Your privacy.

You control what you share with SiteSpin. We use your information to provide, secure and improve the service. Optional website analytics, recordings and advertising have separate privacy choices.

Who we are

SiteSpin, based in Stockholm, Sweden, is the controller responsible for the personal information in this policy. Contact us at support@sitespin.app.

This policy covers our iOS app, sitespin.app, app.sitespin.app and hosting services. If you visit a customer's website, its owner is responsible for how they use your information. We process information needed to host it and deliver its forms, including on a custom domain. See Visitors to your website.

What we collect

• Account information: your email, name if provided, sign-in details, and account identifier. We do not receive your Apple or Google password.
• Your content: messages, business details, photos, files, website content, and addresses of websites you ask us to read. What you publish on your website is public.
• Purchases and domains: subscription and transaction records. We register domains using SiteSpin's contact details, so we do not ask you for a registrant name, postal address, or phone number, or store these details. Apple or our web payment providers handle payment details; we do not receive your full card number.
• Usage and technical information: feature use, device and browser information, IP address, account and device identifiers, errors, and performance information. If you enable notifications, we receive a device token to send account and website alerts. With your analytics permission, we also save these details to your account when you sign up on the web: the website you first came from, campaign tags and the first SiteSpin page you visited.
• Recordings and support: interactions with SiteSpin, support messages, and session recordings, which can include typed text and uploaded pictures. We exclude passwords and payment forms. Browser recordings follow your analytics choice.
• Advertising information: ad-click and permitted device identifiers, installs, app activity, and subscription events, including time, amount, and currency. Matching may use a hashed email address. Your content and recordings are not sent to advertising networks.

We do not request access to your contacts or precise location. Avoid submitting sensitive personal information your website does not need.

Why we use your information

• To provide SiteSpin: manage your account, create and maintain your websites, process subscriptions, register domains, and deliver messages and notifications. Our legal basis is performing our contract with you, including steps you request before subscribing.
• To keep the service reliable and safe: diagnose problems, provide support, prevent fraud and abuse, and improve the service. We rely on our legitimate interests in running and improving SiteSpin, balanced against your rights.
• For optional analytics and advertising: understand website use and measure advertising with your consent where required. You can change these choices as described below.
• To meet legal obligations: retain required accounting records, respond to lawful requests, and comply with applicable registration requirements.
• To publish statistics about how SiteSpin is used: we may publish combined figures from many websites, such as the share of new websites that take bookings. Each figure covers at least 20 businesses. We never name a business, show its website or quote what its owner wrote. We rely on our legitimate interest in sharing what we learn.

AI and website content

We use OpenRouter and its model providers to process your messages, uploaded images, and relevant website content to create and update your website. We require providers not to use your inputs to train their models. Provider retention varies; details are available in OpenRouter's provider information. AI processing is necessary to use SiteSpin's website-building features.

When you ask us to read or import a website, we process its public content and screenshots, which may contain personal information. Firecrawl receives the website address and any search query needed to retrieve it. Our AI providers may also process relevant source-page content and screenshots.

We automatically check published SiteSpin websites to find problems and improve quality. This uses Firecrawl and includes page content, measurements, and the three most recent screenshot sets.

We use automated content checks to prevent abuse. We may retain submitted content, including images, and the review decision and reason. A violation may lead us to take down a website or suspend an account. Contact us if you think a decision is wrong and want it reviewed.

Third parties

We share information with providers as needed for the purposes above:

• OpenRouter and its model providers. AI processing of messages, images, and website content. See provider details.
• Firecrawl (SideGuide Technologies, Inc.). Reads and checks websites, including public page content and screenshots. Its privacy policy does not give a fixed deletion period for personal information.
• Supabase, Render, Vercel, Openprovider, and Cloudflare. Account services, storage, hosting, domain registration, and security. They process account or website content and connection information needed for these services. Openprovider, in the Netherlands, registers domain names included with a plan through the relevant registry. It also runs DNS for those names, connecting them to their websites. Vercel handles domain registration when Openprovider cannot.
• PostHog. Product analytics, recordings, diagnostics, and advertising measurement. This can include account identifiers, usage, typed text, uploaded images, and technical logs. Processing is in the European Union; its AI analysis features use providers outside the EU. See its subprocessor list.
• Pydantic Logfire. Service monitoring and improvement, including records of assistant conversations and technical activity. Processing is in the European Union.
• Sentry. Crash, freeze, error, and performance diagnostics for the iPhone and iPad app, including account identifiers and device, system, and app versions. Processing is in the European Union.
• Meta and TikTok. Advertising measurement using permitted activity, subscription, and matching information. Meta is used for web and app advertising; TikTok for app advertising.
• Stripe, Link and RevenueCat. On the web, Stripe sells your SiteSpin subscription as merchant of record under its consumer brand Link. To charge you and calculate and pay the tax due, it receives your email address, name, card details, country or billing address, and the plan you buy. Your bank statement reads LINK.COM* SITESPIN. Link sends your receipts and invoices, handles refunds and disputes, and lets you manage your purchase at link.com and in SiteSpin. Stripe Payments Company (US) or Stripe Technology Europe, Limited (EU) processes the card payment, depending on where you are. Asking Stripe or Link to delete your data ends your web subscription and erases the related records in our Stripe account. RevenueCat keeps one subscription record across the App Store and web (account identifier, receipt and plan), and receives permitted device identifiers for subscription measurement.
• Stripe, for payments to a business. When a business on SiteSpin takes payments on its website, its customers pay through Stripe, which processes the payment for that business and acts as an independent controller for fraud prevention and compliance. Stripe receives the customer's name, email address, card and device details and the amount, and processes them in the European Union and the United States. Stripe works with the providers of the payment methods it offers, such as wallets and pay-later services, and shares with them what a payment needs, as described in Stripe's privacy policy.
• Apple and Google. Sign-in when you choose it. Apple also handles App Store purchases, notifications, and Apple Ads measurement.
• Pirsch. Cookieless visitor statistics for customer websites.
• Resend. Email delivery, including recipient addresses and message contents.

