Privacy Policy

Last updated: 3 October 2026

This policy explains what personal data Siteiz ("we", "us") collects when you use siteiz.com, why we collect it, how long we keep it and the rights you have. The data controller is Siteiz, Umeå, Sweden. Contact: privacy@siteiz.com.

What we collect and why

Your account

When you log in, we store your email address and a user ID. We do not use passwords: you sign in with a one-time link sent to your email. For your account we also store the websites you add, your scan history and results, and your plan. Legal basis: performing our contract with you (Article 6(1)(b) GDPR).

Website scans

When you scan a website, we fetch its public pages the way a search crawler does and store the technical results (scores, findings, page addresses). This is data about websites, not about you. If you run a free single-page scan and give an email address to receive fixes, we process that email too. Legal basis: providing the service you asked for (Article 6(1)(b)) and our legitimate interest in running and improving the scanner (Article 6(1)(f)).

Payments and subscriptions

Payments are handled by Stripe. We never see or store your full card details. Stripe shares with us what we need to run your subscription and keep records: your name, email, billing address, VAT number if you give one, the plan, payment status and invoices. Legal basis: performing our contract (Article 6(1)(b)) and our legal obligation to keep accounting records (Article 6(1)(c)). Stripe also acts as an independent controller for fraud prevention and its own legal obligations, described in Stripe's privacy policy.

Newsletter

If you subscribe to AI Search News, we store your email address and a record of your consent, including when you confirmed it. Legal basis: your consent (Article 6(1)(a)), given through a double opt-in and withdrawable at any time with the unsubscribe link in every email.

Service emails

We send emails you need to use Siteiz: sign-in links, receipts and important account or service notices. These are part of the service and not marketing. Legal basis: performing our contract (Article 6(1)(b)).

Analytics and security

We use Cloudflare Web Analytics, which is cookieless and only produces aggregate statistics such as page views and referrers. Our forms are protected by Cloudflare Turnstile, which checks that a visitor is human. Our hosting providers keep standard technical logs (IP address, browser type, time) for security and reliability. Legal basis: our legitimate interest in a secure, working site (Article 6(1)(f)).

Cookies and browser storage

We do not use advertising or tracking cookies, so there is no cookie banner. Everything we store in your browser is strictly necessary for a feature you use, or remembers a choice you made. Under the ePrivacy rules (in Sweden, the Electronic Communications Act) this does not require consent.

Stripe sets its own cookies on its checkout and billing pages to process payments and prevent fraud. Cloudflare may set a short-lived security cookie when it checks for bots.

Who we share data with

We do not sell your personal data or share it for advertising. We use these providers, who process data on our behalf under data processing agreements:

• Supabase, Inc.: database, sign-in and storage for account, scan and subscriber data.
• Vercel, Inc.: website hosting.
• Cloudflare, Inc.: infrastructure, browser rendering for scans, bot protection and cookieless analytics.
• Resend: delivery of sign-in links and other emails.
• Stripe Payments Europe Ltd. and Stripe, Inc.: payments, subscriptions, invoices and tax calculation.
• LinkedIn: only to publish our own posts. We do not send your personal data to LinkedIn.

We may also disclose data when required by law, for example to authorities or for accounting audits.

International transfers

Some providers are based in, or use subprocessors in, the United States. Those transfers are covered by the EU-US Data Privacy Framework where the provider is certified, or by the EU Standard Contractual Clauses.

How long we keep data

• Account data, sites and scan history: for as long as you have an account. Deleted within 30 days after you ask us to delete your account.
• Free single-page scans not linked to an account: up to 12 months, then deleted or anonymized.
• Payment and invoice records: 7 years, as required by the Swedish Accounting Act (Bokföringslagen).
• Newsletter: until you unsubscribe, plus a minimal record of the unsubscribe so we can honor it.
• Technical logs: a short period, typically up to 90 days, by our providers.

Your rights

You have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent at any time. To delete your account or exercise any right, email privacy@siteiz.com from the address you use with Siteiz. We respond within one month. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live.

Security

We use technical and organizational measures to protect your data, including encryption in transit, password-free sign-in, and database rules that only let each account read its own data. No method is perfectly secure, and we will tell you without undue delay if a breach is likely to put your rights at risk.

Children

Siteiz is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.

Contact

Siteiz, Umeå, Sweden. Privacy questions and requests: privacy@siteiz.com.