SITESMITH · LEGAL

Privacy Policy

Last updated: September 29, 2026

1. Who is responsible for your data

The controller of personal data described here is Rosseta Systems sp. z o.o., ul. Zwycięstwa 2, 42-700 Lubliniec, Poland, registered in the Polish National Court Register (KRS) under number 0000482365, NIP (tax ID) 5761576472 ("we", "us"), which operates the SiteSmith service.

For anything in this policy, including any request below, write to [email protected]. A person reads that address; there is no ticket system to fight.

2. What we collect, and why

If you ask us for a preview

When you submit the form on this site we store the email address, website address, business name and description you type, plus the IP address the request came from, the country our host reports, and which campaign referred you. We use it to build and send your preview, and to keep an audit trail of who asked us for what. Legal basis: steps taken at your request before entering a contract (GDPR Art. 6(1)(b)), and our legitimate interest in preventing abuse of the form (Art. 6(1)(f)).

To decide when to follow up about your preview and what to say, we also record whether our emails to you were opened or their links clicked (reported by our email provider, Postmark), when your preview is visited, and whether its buy page or checkout was opened. We use this only for our own follow-ups about your request and never share it for advertising. Follow-ups and replies are written with the help of AI and checked against our rules; anything they cannot answer goes to a person. Legal basis: our legitimate interest in following up on a preview you asked for (Art. 6(1)(f)). Every follow-up has an unsubscribe link.

If we wrote to you first

We contact business owners about their existing business websites, using business contact details published on those websites. We store the website address, the published contact address, and whether you replied or asked us to stop. Every message carries a one-click unsubscribe, and an unsubscribe is permanent — we keep the address on a suppression list precisely so we never write again. Legal basis: our legitimate interest in offering a relevant business service (Art. 6(1)(f)). You may object at any time, and unsubscribing is that objection.

If you buy

Payment is taken by Stripe. We never see or store your card number — it goes directly to Stripe. We store your email address, what you bought, and the Stripe session reference, so we can deliver the site, prove the purchase, and issue receipts. Legal basis: performance of our contract with you (Art. 6(1)(b)) and our legal obligation to keep accounting records (Art. 6(1)(c)).

If you sign in to the customer panel

Sign-in is handled by Auth0 (Okta). You either receive a one-time code by email or use Sign in with Google; in both cases we receive your email address and, from Google, your name. We create a session record so the panel knows which websites are yours. We ask Google for nothing beyond your email address and basic profile — no contacts, no Drive, no Gmail. Legal basis: performance of our contract with you (Art. 6(1)(b)).

If you buy a domain or mailboxes

Domains are registered through OVHcloud with you as the registrant. That means your name and contact details are sent to the domain registry and may appear in public WHOIS/RDDS records — this is a requirement of the domain system, not our choice. Mailbox contents on business email plans are yours; we do not read them. Legal basis: performance of our contract with you (Art. 6(1)(b)).

If you arrive through a referral link

A referral link carries a short code naming the customer who shared it. Our site keeps that code in your browser (local storage) for up to 60 days, so the referral price still applies if you come back later, and sends it with your preview request. We store which code your request came with, to fix your price and to send the customer who referred you a thank-you gift card if you buy. Legal basis: our legitimate interest in running the referral program (Art. 6(1)(f)).

If you agree to have your website featured

We store what you agreed to (sitessmith.com, our Facebook page, or both), when, the version of the page you agreed on, your country as reported by our network provider, the words and first name you chose to add, and the screenshots and details shown. We keep the record while your website is featured and afterwards as proof of your permission. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time; withdrawing takes your website off sitessmith.com at once and deletes the Facebook post.

If you use a contact form on a website we built

Forms on the sites we build submit through our gateway, which forwards the message to the business that owns the site and applies bot protection (Cloudflare Turnstile). For those messages the business owning that website is the controller and we act as its processor. Ask that business about its own privacy notice.

3. Who else processes it

We keep the list short on purpose. Each of these does one job:

Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We do not sell personal data, and we do not share it for anyone else's advertising.

