Privacy Policy

1. Controller

Paul-Louis Pröve, Eppendorfer Weg 64, 20259 Hamburg, Germany, is the controller for Site Sequel. Contact: support@sitesequel.com.

2. Data we process

• Website and project data: the URL you submit, publicly available content and assets from that site, generated versions, requested changes, project identifiers, build records, and generation session records.
• Technical and analytics data: IP address used for abuse prevention, request paths, timestamps, referring site, approximate location, screen size, language, and device and browser information made available through ordinary web requests or our cookieless traffic analytics, plus error and security logs. Analytics receives normalized page categories instead of project identifiers, submitted website addresses, access tokens, or message content.
• Purchase and access data: project, product, order, payment-status information, and the purchase email address received from Lemon Squeezy; sign-in link records and session tokens for purchased projects. We do not receive full payment-card details.
• Communications: your email address and message if you contact us.

3. Why we process it

We process data to create and retain requested previews, apply changes, deliver purchases, publish or host selected websites, provide support, prevent misuse, secure and troubleshoot the service, meet legal obligations, and establish or defend legal claims.

The legal bases are performance of a contract or steps requested before a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c)), and our legitimate interests in operating, securing, improving, and protecting the service (Article 6(1)(f)).

4. Public sources and outreach

When a URL is submitted, we collect information from that publicly accessible website. We may also use public business listings and websites to identify businesses that could benefit from a redesign and contact them about an unlisted preview. This information may include business contact details or names. The sources are public websites, linked public resources, and public business datasets.

We process this information to assess and create redesign previews for businesses that have not asked for one, and to introduce the service to them, based on our legitimate interest in marketing to businesses (Article 6(1)(f) GDPR). You can opt out by replying to our outreach message or emailing support@sitesequel.com. On objection, we delete the preview and retain only the information needed to maintain your opt-out.

5. Service providers

We share data only as needed with providers that support the service, including Railway for infrastructure, hosting, and our self-hosted Umami traffic analytics; OpenAI as the AI model provider (with Z.ai as an automatic fallback when OpenAI is unavailable); Cloudflare Browser Rendering, which receives source and generated preview URLs to render screenshots used by the builder; Vercel, which receives and serves the website files and domain name of a Business or Complete website you connect to your own domain; Jina AI, DuckDuckGo, and Exa for retrieving public website information; Lemon Squeezy for checkout, tax, fraud prevention, and payment support; Resend for sending purchase and sign-in emails; and Namecheap for our domain and mailbox.

A customer website may contain a contact form that sends visitor messages directly to FormSubmit, which forwards them to the customer’s own email address. Site Sequel does not receive these messages; the customer is responsible for them and for the privacy notice on their own website. FormSubmit states that submissions may be archived for 30 days.

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, standard contractual clauses, or another lawful safeguard. You may contact us for more information about applicable safeguards.

6. Emails we send

After a purchase we email the purchase address a sign-in link, and we send further sign-in links when you request them. These links are single-use and expire after 15 minutes. When you connect your own domain, we email you once it is live, and if you ask us to send the setup steps to someone who helps you, we use the address you type only to send those steps. These emails are sent through Resend from support@sitesequel.com. Outreach emails are sent separately from our own mailbox and never through Resend.

7. Retention

Project data and successful build records are kept while the preview or purchased service remains active and afterward only while reasonably needed to provide the service or resolve legal and security issues. Previews that are never purchased may be removed after a period of inactivity, and are deleted on request. The purchase email is kept as the only identity for a purchased project. Sign-in link records are deleted after 30 days. Prospecting records are kept while relevant to outreach; if you object, we retain minimal suppression information so we do not contact you again. Failed temporary build files are removed after failure. Technical logs are kept only as long as reasonably needed for operations and security. Purchase and accounting records are retained for statutory periods. Backups may persist for a limited period before being overwritten.

8. Cookies and analytics

Site Sequel uses one strictly necessary cookie that keeps you signed in to a purchased project for 30 days, and a short-lived cookie that recognises your browser when you return from checkout. We use a self-hosted Umami installation to understand aggregate traffic and a small number of product actions. It does not set analytics cookies, respects your browser’s Do Not Track setting, and does not receive submitted website addresses, project identifiers, access tokens, edit requests, email addresses, or generated website content. There are no advertising or analytics cookies, so no analytics-cookie consent banner is shown. If our use changes, this policy and any required consent controls will be updated first.

9. Your rights

Subject to the GDPR’s conditions and exceptions, you may request access, correction, deletion, restriction, or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent where processing relies on consent. You may also complain to a supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information.

Send requests to support@sitesequel.com. We may need to verify that you control the relevant project or email address.

10. Required information and automated processing

You need to provide a website URL to create a preview and the requested checkout information to purchase. Without it, we cannot provide that part of the service. AI systems help generate websites, but Site Sequel does not use solely automated processing to make decisions that produce legal or similarly significant effects about people.

11. Changes

We may update this policy when the service or law changes. The current version and effective date will remain available here.