Privacy Policy

Last updated October 10, 2026

Who we are

SiteCreatorEngine is a service that builds and hosts a website for a small business. You answer a few questions about your business, our models draft the pages, and the result goes live on a subdomain of this site. Connecting a domain you own is planned for the paid plans and is not available yet.

This policy explains what we collect, why, and what you can ask us to do with it. It covers the service itself. It does not cover the sites our customers publish with it - each of those belongs to the business that runs it, and that business decides what happens with the data its own visitors leave.

What we collect from you

Your email address. It is the only thing we require to create an account, because there is no password in this product at all: we email you a one-time link when you need to sign in.

What you tell the builder about your business - the name, the trade, the town, the services, the opening hours, anything you type into the wizard or the editor. It becomes the content of your site, so it is public the moment you publish.

Files you upload: photos, a logo, whatever you place on the pages.

If you connect a paid plan, your payment is handled by the payment provider. We never see or store a card number.

• If you sign in with Google, we receive your email address and the fact that Google confirmed it. Nothing else for signing in. We do not ask Google for your contacts, your files or your profile picture, and we do not post anything anywhere on your behalf. Connecting Google Calendar to your bookings is a separate step that you choose to take. See the Google section below. Questions to support@sitecreatorengine.com.

What the service collects on its own

Ordinary server logs, kept for a short time, so that we can see errors and abuse.

Visits to the sites built with the service, counted by our own counter. This one is worth describing precisely, because it works differently from what you may expect.

• The counter sets no cookies. None at all.
• A visitor is recognised by a one-way fingerprint built from their address, their browser string, the site and a secret, and that fingerprint changes every day. The address and the browser string themselves are never written to the database.
• Because of that, we can tell you how many visits a day a page had, and we cannot tell you that the same person came back next week. We think that is the right trade, and it is why the numbers in your dashboard are called visits rather than people.
• The consequence for the sites built with the service: this counting needs no cookie banner. A site shows a short cookie choice only when its owner adds something that sets cookies - their own analytics counter, their own code, a map or content from another service - and that content waits until the visitor allows it.

Session recording on this website, only with your consent

On the pages of SiteCreatorEngine itself - this website, the builder and the dashboard - we can record how the pages are used with Smartlook, a session recording service. It shows us where people get stuck, so that we can fix it. We do this only if you say yes.

• Nothing is recorded until you choose "Allow" in the notice at the bottom of the page. If you choose "No, thanks", or make no choice at all, the recording script is not loaded.
• What a recording contains: the pages you open, clicks, scrolling and pointer movement, your device type, browser and screen size, and an approximate location worked out from your address.
• What it does not contain: anything you type into a form, and numbers or email addresses shown on the page. The recording script is told this explicitly by our code, not left to its defaults.
• Smartlook keeps a small identifier in your browser to join the pages of one visit, and stores recordings in the European Union for a limited period set by its service plan, after which they are deleted.
• You can change your mind at any time with "Privacy choices" at the bottom of every page. Choosing "No, thanks" stops the recording from that moment.
• The sites our customers build with the service are never recorded this way.

Visit statistics on this website (Google Analytics)

On the pages of SiteCreatorEngine itself we count visits, sign-ups and plan purchases with Google Analytics, so that we know which pages and which channels bring people to the service.

• Until you choose "Allow", Google Analytics sets no cookies and receives only cookieless signals (Google's Consent Mode): the page address, the time and the type of device, without an identifier that recognises you.
• After "Allow", it keeps an identifier in a cookie to join the pages of your visits, and Google may use it to measure our advertising.
• When you buy a plan, our server tells Google Analytics the plan, the amount and a transaction number, linked to that identifier if you allowed it. Card details never go to Google.
• You can change your mind at any time with "Privacy choices" at the bottom of every page.
• The sites our customers build with the service never carry our Google Analytics.

Artificial intelligence, and what is sent where

The text and images on your site are drafted by models we call through their providers: Anthropic writes the text, and OpenAI draws the images you ask for. To build your site we send them what you told us about your business, plus our own instructions.

When an assistant works with one of your customers, enquiries or bookings - because you asked it to, or because you switched on its replies to new enquiries - the details that task needs are sent to Anthropic with that request: usually the person's name, how to reach them and what they wrote. Nothing about your customers is sent to OpenAI.

When you speak to an assistant instead of typing, the recording is sent to OpenAI to be turned into text, and only the text comes back. We do not keep the recording anywhere.

Providers process that request to answer it. We do not permit them to train general models on it, and our accounts are configured accordingly.