4. Advertising and measurement on this site

We count page loads, form starts, submission attempts and errors, and whether the examples, the video and the request form were reached or used (an example opened, the video started or half watched, the main button clicked), to understand how this page and the request form work. These counters contain only an event category, date and a fixed campaign label, with no form contents, IP address, cookie or visitor identifier stored in the counters. Counter records expire after 14 days. Browser counters respect Do Not Track and Global Privacy Control. Accepted requests are counted separately by our server. These totals are not unique visitor counts.

We use Meta Pixel to measure our advertising: it records page views and enquiry events, and may set cookies. For a purchase that follows a measured enquiry, server-side measurement sends Meta the purchase value, currency and a hashed email address. When measurement is on and you submit the request form, our server also sends Meta that enquiry with a hashed email address, a hashed request reference, a hashed country code, your IP address, browser user agent and Meta's _fbp/_fbc identifiers. Opting out, GPC or Do Not Track stops this. How it starts depends on where you are, which we check once per visit from your connection's country without storing it:

• United States and other countries where notice is sufficient: measurement runs from page load. You can opt out at any time using the control at the bottom of our homepage. Global Privacy Control and Do Not Track switch measurement off, including when this browser previously allowed it.
• EEA, United Kingdom, Switzerland, or an unknown country: measurement stays off unless this browser already has an explicit consent recorded. You can withdraw that consent using the same footer control. We do not ask for advertising consent in the preview request form.

For visitors in the United States, we also use a Google Ads tag to measure accepted preview requests. It can set advertising attribution cookies (such as _gcl_*) and sends the request event, a request reference for deduplication, page and ad-click information, and browser connection information to Google. We do not send form contents, email addresses or phone numbers to Google; enhanced conversions and personalized advertising are disabled. This tag stays off outside the US, when country detection fails, or when you opt out or send a Global Privacy Control or Do Not Track signal. The footer opt-out applies to both Meta and Google measurement.

Advertising measurement is never required to request a preview. Opting out or withdrawing does not cancel an existing rebuild request. Websites we build for customers ship with analytics switched off; the owner decides whether to turn it on.

5. How long we keep it

• Enquiries that do not become customers: up to 12 months, then deleted.
• Customer records: for as long as we host or support your site, and afterwards as long as accounting law requires (in Poland, 5 years from the end of the tax year).
• Your website's files: each version we deliver and your panel edits, kept for as long as you are our customer — also when you host the site yourself — so we can make changes for you later. Deleted when you ask.
• Panel sessions: 30 days, then they expire by themselves.
• Unsubscribe records: kept indefinitely — deleting them is how a business accidentally emails you again.

6. Your rights

Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to someone else in a portable format. You may also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

7. Cookies

We use cookies that are necessary for the service to function: a sign-in session cookie for the customer panel, and short-lived cookies that protect the sign-in and the forms against abuse. The advertising tags described in section 4 also set cookies. We do not use cookies to build advertising profiles of you across other websites.

8. Automated decisions

We do not make decisions about you with legal or similarly significant effects by automated means alone.

9. Children

SiteSmith is a service for businesses and is not directed at children.

10. Changes

If we change this policy we update the date at the top. Where a change materially affects customers, we tell them by email rather than expecting them to re-read this page.

Text notifications about your requested preview

The SiteSmith text messaging service is operated by Michał Malik, sole proprietor, using Twilio to deliver messages. Messaging support and privacy requests can be sent to [email protected].

We collect the phone number you enter with your request. Providing a number does not subscribe you to texts. If you separately opt in, we use it to send your requested preview and up to three reminders through Twilio and mobile network operators. We record the consent wording, version, date, number and time zone automatically reported by your browser. Phone numbers and SMS consent are not sent to our website generation models or used for ad measurement.

We do not sell or share mobile numbers, SMS opt-in information or consent with third parties for their marketing. We share them only with service providers needed to operate messaging. Reply STOP to stop texts, or contact [email protected]. We keep consent and delivery records to document your choices and retain a suppression record to prevent unwanted further messages.