Your privacy.

You control what you share with SiteSpin. We use your information to provide the service, keep it secure, and improve it. Optional website analytics, recordings, and advertising have separate privacy choices.

Who we are

SiteSpin is a website-building service based in Sweden. We are responsible for the personal information described in this policy. Contact us at support@sitespin.app.

This policy covers our iOS app, sitespin.app, app.sitespin.app, and our hosting services. If you visit a customer's website, its owner is responsible for how they use your information. We process information needed to host that website and deliver its forms, including when it uses a custom domain. See Visitors to your website.

What we collect

• Account information: your email, name when provided, sign-in details, and account identifier. We do not receive your Apple or Google password.
• Your content: messages, business details, photos, files, website content, and addresses of websites you ask us to read. Information you publish on your site becomes public.
• Purchases and domains: subscription and transaction records. We register domains under SiteSpin's own contact details, so we do not ask you for a registrant name, postal address, or phone number and do not store one. Apple or our web payment providers handle payment details; we do not receive your full card number.
• Usage and technical information: features used, device and browser information, IP address, account and device identifiers, errors, and performance information. If you enable notifications, we receive a device token to deliver account and website alerts.
• Recordings and support: interactions with SiteSpin, support messages, and session recordings, which can include text you type and pictures you upload. Passwords and payment forms are excluded. Browser recordings follow your analytics choice.
• Advertising information: ad-click and permitted device identifiers, installs, app activity, and subscription events, including time, amount, and currency. Matching may use a hashed email address. Your content and recordings are not sent to advertising networks.

We do not request access to your contacts or precise location. Please avoid submitting sensitive personal information that is not needed for your website.

Why we use your information

• To provide SiteSpin: manage your account, create and maintain your websites, process subscriptions, register domains, and deliver messages and notifications. Our legal basis is performing our contract with you, including steps you request before subscribing.
• To keep the service reliable and safe: diagnose problems, provide support, prevent fraud and abuse, and improve the service. We rely on our legitimate interests in operating and improving SiteSpin, balanced against your rights.
• For optional analytics and advertising: understand website use and measure advertising with your consent where required. You can change these choices as described below.
• To meet legal obligations: retain required accounting records, respond to lawful requests, and comply with applicable registration requirements.

AI and website content

AI providers process your messages, uploaded images, and relevant website content to create and update your site. We use OpenRouter and its model providers for this processing. We require providers not to use your inputs to train their models. Provider retention varies; details are available in OpenRouter's provider information. AI processing is necessary to use SiteSpin's website-building features.

When you ask us to read or import a website, we process its public content and screenshots, which may contain personal information. Firecrawl receives the website address and any search query needed to retrieve it. Relevant source-page content and screenshots may also be processed by our AI providers.

We automatically check published SiteSpin websites to find problems and improve quality. This uses Firecrawl and includes page content, measurements, and the three most recent screenshot sets.

We use automated content checks to prevent abuse. Reviews can retain submitted content, including images, and the decision and reason. A violation may lead to a website being taken down or an account being suspended. Contact us if you believe a decision is wrong and want it reviewed.

Third parties

We share information with providers needed to deliver the purposes above. Their roles and the information involved are:

• OpenRouter and its model providers. AI processing of messages, images, and website content. See provider details.
• Firecrawl (SideGuide Technologies, Inc.). Website retrieval and checks, including public page content and screenshots. Its privacy policy does not give a fixed deletion period for personal information.
• Supabase, Render, Vercel, and Cloudflare. Account services, storage, hosting, and security. They process account or website content and connection information needed to provide those services. Vercel also handles domain registration with the relevant registry.
• PostHog. Product analytics, recordings, diagnostics, and advertising measurement. This can include account identifiers, usage, typed text, uploaded images, and technical logs. Data is processed in the European Union; its AI analysis features use providers outside the EU. See its subprocessor list.
• Pydantic Logfire. Service monitoring and improvement, including records of assistant conversations and technical activity. Processing is in the European Union.
• Airbridge (AB180). App advertising measurement and app-opening links. Receives app activity, subscription events, account identifiers, device and connection information, and permitted advertising identifiers. AB180 is based in South Korea and uses servers in Japan.
• Meta and TikTok. Advertising measurement using permitted activity, subscription, and matching information. Meta is used for web and app advertising; TikTok for app advertising.
• RevenueCat and Stripe. Subscriptions and web payments, including account, receipt, subscription, and checkout information. RevenueCat also receives permitted device identifiers for subscription measurement.
• Apple and Google. Sign-in when you choose it. Apple also handles App Store purchases, notifications, and Apple Ads measurement.
• Pirsch. Cookieless visitor statistics for customer websites.
• Resend. Email delivery, including recipient addresses and message contents.

