Who we are

The data controller is EAGENCY WEB DESIGN SRL, registered office at 12 Avram Iancu Street, Târgoviște, Dâmbovița County, Romania, Trade Register no. J2023000354159, tax ID (CUI) 47845036 (“we”). You can write to us any time through the contact page.

What data we process

Your account: your name, email address and password, which we only keep as a hash, never in plain text.
Your business and team: the business name in the account, the people you invite and their roles.
What you add: the description of your business, texts, photos, logos and the settings of your sites.
Payments: the state of your subscription, invoices and credit movements. You enter your card details directly with Stripe; we never see or keep them.
Security: your IP address and the important actions in the account (sign-ins, publishing, deletions), in the security log.
The phone app: an installation identifier, used only to send you notifications, and which notifications you chose to receive. It uses the camera and your photos only when you choose to upload a photo.
The contact page: the name, email and message you send us.

Why, and on what basis

To provide the service you chose: the account, the sites, the modules, notifications and support (performance of a contract, Art. 6(1)(b) GDPR).
To keep the accounting records of payments (legal obligation, Art. 6(1)(c)).
To protect accounts and the platform from abuse and attacks, and to answer messages sent through the contact page (legitimate interest, Art. 6(1)(f)).

We do not sell your data, we do not use it for advertising and we do not make decisions with legal effects about you through profiling.

Artificial intelligence

Siteflect writes and changes sites with the help of artificial intelligence models. When you generate a site, use the chat or ask for a picture or a logo, the text of your request and the content it needs reach the provider of the model used: Anthropic (USA), OpenAI (USA), Google (USA), DeepSeek (China) or Recraft (for logos). Each provider receives only what that request needs.

Please do not write sensitive personal data, yours or anyone else’s, in your requests.

Who we share data with

We work with providers who process data on our behalf, each only for its own role:

Hetzner Online GmbH (Germany): the servers Siteflect runs on.
Cloudflare: protecting and delivering the traffic to the platform’s addresses.
Stripe: payments and invoices.
Resend: sending emails (confirmations, notifications).
Google Firebase Cloud Messaging: delivering notifications to your phone.
The AI providers in the section above.
Pexels: searching stock photos; it only receives the search words.
The database backups are encrypted (AES-256) before they reach external storage.

When data leaves the European Economic Area, the transfer relies on the GDPR transfer mechanisms each provider offers, such as the European Commission’s standard contractual clauses.

We disclose data to authorities only when the law requires us to.

Visitors of sites made with Siteflect

The data visitors leave on our customers’ sites (form messages, bookings, newsletter sign-ups, reviews, chat conversations) belongs to the business that owns the site. For that data, the business is the controller and we process it only on its behalf and on its instructions. Visit statistics are anonymous and use no cookies.

If you left data on such a site, write to that business first; if it does not answer, you can also write to us.

How long we keep data

Account and site data: for as long as you have the account. What you delete is deleted for good, at once.
After a subscription ends: the sites stay online for 14 days, then offline for another 60 days, after which the business and its data are deleted.
Invoices and the amounts in the credit history: 10 years, as accounting law requires, with nothing that identifies you once the account is deleted.
The security log: 12 months.
The servers’ technical logs: 14 days.
Messages sent through the contact page: 12 months.
Encrypted backups: at most 28 days; what was deleted leaves them as they rotate.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability and to object to processing based on legitimate interest. You can do much of this yourself in your account: change your details in Settings, download your texts and photos in Settings → Your data, and delete your account in Settings → Delete account.

For any request, write to us through the contact page; we answer within one month. You also have the right to lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or the authority where you live.

Cookies

siteflect.com uses no cookies. The app.siteflect.com web app uses only strictly necessary cookies: the one that keeps you signed in and the one that remembers your language. We use no advertising or tracking cookies.

Security

Every connection is encrypted (HTTPS). Each business’s data is kept apart from the others’ at the database level, passwords are only kept as hashes and backups are encrypted. We access data only when the service or support needs it, and that access is logged.

Children

Siteflect is a service for businesses and is not meant for people under 16.

Changes

We may update this policy when the service or the law changes. The date of the last update is shown at the top of the page; we tell you about important changes by email before they take effect.

Privacy policy