Privacy Notice

1. Who we are

Sitely is an AI-powered website builder operated by Bouchra Khalifa, an individual entrepreneur based in Spain, trading as Sitely. Bouchra Khalifa is the data controller of the personal data described in this notice. You can contact our support team about your data at any time.

2. Personal data we collect

• Account data: your email address, display name, and authentication credentials (stored in hashed form by our authentication provider).
• Content data: the prompts you submit, the websites you generate, project names and settings, and messages in the editor.
• Usage data: device and browser information, IP address, and service logs such as generation requests and credit transactions.
• Support data: messages you send to our support team.

3. Purposes and legal basis

• Providing the Service — creating your account, generating and storing your websites, applying plans and credits (legal basis: performance of our contract with you).
• Security and fraud prevention — protecting accounts, detecting abuse and enforcing our Terms (legal basis: legitimate interests).
• Product improvement — understanding how features are used to improve the Service (legal basis: legitimate interests).
• Customer support — answering your requests (legal basis: performance of contract).
• Payments — purchases, subscriptions, tax compliance and invoicing are handled by Paddle as our Merchant of Record (legal basis: performance of contract and legal obligation).

4. Data sharing

We share personal data only with the following categories of recipients:

• Service providers and subprocessors — our hosting, database, authentication and AI-processing providers, which host the Service and process your prompts to generate websites.
• Paddle.com — as Merchant of Record, Paddle handles the sale of our products, subscription management, payments, tax compliance and invoicing. Paddle's handling of payment data is governed by Paddle's own privacy policy.
• Professional advisers — legal and accounting advisers, where needed.
• Authorities — where disclosure is required by law or necessary to protect rights, safety or security.

We do not sell your personal data or use it for third-party advertising.

5. Data retention

We keep your personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations and resolve disputes. When data is no longer needed, we delete or anonymise it. If you delete a project or your account, the related content is deleted or anonymised within a reasonable period.

6. Your rights

Depending on the laws that apply to you, you have the right to access your personal data, rectify inaccurate data, erase data, restrict or object to processing, receive your data in a portable format, and withdraw consent where processing is based on consent. You can also complain to your local supervisory authority. We respond to requests within one month; contact our support team to exercise your rights.

7. International transfers

Our service providers may process data in countries other than your own, including outside the UK and the European Economic Area. Where that happens, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions to protect your data.

8. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and restricting access to data to those who need it to provide the Service.

9. Cookies and local storage

We use only essential storage: a session cookie and local storage entry to keep you signed in, and a local preference to remember your language choice. We do not use advertising, marketing or third-party analytics cookies. You can clear these through your browser settings.

10. Children

The Service is not directed to children, and we do not knowingly collect personal data from children below the age of digital consent in their country.