Privacy Policy

• Account info — email, name, phone (if provided), and the URL of the site you want upgraded.
• Payment info — handled entirely by our payment processor. We do not receive or store your full card number. We keep a payment confirmation, the amount and the processor’s reference ID.
• Order data — products purchased, status, delivery notes.
• Integration data — credentials needed to deliver an upgrade (payments, CRM, email). We store AI provider keys in encrypted form. Other connection tokens are kept in our access-controlled database, visible only to authorized staff and the connected feature, and deleted when you disconnect.
• Site analysis output — for a free plan we fetch the public HTML of your URL and run an automated audit. No passwords/logged-in content.
• Logs — IP, user-agent, request timing (debug + rate-limit).
• Anonymous page views — Vercel Web Analytics and Speed Insights (URL path and page-speed timings only; no cookies, no cross-site tracking, IPs not stored). Loaded only if you allow analytics in the cookie choice; off by default.

To deliver and support what you bought, send the receipts and updates you asked for, prevent abuse, and answer support. That's the whole list — no ad targeting on your data.

We share the minimum required data with the providers below. A fuller, draft register is at /legal/subprocessors.

• Stripe — payments & payment integration (Stripe Connect). Privacy Policy.
• Resend / Brevo — transactional email (receipts, login links, replies).
• Vercel — hosting, edge logs, privacy-friendly Web Analytics. Analytics privacy.
• Turso (libSQL) — database hosting for orders, sessions, outbox.
• Groq / OpenRouter / HuggingFace / Together / Cerebras / Cloudflare Workers AI — model inference. AI features send the text you submit, and for some features summaries of your business data, to these providers. We do not control whether a provider retains prompts or uses them to improve its models on free or standard tiers. Do not enter sensitive personal data, health information, government ID numbers or payment-card data into AI features.
• Firebase Auth (optional) — Google / Facebook / Apple sign-in if you choose it.
• Payment providers you connect (for example Helcim, Square, PayPal) — only if you or your business choose to take payments through them; they receive the transaction details needed to process the payment.
• Twilio — SMS delivery (for example supplier order messages and booking reminders), only when a business turns it on.
• Anthropic — AI drafting, insights and agents; the text you submit to those features is sent to Anthropic for processing.
• Sentry — browser error monitoring (technical error details and page URLs, no payment data). Loaded only if you allow analytics and error monitoring in the cookie choice; off by default.
• Google (Fonts, PageSpeed Insights, Places) — fonts are loaded from Google; the website scanner sends the URL you enter to Google PageSpeed Insights.

If you activate payment integration, we use Stripe Connect to create a connected Stripe Express account on your behalf, sharing with Stripe:

• Identity — name, email, business details for verification (KYC) and compliance.
• Transaction data — amounts, currency, and customer metadata, used to calculate and collect the platform fee.
• Account status — onboarding status, whether charges/payouts are enabled, and any restrictions.

Stripe acts as both processor (on our instructions) and independent controller (its own AML/sanctions obligations). See the Stripe Privacy Policy and Connected Account Agreement.

Acquirer disclosure: card transactions are acquired by Wells Fargo Bank, N.A. (or another acquirer Stripe designates). Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA. We don't access your Stripe dashboard credentials, bank details, or tax IDs — Stripe collects those directly.

We set only essential first-party cookies and browser storage: sign-in (pms_sid, 30 days), security (pms_csrf), checkout and point-of-sale sessions, your cart, and the record of your cookie choice. We do not use advertising or retargeting cookies. Analytics and error monitoring (Vercel Analytics, Speed Insights, Sentry) load only if you choose “Allow analytics”; “Essential only”, or no answer, keeps them off. If your browser sends a Global Privacy Control signal we treat it as a standing “no” and do not ask. Change your choice any time: Privacy choices. Fonts load from Google Fonts, so Google receives your IP address when a page loads. Paid integrations you enable on your own site (GA, Meta Pixel) add their own cookies; our site itself does not.

Orders: 7 years (tax). Marketing subscribers: until you unsubscribe. Server logs: 90 days. Sent email in our outbox: 7 days after delivery. Website scan results: the visitor IP address is removed after 30 days and the scan record after 90 days. Website-report requests (email and URL): 90 days. Plan reminders are sent only if you tick the opt-in box, and that address is kept for 30 days. Records of your agreement to our terms and of your marketing and text-message choices (document version, date and time, IP address, browser and the exact wording you accepted) are kept for the life of your account plus the period needed to establish, exercise or defend legal claims. Text-message and email opt-outs (STOP, unsubscribe) are kept so we never contact that number or address again. Signed e-signature records are kept for as long as the sending business needs them as proof of agreement. Privacy requests are logged with a 30-day response deadline. Idempotency keys: 24 hours.

Request a copy, deletion, or correction at plugmysiteaisolutions+privacy@gmail.com — we respond within 30 days. EU/UK/California residents have GDPR / UK GDPR / CCPA rights, including complaining to a supervisory authority.

We encrypt traffic with HTTPS and HSTS, verify payment and phone-provider webhooks by signature, hash passwords with scrypt, rate-limit sign-in and public endpoints, and limit staff access to production data. No system is perfectly secure; if we confirm a breach affecting your data we will notify you as required by law.

We update this page when practices change and bump the date above; major changes are emailed to active customers. Questions: plugmysiteaisolutions+privacy@gmail.com (postal address on request).