Model output can be wrong, dated, or simply not about your business. Every page is yours to read and edit before it goes out, and the final text is your responsibility - that is stated again in the terms.

Stock photographs come from Unsplash and Pexels under their own licences. Generated images are produced on request, one press at a time, and never in the background.

Data your own customers leave

A site built here can carry an enquiry form, a booking widget and a customer list. When somebody fills that form, the data belongs to the business that owns the site - you are the controller of it, and we process it for you.

Practically, this means: you decide what to ask for, you decide how long to keep it, and you answer the person who asks you to delete it. We store it, we keep it away from other businesses on the platform, and we delete it when you delete it or close your account.

We do not sell it, we do not mine it for advertising, and we do not use one business's customers to do anything for another.

Google sign-in, Google Calendar and Google APIs

Signing in with Google is optional. It exists so that you do not have to wait for an email to arrive.

• For signing in we ask Google for two things only: that you are signed in (openid) and your email address (email).

Connecting Google Calendar to your bookings is optional too, and you can disconnect it at any time on the same screen.

• When you connect it, we ask Google for two calendar permissions only: to create and manage one calendar of our own in your account (calendar.app.created), and to see when you are busy (calendar.freebusy). We cannot read, change or delete your other calendars or their events.
• Each booking is written as an event to that one calendar, so you see your appointments on your phone. The busy times of your main calendar are checked so that clients are not offered a time when you are already busy. From your main calendar we see only the start and end of busy periods - not titles, places or guests.
• In a team, each person who connects their own calendar gets their own bookings there, and their busy times close only their own time.
• The access keys Google gives us are stored encrypted. Busy times are kept only for a few minutes, to answer the booking screen. If you ask an assistant for free times, it receives times that already take your busy periods into account; the busy periods themselves are not sent to it.
• When you disconnect, we withdraw our access at Google and delete the keys. Events we already wrote stay in your calendar, because they are your appointments.
• SiteCreatorEngine's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• We do not sell data received through Google APIs, do not use it for advertising, and do not let anyone read it except with your permission, for security, or where the law requires it.
• We do not use data received through Google APIs to develop, improve or train generalised artificial intelligence or machine learning models.

Who else touches the data

Hosting - Cloudways on Amazon Web Services, in Frankfurt, Germany.

Network and DNS - Cloudflare.

Email delivery - the mail provider configured for the service.

Models - Anthropic and OpenAI, as described above.

Photographs - Unsplash and Pexels.

Calendar, only if you connect it - Google Calendar (Google).

Session recording on this website, only if you allow it - Smartlook.

Visit statistics on this website - Google Analytics (Google), with cookies only if you allow them.

Payments, when a paid plan is in use - the payment provider, who handles the card details we never see.

Each of them does one job for us and is not allowed to use your data for anything else.

Our own support team, when you need help with your website: a team member can sign in to your account for up to an hour to fix things for you. Every visit is shown with its date and time in your profile. During a visit payments, deleting and your team stay closed, and the work does not use your AI credits.

How long we keep things

Your account and your sites: for as long as the account exists.

Raw visit events: 90 days. The daily totals built from them are kept, because a chart of the last two years is the point of having a counter at all - and by then there is nothing in it that points at a person.

Enquiries and customer records: until you delete them, or for a year if nothing else happens to them.

Records of what the assistants did - which tools they used, with what input, and how it went: 90 days, so we can answer questions and complaints about their work. Email addresses and phone numbers in the recorded results are hidden.

Server logs: days, not months.

When you close your account we delete your sites, your files and your customer records. Some things survive for a while in backups, and those roll over on their own.

What you can ask us to do

See what we hold about you, get a copy of it, correct it, or have it deleted.

Take your content elsewhere: the customer list exports to a spreadsheet from Customers, and we will send you the text and images of your pages if you ask.

Stop emailing you. Every email we send carries an unsubscribe link, and it works without signing in.

• Write to support@sitecreatorengine.com and we will answer. If you are in the EU or the UK and you think we answered badly, you can complain to your data protection authority.

Children

The service is for running a business, and it is not meant for anyone under 16. We do not knowingly collect anything from a child. If you believe we did, write to us and it will be removed.

Security, honestly stated

Traffic is encrypted, secrets live outside the database, the sites of different businesses are kept apart, and access to the servers is limited to the people who run the service.

No one can promise that nothing will ever go wrong. If something does happen to your data, we will tell you about it rather than wait for you to notice.

Changes

When this policy changes we update the date at the top of the page. If a change actually affects what happens to your data, we will email you before it takes effect rather than quietly rewrite the page.

Contact

• Questions about this policy: support@sitecreatorengine.com