Privacy notice

Who is responsible

The controller of your personal data is SiteAfter, a FillFold solution, DE, USA. For anything about your data, email [email protected]. Because we are based in the United States, our team may access the data described here from there, under the safeguards set out below.

What we collect

When you ask for a preview, we store the address of your current website, your email address, the page you used, the date and time you confirmed that you own or manage the business, and whether you confirmed your request by email. We then email you about your preview. If you have no website yet, we also store your answers to our short questionnaire (encrypted, like your email address) and keep the photos you email us, for your preview only.

When we prepare a preview of a business’s website, whether the business asked for it or not, we use content taken from that business’s publicly accessible website: its texts, photos, opening hours and the business contact details published there, which can include the name, phone number or email of a sole trader. Guest reviews and photos of people may appear on such sites: we keep reviewers to a first name or initials and leave out photos of identifiable people unless the business asks us to keep them.

When you use the website check, our server reads the public pages of the address you give (its home page, robots.txt, sitemap and a few of its links and images), like a visitor would, and shows you the result. The address and the result are kept only in the server’s memory for 15 minutes, so that reloading the page does not check the site again, and are never written to a database. Your IP address is used, in memory only, to limit the number of checks per minute.

When you become a customer, we keep your name, business name and address, your email, your order and invoices, and the photos and texts you give us for your site.

When we host your site, the messages your guests or customers send through its forms reach us on your behalf: for that data you are the controller and we act as your processor, as set out in section 12 of our terms of sale.

When you use the site, our server and our network provider briefly process your IP address to deliver pages and protect the site from abuse, for example by limiting repeated requests. If we enable visit counts, they use a privacy-friendly tool hosted on our own server, with no cookies and no stored IP address; we only see totals.

Why, and on what basis

• Previews you ask for: taking the steps you ask for before any contract (GDPR Article 6(1)(b)). We first send you one email asking you to confirm your request; until you click the link, we do nothing with it.
• Previews you did not ask for: our legitimate interest in offering a business a free, private look at what its website could be (Article 6(1)(f)). We tell the business at our first contact, by post, with a link to this notice. We contact a business at most once about a preview it did not ask for.
• Customers: performing our contract with you (Article 6(1)(b)), and keeping invoices and accounting records as the law requires (Article 6(1)(c)).
• Website check: taking the steps you ask for (Article 6(1)(b)) and our legitimate interest in preventing abuse of the tool (Article 6(1)(f)).
• Security and visit counts: our legitimate interest in keeping the site safe and improving it (Article 6(1)(f)).

We make no automated decisions about you that have legal or similarly significant effects.

Where your data is kept, and how it is protected

Your email address and website address are encrypted (AES-256) before they are stored in a database on a server we rent in the Netherlands, in the European Union. Previews are stored on the same server, behind private, unlisted links that we ask search engines not to index. The site is served over HTTPS only.

Who processes data for us

• Hosting: the provider of our server in the Netherlands.
• Network and email: Cloudflare carries all traffic to the site (which includes your IP address), sends our emails, and forwards messages sent to [email protected], including the notice of each confirmed preview request, to our mailbox provider.
• Payments: online payment is not open yet. When it opens, payments will be handled by Stripe. We will update this notice first.

Some of these providers, and our own team, may handle data outside the European Union, in particular in the United States. Such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguards. We do not sell or share your data with anyone else.

How long we keep it

• Preview requests that are never confirmed are deleted after 30 days.
• A preview that is not taken up is deleted 30 days after we send it, or first tell the business about it, together with the request and the copies of the content we made for it.
• If you become a customer, we keep your site’s content while we build or host it, and your copy is sent to you when the service ends; invoices and accounting records are kept for as long as tax and accounting rules require.
• If a business asks us not to contact it again, we keep its name and address on a do-not-contact list so that we can respect that request.
• Security logs are kept only as long as needed to protect the site.
• We delete your data sooner if you ask, except where we must keep it.

Your rights

You can ask us to give you access to your data, correct it, erase it, restrict its use, or send it to you in a portable format. Write to [email protected]; we reply within one month.

You can object at any time to our use of your data based on our legitimate interest, including for any preview we prepared about your business. We then stop, unless we have compelling legitimate grounds.

You can also complain to the Data Protection Commission in Ireland (dataprotection.ie) or to the data protection authority in the EU country where you live or work.