Privacy Policy

This policy applies to personal information SiteSmith processes about website visitors, prospective clients and clients. It does not cover information that visitors submit to websites we host for our clients. For that, see section 7.

SiteSmith operates sitesmith.cloud and is the controller of the personal information described in this policy. You can reach us about privacy at [email protected].

Our text messaging program is registered with mobile carriers under the brand name Site Smith. Section 12 explains what we collect and send when you give us a mobile number.

3.1Information you give us

3.2Information collected automatically

When you use our website and client area we collect technical information such as IP address, browser and device type, pages visited and timestamps, in server logs used for security, troubleshooting and fraud prevention.

3.3Information from third parties

We receive payment confirmations and fraud signals from Stripe, and message delivery information from our email and SMS providers.

We don't use your information for automated decision-making that has legal or similarly significant effects on you.

We use a small number of strictly necessary cookies and browser storage. We don't use advertising, analytics-tracking or cross-site cookies, so no cookie banner is required.

We do not sell or rent personal information, and we do not "share" it for cross-context behavioral advertising. We disclose it only to the service providers below, under contracts that require them to protect it and use it only on our instructions.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

Your mobile number and text-message opt-in are shared only with Twilio, the carrier network and our own systems, purely to deliver the messages you asked for. Site Smith does not pass them to anyone else for their own marketing, and no third party is permitted to market to you using them.

We may also disclose information to professional advisers such as accountants and lawyers, to a buyer or successor if our business is sold or merged, or where required to comply with the law, enforce our agreements or protect the rights and safety of our clients, SiteSmith or others. Where the law allows, we'll tell you about legal requests first.

When we host a website for a client, the client decides what personal information that website collects from its visitors, and is responsible for its own privacy policy. We process that information only as a service provider (processor) to host and support the website, and we'll help clients meet their obligations where we reasonably can.

We are based in the United States and our service providers may process information in the United States and other countries. Where we transfer personal information from the EEA, UK or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses.

• Encryption in transit (HTTPS/TLS) across our website, client area and control panel.
• Passwords stored only as salted hashes. Server credentials encrypted at rest.
• Role-based access so staff can only see what their job requires.
• Regular security updates, monitoring and daily backups.

No method of transmission or storage is completely secure. If a breach affects your personal information, we will notify you and any authorities as required by law.

11.1Rights for everyone

Wherever you live, you can ask us to access, correct, export or delete your personal information, and you can update most details yourself in your client area.

11.2California residents

Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to know what personal information we collect, use and disclose; to request deletion; to correct inaccurate information; and to opt out of the sale or sharing of personal information. We do not sell or share personal information. We will not discriminate against you for exercising these rights.

11.3EEA, UK and Swiss residents

Under the GDPR and similar laws, you also have the right to restrict or object to certain processing, to data portability, to withdraw consent where we rely on it, and to complain to your local data protection authority.

11.4How to make a request

Email [email protected] from the address on your account. We may need to verify your identity before responding. We respond within 30 days, or sooner where the law requires. You may use an authorized agent, who must provide written permission from you.

We send service messages such as receipts, renewal notices, security alerts and ticket replies, which you can't opt out of while you have an active account. If we ever send marketing emails, we'll include an unsubscribe link in every one.

12.1Text messages

If you give us a mobile number and confirm it, Site Smith texts you security codes and service alerts only. We never send marketing texts. Message frequency varies and message and data rates may apply.

Reply STOP to any message to opt out, or HELP for help. We keep a record that you opted out so that we can honor it, and we then send account notices to your email address instead. You can remove your number from your account at any time. The full terms are in section 4 of our Terms of Service.

We don't track you across other websites. We treat Global Privacy Control (GPC) browser signals as a valid request to opt out of any sale or sharing of personal information.

Our Services are intended for businesses and adults. We don't knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we'll delete it.

We may update this policy from time to time. We'll post the updated version here with a new "last updated" date and, for material changes, email account holders before they take effect.

For privacy questions or to exercise your rights, email [email protected]. We'll reply within one business day and complete requests within 30 days.