Privacy Policy

1. Scope

This Privacy Policy explains how SiteSurely processes information when you visit the SiteSurely website, create or use a SiteSurely account, join a customer organization, or use SiteSurely's website-monitoring service. It is a production draft based on the current application and service configuration and is not legal advice or a statement of legal certification.

2. Information SiteSurely processes

SiteSurely processes the following categories when they are needed to operate the service or when you provide them:

• Account information, such as your email address, display name or name, authentication records, email-confirmation state, and password-recovery state.
• Organization and team information, such as workspace or organization name and slug, memberships, roles, invitations, invitation email addresses, and team-access activity.
• Website and monitoring information, such as a client-site name, website URL, normalized host, monitoring settings, configured paths or success criteria, domain-verification information, and check scheduling state.
• Generated service information, such as check runs, browser observations, page and form state, calls-to-action, browser errors, tracking-visible signals, timestamps, screenshots, evidence, findings, incidents, incident status, and factual reports or report runs.
• Billing and subscription information, such as plan, site allowance, subscription status, billing-period state, cancellation state, Stripe customer and subscription identifiers, price identifiers, first-payment records, refund-request records, and related billing metadata. Stripe processes payment-card details; SiteSurely does not store complete payment-card numbers in the application records reviewed for this policy.
• Communications, such as transactional account, confirmation, password-recovery, incident-alert, report, and team-invitation messages and the email addresses used to deliver them.
• Early-access waitlist information, if you affirm you are at least 18 and opt in, such as your email address, chosen business role, signup timestamp, and limited campaign attribution tags. We use this only for SiteSurely early-access and launch information; you may request removal through SiteSurely support.
• Legal acceptance records, such as the Terms and Privacy versions accepted during account creation and the acceptance timestamp.
• Technical and security information, such as request and service activity used for authentication, rate limiting, abuse prevention, debugging, reliability, and security. Depending on the request path and provider, this can include timestamps, request metadata, and IP-derived rate-limit information.

3. How SiteSurely uses information

SiteSurely uses information to:

• create and authenticate accounts and maintain sessions;
• create organizations, manage memberships and invitations, and provide role-based workspace access;
• receive and monitor customer-configured website URLs, record observations, generate evidence and reports, and manage incidents and notifications;
• manage plans, site capacity, subscriptions, invoices, refunds, and billing support;
• send service communications, including account, security, incident, report, and team messages;
• protect the service, enforce authorization, prevent fraud and abuse, investigate failures, and maintain operational reliability; and
• respond to support requests, maintain records of legal acceptance, comply with applicable law, resolve disputes, and enforce applicable agreements.

4. Website monitoring data

Customers may provide public website URLs or configure websites for monitoring. SiteSurely's monitoring service may request those websites and generate technical observations about the configured pages and journeys. Depending on the configuration and observed state, generated records can include page metadata, form and call-to-action state, browser diagnostics, tracking-visible signals, screenshots, evidence, check timestamps, findings, incidents, and reports.

Monitoring data is generated from customer-provided website configurations. SiteSurely does not claim ownership of a customer's website, content, or underlying business data. Customers are responsible for having the rights and permissions needed to configure a website for monitoring and for avoiding credentials or other information they do not want processed by the service.

Monitoring starts passively in the current product. Active or synthetic testing is separately controlled and depends on domain-authorization checks. SiteSurely does not represent that every website request or third-party resource is collected or retained.

5. Organizations and authorized users

SiteSurely is organization-based. Your individual account may be associated with one or more customer organizations. Organization owners, administrators, and other authorized members may be able to access information associated with their organization according to their role and the product's access controls. If you join an organization by invitation, that organization may know your email address and role and may see your activity in the organization.

6. Service providers and disclosures

SiteSurely uses service providers to operate the service. Current architecture and configuration identify these roles:

• Supabase provides authentication and the application's database and private storage capabilities.
• Railway hosts the web application and may also provide the background worker infrastructure used for website monitoring where that deployment is configured.
• Stripe processes subscription checkout and payment-card transactions and provides billing events. SiteSurely receives and stores limited subscription and billing metadata needed to grant entitlements and support billing.
• Resend sends transactional SiteSurely email, such as account, team, incident, report, and service messages.

SiteSurely may disclose information to these providers only as needed for their service role, to authorized organization members, when required to comply with law or protect rights and safety, or in connection with a merger, acquisition, financing, reorganization, or sale of all or part of the business. SiteSurely does not sell personal information as a business practice described by this policy. SiteSurely does not disclose customer monitoring data for unrelated advertising.

7. Payments and subscriptions

Stripe handles payment-card processing for SiteSurely subscriptions. SiteSurely's application records retain billing metadata such as provider identifiers, plan and price information, subscription status, billing-period dates, cancellation state, first-payment details, and refund-request state. SiteSurely does not store complete payment-card numbers in the application records reviewed for this policy. Stripe's own privacy terms also apply to information it processes.

8. Cookies and session technologies

The service uses necessary authentication and session technologies, including Supabase authentication cookies and SiteSurely cookies used to maintain workspace selection, password-recovery state, and, where present, a referral code. A referral cookie is configured with a limited period of 30 days.

The reviewed application does not include advertising cookies or an analytics/marketing tracking system. SiteSurely does not currently provide a separate cookie-consent banner for strictly necessary session technologies. You can configure your browser to block cookies, but doing so may prevent sign-in or other service functions from working.

9. AI and automated processing

The reviewed SiteSurely application does not currently send customer account data or monitoring data to an external AI or model provider as part of the service. If that changes, SiteSurely should update this policy before introducing the new processing in production.

10. Security

SiteSurely uses access controls, authentication and authorization, organization-level data separation, private evidence storage, encrypted connections, and operational/security monitoring appropriate to the service. No method of transmission or storage is completely secure, and SiteSurely cannot guarantee absolute security.

11. Retention and deletion

The reviewed implementation does not establish one universal retention period for all categories of information. SiteSurely retains information for as long as reasonably necessary to provide the service, maintain security and operational records, support billing and accounting, resolve disputes, comply with legal obligations, and enforce agreements. Different systems, backups, provider records, and security or audit records may retain information for different periods.

The product does not currently present a self-service account-deletion control in the reviewed application. To request deletion or ask a question about retention, contact support@sitesurely.com. SiteSurely may need to retain certain information where required or reasonably necessary for security, fraud prevention, legal obligations, accounting, dispute resolution, or the establishment or defense of claims.

12. Privacy choices and rights

Depending on where you live, applicable law may provide rights such as access, correction, deletion, portability, restriction, objection, or withdrawal of consent where processing is based on consent. These rights are not identical in every jurisdiction and may be subject to exceptions.

To submit a privacy request, contact support@sitesurely.com with enough information for SiteSurely to understand and verify the request. SiteSurely may ask for reasonable verification before disclosing or changing personal information. If you use SiteSurely through an organization, the organization may control or assist with requests concerning organization data.

13. United States state privacy

Residents of certain U.S. states may have additional privacy rights under applicable state law. Whether a particular law applies depends on the facts and statutory requirements; this policy does not claim that SiteSurely meets any specific statutory threshold or is certified under any state privacy law. Contact support@sitesurely.com to make a request or ask about applicable rights.

14. International users

SiteSurely is not presented as geographically restricted. Information may be processed in the United States or other locations where SiteSurely or its service providers operate. International privacy rights and transfer rules may apply depending on your location. SiteSurely has not designated an EU representative, UK representative, or data protection officer in this policy.

15. Children

SiteSurely is a business website-monitoring service and is not directed to children. The service should not be used to provide information about children. The early-access waitlist is for people aged 18 and older and requires an age confirmation. SiteSurely does not knowingly seek personal information from children through a child-directed offering.

16. Do Not Track and Global Privacy Control

The reviewed application does not implement a separate Do Not Track or Global Privacy Control preference signal. SiteSurely does not claim technical support for those signals.

17. Changes to this policy

SiteSurely may update this policy when its practices, features, providers, or legal obligations change. The updated version will be posted on this page with a new “Last updated” date. Material changes may also be communicated through reasonable service mechanisms where appropriate.

18. Contact

For privacy questions or requests, contact SiteSurely at support@sitesurely.com.