We may also disclose information when required by law, to protect rights and safety, or in a business transfer with appropriate privacy protections.

Cookies and tracking

On sitespin.app and app.sitespin.app, you can allow analytics and advertising, just analytics, or neither. Optional browser storage and recordings start only after the relevant choice. Necessary storage keeps you signed in and remembers your preferences.

Change your choice with Cookie settings or Your Privacy Choices in the footer. Refusing stops optional recordings and website advertising sharing and clears optional identifiers. We honour Global Privacy Control as an advertising opt-out. Necessary account and subscription processing continues. We may also receive cookieless activity counts without recordings or a persistent browser identifier.

The iPhone and iPad app does not track you across other companies' apps or websites. It does not read your device's advertising identifier and does not show Apple's tracking prompt.

We do not sell personal information for money. Advertising sharing may count as a “sale” or “sharing” under California and other US state laws. Use Your Privacy Choices or Global Privacy Control to opt out of website advertising sharing. We do not knowingly sell or share information about anyone under 16, and do not discriminate against you for exercising privacy rights.

Visitors to your website

We do not place SiteSpin's advertising trackers or session recordings on customer websites. Eligible websites include cookieless Pirsch visitor statistics, which count visits using an identifier that changes daily. Hosting providers receive connection information when serving pages and images.

When someone submits a form on your website, we store and send you what they submit. We also process their IP address and browser information to prevent spam. Form-submission IP addresses are removed after up to 90 days. You are responsible for your use of visitor information and any additional services you add.

How long we keep information

We keep account and project information while needed to provide the service. Deleting your account removes your websites, chats, uploads, form messages, and visitor statistics, and takes your published websites down. Some usage statistics may remain after we remove information identifying you. We may keep records required for legal obligations or unresolved disputes for those purposes.

We keep retrieved website content and screenshots while needed by a project or selected collections used to evaluate and improve SiteSpin. Unreferenced temporary copies are scheduled for deletion by the earlier of 60 days after collection or 30 days after cache expiry. The same deadlines apply to retained copies no longer needed, without restarting the clock. Operational AI records are kept for up to 30 days. Imported content remains with your project until deleted. These periods cover our copies; provider retention can differ.

Moderation records may contain full submitted content when a serious violation is detected, or an excerpt for other checks. Submitted content and review context are removed after 90 days, except suspension evidence, which is kept while the account exists. Suspension evidence can include images even after a project is deleted. Remaining decisions and reasons are deleted with your account.

When someone books through your website, we keep their name, contact details and what they wrote with the booking until 36 months after their most recent appointment or order, then erase them. The time and service they booked stay in your records without those details. When you ask, we erase or export one person's booking details sooner.

For payments to a business through its website, we keep the payment record (the amount, the date, what was refunded and Stripe's reference) for 10 years because the business must account for it. We erase the payer's name, email address and last four card digits from that record no later than 36 months after the payment, or sooner when the business asks us to erase that person. Stripe's messages about a payment are kept for 13 months.

When someone orders from your shop, we keep their name, contact details, delivery address and what they wrote with the order until 36 months after their most recent order or appointment, then erase them. An order placed without an email address keeps those details for 400 days. The items ordered and their cost stay in your records without those details.

We no longer collect registrant contact details: SiteSpin is the registered holder of the domains it buys for customers. Details from registrations before this change are deleted with your account; the domain is unaffected.

International transfers

We use providers in the European Union and other countries, including the United States. Where required, we use recognised safeguards for transfers, such as an applicable adequacy decision, participation in the EU–US Data Privacy Framework, or standard contractual clauses. Contact us about the safeguards for your data.

Your rights

Depending on applicable law, you can ask to access, correct, export or delete your personal information, restrict its use, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting earlier lawful processing.

Delete your account in SiteSpin's account settings, or contact support@sitespin.app for help or other privacy requests. You can export form messages and visitor statistics in the app or web service; ask us for other account data. We may need to verify your identity before fulfilling a request.

Deleting your account does not cancel a subscription. Manage App Store subscriptions in Apple's subscription settings and web subscriptions in your SiteSpin billing settings before deleting your account. Asking Stripe or Link to delete your data ends a web subscription.

You may complain to the Swedish Authority for Privacy Protection (IMY) or your local data protection authority.

Children

SiteSpin is not intended for children under 13. We do not knowingly collect their personal information. Contact us if you think a child has provided information so we can address it.

Changes and contact

We update the date above when this policy changes and notify you of material changes in SiteSpin. For questions or privacy requests, email support@sitespin.app.