth tokens that we store encrypted.

How we use it

To provide the Service, deliver bookings and inquiries to the right workspace, process payments, prevent abuse and communicate about your account.

Google user data

If a business connects Google Calendar, SiteStack uses Google APIs only to: check that business's free/busy times so visitors can't book a slot that is already taken, and create, update or delete calendar events for bookings made through its website. We do not read the contents of other events, and we do not use Google user data for advertising, sell it, or use it to train AI models. Disconnecting the calendar in SiteStack revokes our access and deletes the stored tokens; you can also remove SiteStack's access at any time in your Google account settings.

SiteStack's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing

We share data only with processors needed to run the Service — hosting (Vercel), database and storage (Supabase), payments (Stripe), email delivery (Resend), the domain registrar and, when you use "Write with AI", the AI provider (Anthropic) that drafts the text — and when required by law. We do not sell personal data.

Retention

We keep data while your account is active. Deleted websites are removed from your dashboard immediately and purged after a retention window; billing and domain records are kept as required for tax and legal purposes.

Your rights

You can access, correct, export or delete your data. Visitors who submitted a form should contact the business that operates the website.

Security

Data is isolated per workspace at the database level and transmitted over HTTPS.