We may also disclose information when required by law, to protect rights and safety, or as part of a business transfer subject to appropriate privacy protections.

Cookies and tracking

On sitespin.app and app.sitespin.app, you can allow analytics and advertising, choose analytics only, or refuse both. Optional browser storage and recordings start only after the relevant choice. Necessary storage keeps you signed in and remembers your preferences.

Use Cookie settings or Your Privacy Choices in the footer to change your choice. Refusing stops optional recordings and website advertising sharing and clears optional identifiers. We honour Global Privacy Control as an advertising opt-out. Necessary account and subscription processing continues; we may also receive cookieless activity counts without recordings or a persistent browser identifier.

On iOS, Apple's tracking prompt controls access to the advertising identifier for tracking across other companies' apps and websites. You can change it in device Settings. Refusing does not limit access to SiteSpin; supported aggregated advertising measurement may still operate.

App-opening links in emails and the mobile invitation can use Airbridge to open the relevant app screen or a fallback. Following these links shares connection information and the destination with Airbridge.

We do not sell personal information for money. Advertising sharing may count as a “sale” or “sharing” under California and other US state laws. Use Your Privacy Choices or Global Privacy Control to opt out of website advertising sharing. We do not knowingly sell or share information about anyone under 16, and do not discriminate against you for exercising privacy rights.

Visitors to your website

We do not place SiteSpin's advertising trackers or session recordings on customer websites. Eligible sites include cookieless Pirsch visitor statistics, using a daily changing identifier to count visits. Hosting providers receive connection information when serving pages and images.

When someone submits a form on your site, we store and deliver the submitted information to you. We also process their IP address and browser information to prevent spam; form-submission IP addresses are removed after up to 90 days. You are responsible for your own use of visitor information and any additional services you add.

How long we keep information

We keep account and project information while needed to provide the service. Deleting your account removes your sites, chats, uploads, form messages, and visitor statistics, and takes your published sites offline. Some usage statistics may remain after information identifying you has been removed. Records required for legal obligations or unresolved disputes may be retained for those purposes.

We keep retrieved website content and screenshots while needed by a project or selected collections used to evaluate and improve SiteSpin. Unreferenced temporary copies are scheduled for deletion by the earlier of 60 days after collection or 30 days after cache expiry. Those same deadlines apply when a retained copy is no longer needed, without restarting the clock. Operational AI records are kept for up to 30 days. Imported content remains with your project until deleted. These periods cover our copies; provider retention can differ.

Moderation records may contain full submitted content when a serious violation is detected, or an excerpt for other checks. Submitted content and review context are removed after 90 days, except suspension evidence, which is kept while the account exists. Suspension evidence can include images even after a project is deleted. Remaining decisions and reasons are deleted with your account.

We no longer collect registrant contact details: SiteSpin is the registered holder of the domains it buys for customers. Details given for a registration made before that change are deleted when your account is deleted, and the domain itself is unaffected.

International transfers

We use providers in the European Union and other countries, including the United States, South Korea, and Japan. Where required, transfers are covered by recognised safeguards, such as an applicable adequacy decision, participation in the EU–US Data Privacy Framework, or standard contractual clauses. Contact us for information about the safeguards relevant to your data.

Your rights

Depending on applicable law, you can ask to access, correct, export, delete, or restrict use of your personal information, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting processing that was lawful before withdrawal.

Delete your account in SiteSpin's account settings, or contact support@sitespin.app for help or another privacy request. You can export form messages and visitor statistics in the app or web service; ask us for other account data. We may need to verify your identity before fulfilling a request.

Deleting your account does not cancel a subscription. Manage App Store subscriptions in Apple's subscription settings and web subscriptions through your SiteSpin billing settings before deleting your account.

You may complain to the Swedish Authority for Privacy Protection (IMY) or your local data protection authority.

Children

SiteSpin is not intended for children under 13. We do not knowingly collect their personal information. Contact us if you believe a child has provided information so we can address it.

Changes and contact

We update the date above when this policy changes and notify you of material changes in SiteSpin. For questions or privacy requests, email support@sitespin.app.