Privacy Policy

Ultima actualizare: 7 October 2026

This page explains which personal data Sitesmith processes, why, how long we keep it, and what your rights are. We are responsible (the controller) for the data of our users and of visitors of our own pages. For the data that visitors send through our customers' websites, the customer is responsible (see section 9).

1. What we collect

• Account: your name, email address and a securely hashed password (we never store your password itself).
• Projects: the business details, texts and photos you add while designing your site, earlier versions of your design, your change requests and the messages you exchange with us in your project panel.
• Contact form: if you send us a question through the form on our homepage, your name, email address, your message and, if you fill them in, your phone number, business name and the kind of website you are interested in.
• Reports of illegal content: the address of the content, your explanation and, if you give them, your name and email address.
• Security data: when you log in, your session stores your IP address and browser type. Account actions (such as logging in) are recorded in our security log with the IP address.

We do not collect payment, card or bank details.

2. Why, and on which legal basis

• Your account, projects, messages and the emails about them: to provide the service you asked for (contract, GDPR art. 6(1)(b)).
• Security logs, rate limits and the security data of sessions: our legitimate interest in keeping the service and its users safe (art. 6(1)(f)).
• Visitor statistics: our legitimate interest in knowing how our pages and our customers' websites are used, without identifying anyone (art. 6(1)(f)).
• Questions sent through the contact form: our legitimate interest in answering people who contact us (art. 6(1)(f)).
• Reports of illegal content: our legal obligations as a hosting provider under the Digital Services Act (art. 6(1)(c)).
• Showing your live website as an example on our homepage: only with your consent (art. 6(1)(a)), which you can withdraw at any time in your project.

3. Visitor statistics

Published sites and our own public pages count visits without cookies and without storing IP addresses. Each visitor is counted with a code that changes every day and can't be traced back: it is calculated from the IP address and browser type together with a random value that we replace every day. The old value is deleted, so codes from earlier days can't be recalculated. We also store the day, the page, the website a visitor came from and whether it was a phone or a computer. After 400 days the daily codes are removed as well; only the counts remain.

4. Cookies

We use only necessary cookies: one to keep you logged in (it contains only a random session code) and one to remember your language. No tracking or advertising cookies. For security, a session stores your IP address and browser type on our server; they are deleted when the session ends (when you log out) or expires (after at most 7 days). Your browser also remembers, on your device only, that you have seen the cookie notice and, while you design a site before creating an account, your answers to the first questions.

5. Embedded maps and videos

If a published site shows a map or a video, it only loads after the visitor clicks on it. From that moment it comes from Google Maps, YouTube (privacy-enhanced mode) or Vimeo, which then receive the visitor's IP address under their own privacy policies. Fonts are hosted by us, so no font requests go to third parties.

6. Who receives your data

• Hetzner Online GmbH, Germany: hosts our servers.
• Our email provider in the EU: delivers our emails (it processes the recipient's address and the message for that purpose only).

These processors work only on our instructions and under a processing agreement. Your data stays in the European Union. We do not sell your data and only give it to authorities when the law requires it.

7. Who can see it

Your account and project data is visible to you and to Sitesmith administrators who need it to provide the service. Content you choose to publish on a live site (business details, photos, testimonials, and so on) is public, since that is the purpose of a website. If you allow it in your project, we also show your live website as an example on our homepage (its name, type and a small preview with a link); you can withdraw this at any time.

8. How long we keep it

• Account and project data: as long as your account exists. If you delete a draft project, its content and photos are deleted with it. When you delete your account, your account, projects, photos and messages are deleted.
• Sessions: deleted when you log out or when they expire (after at most 7 days).
• Security and audit logs: 12 months.
• Copies of the emails we send: 90 days.
• Contact-form questions and reports of illegal content: deleted 12 months after we have handled them, and at the latest 24 months after we received them; messages marked as spam after 30 days. Ask us at hello@example.com to delete yours sooner.
• Daily visitor codes in the statistics: 400 days.
• Backups: kept for up to 7 days, so deleted data also disappears from the backups within 7 days.

9. Websites of our customers

For the websites we host for our customers, the customer is responsible for the personal data their visitors send (the controller) and we process it on their behalf, under the processing agreement in our terms. Every customer website has its own privacy page that explains this to its visitors. Messages and booking requests sent through customer websites are deleted 24 months after they were received, or earlier when the customer deletes them in their inbox.

10. Your rights

You have the right to access your data, to have it corrected (rectification) or deleted (erasure), to restrict its use, to receive it in a common format (portability), and to object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time; this doesn't affect what we did before. You can see, correct, download and delete most of your data yourself under My account, or contact us at hello@example.com; we answer within one month. You also have the right to file a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be).

11. Security

Connections are encrypted (HTTPS). Passwords are stored as salted bcrypt hashes. Administrator accounts require two-factor authentication and sensitive fields such as authentication secrets are encrypted at rest. All administrator actions are recorded in an audit log.

12. Changes to this policy

We may update this policy; the date at the top shows when it last changed. We tell you about material changes by email.

13. Contact

Questions about this policy or your data can be sent to hello@example.com. Sitesmith is meant for businesses and organisations and is not intended for anyone under 18.