Privacy Policy

1. Introduction

Welcome to Sitelas ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Sitelas, the website builder for AI agents.

By using Sitelas, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Your email address. Most people sign in with Google, in which case we also receive the basic profile from that account and never see or store your Google password.
• Website Content: Any content you add to your website, including text, images, and other materials you choose to publish.
• Subdomain Selection: Your chosen subdomain (e.g., yourname.sitelas.com).
• Payment Information (Sitelas subscription): When you subscribe to Sitelas, Polar — our Merchant of Record — processes your payment. We do not store your full card details on our servers; Polar tokenizes and holds them.
• Contact Form Submissions: Messages submitted through your website's contact form by visitors.
• Support Communications: Any messages you send to our support team.

2.2 Information Collected Automatically

• Analytics Data: We collect anonymized analytics on website visits, including page views, unique visitors, referral sources, and browsing paths.
• Device Information: Browser type, operating system, and device type for optimization purposes.
• Log Data: Server logs including IP addresses, access times, and pages visited for security and troubleshooting.
• Cookies: We use essential cookies for authentication and session management. We may use analytics cookies to improve our service.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide Our Service: To create, host, and display your website.
• Authentication: To verify your identity and secure your account when you sign in, and — when you connect an AI agent — through the OAuth authorisation you approve for that agent. If you grant an agent the optional email scope, it can read the email address on your account; you can see this on the approval screen and revoke it at any time.
• Process Payments: To handle subscription billing through Polar, our Merchant of Record.
• Send Notifications: To send you important emails including contact form submissions, billing notices, and service updates.
• Analytics: To provide you with visitor analytics for your website and to improve our platform.
• Customer Support: To respond to your inquiries and provide assistance.
• Security: To protect against fraud, abuse, and unauthorized access.
• Legal Compliance: To comply with applicable laws and regulations.

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

• Service Providers (subprocessors): We use the following third-party services to operate the platform. Each acts as a subprocessor of your data for the specific purpose listed:
  • Supabase: Database and authentication services. Stores account data, site content, form submissions, and contact records.
  • Polar (polar.sh): Sitelas's authorized reseller and Merchant of Record for the Sitelas subscription and one-time AI-credit purchases only. Polar processes and stores your payment method, charges your subscription, collects and remits any applicable sales tax/VAT, and provides first-tier billing support. Sitelas never receives or stores your full card details. Sitelas does not process any end-customer payments — see “Embedded payment & booking links” below.
  • Resend: Email delivery for transactional emails from Sitelas (site lifecycle notices, billing warnings, one-time login codes).
  • Cloudflare (Turnstile): Bot protection on public forms. Processes a visitor's IP address and challenge signals to verify the submission is human; Cloudflare does not retain this beyond verification.
  • Google (Gemini): AI generation and the in-editor chat. Prompts and generated content are sent to Google and subject to Google's data terms.
  • Vercel: Hosting, edge delivery, and analytics infrastructure.
• Embedded payment & booking links: Sitelas is a website builder — it does not sell products or take payments on your visitors' behalf and operates no storefront, cart, or checkout. If you add a Stripe Payment Link or a Calendly booking widget to your site and a visitor uses it, that payment or booking happens entirely on the provider (Stripe / Calendly), into your own account. Sitelas does not process, receive, or store those payments or the visitor's payment details. Messages your visitors send through your site's contact/newsletter forms land in your Sitelas inbox (and, if you configure one, forward to your own webhook); for that form data you are the controller as the site owner and Sitelas acts as a processor on your behalf.
• Public Website Content: Content you publish on your website is publicly accessible. This includes any text, images, and other content you choose to display.
• Legal Requirements: We may disclose information if required by law, court order, or government request.
• Protection of Rights: We may disclose information to protect our rights, property, or safety, or that of our users.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• All data transmission is encrypted using SSL/HTTPS.
• Database encryption at rest and in transit.
• Row-level security (RLS) for multi-tenant data isolation.
• Sign-in handled by our authentication provider, with Google as the usual method, and agent access granted through OAuth you approve and can revoke at any time.
• Regular security audits and updates.

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide our services:

• Active Accounts: Data is retained while your subscription is active.
• Cancelled Accounts: After subscription cancellation, your website is unpublished. Account data may be retained for a reasonable period for legal and business purposes.
• Trial Expiration: If you do not subscribe after your trial, your website is unpublished, but data may be retained for a period to allow reactivation.
• Deletion Requests: You may request deletion of your account and data by contacting us.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request access to your personal data.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your personal data.
• Portability: Request a copy of your data in a portable format.
• Objection: Object to certain processing of your data.
• Withdraw Consent: Withdraw consent where processing is based on consent.

To exercise these rights, please contact us at contact@sitelas.com.

8. Cookies

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication, session management, and core functionality.
• Analytics Cookies: To understand how visitors use our platform and improve our service.

You can control cookies through your browser settings, but disabling essential cookies may affect your ability to use our service.

9. Third-Party Links

Your website may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

10. Children's Privacy

Our service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

Our services are hosted in the United States. If you access our service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our service after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: