Privacy policy

1. Who we are

Sitewell provides website care, form and lead management, website health monitoring, search insights, content workflows, and connected business-profile tools. Sitewell is the controller of personal information used to operate our website, customer accounts, billing, and direct customer relationships.

When a customer uses Sitewell to process information submitted through the customer’s website or otherwise controls the purpose of that processing, the customer is the controller and Sitewell acts as its processor.

Questions or data-protection requests can be sent through our contact page.

2. Information we collect

• Account and contact details: names, email addresses, login credentials, organisation details, preferences, support messages, and membership information.
• Billing information: subscription status, transaction references, and limited payment metadata. Payment-card details are handled by our payment provider rather than stored by Sitewell.
• Website and service data: websites, domains, forms, submissions, leads, email-delivery records, reports, content, configuration, repository information, and actions taken in the service.
• Connected-service data: information you authorise us to obtain from services such as Google and GitHub, together with encrypted access and refresh tokens needed to maintain those connections.
• Google Search Console data: connected properties and search-performance information such as queries, pages, clicks, impressions, click-through rates, and average positions.
• Google Business Profile data: account and location identifiers, business details, categories, opening hours, website information, customer reviews and existing replies, posts, and approved profile changes.
• Technical and security data: IP address, browser and device information, timestamps, logs, cookie identifiers, and information needed to prevent abuse and maintain the service.
• Public business information: business contact details, websites, and publicly available evidence used to research potential customers and prepare outreach. Outreach engagement records may include whether a message or tracked link was opened or selected; we do not store the recipient’s IP address or user-agent string for that tracking.

3. How and why we use information

We use personal information to provide and secure Sitewell, authenticate users, process subscriptions, respond to enquiries, deliver requested audits and communications, monitor website health, manage forms and leads, provide connected features, generate reviewable recommendations and drafts, improve reliability, prevent fraud and spam, and comply with legal obligations.

Our lawful bases under UK data-protection law are performance of a contract, steps requested before entering a contract, legitimate interests in operating and improving our services and communicating with relevant businesses, consent where requested, and compliance with legal obligations. Where we rely on legitimate interests, we consider the effect on the people concerned and provide a way to object.

Some features use artificial intelligence to prepare drafts or recommendations. These outputs are intended for human review. We may send the minimum necessary content to our configured AI service provider to deliver the feature; we do not use Google user data to train general-purpose AI models.

4. Google API data

Sitewell only accesses Google data after an authorised user chooses to connect a Google account. We use that data to provide the Search Console and Google Business Profile features described above, including search reporting, profile health checks, review syncing, review-reply drafts, and posts or profile updates that an authorised user approves.

We do not sell Google user data, use it for advertising, or transfer it for creditworthiness, lending, or unrelated purposes. We share it only with service providers where necessary to operate or secure the requested feature, comply with law, or act with the user’s explicit direction.

Sitewell’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google within Sitewell or revoke Sitewell’s access from your Google Account. Disconnecting stops new collection through that connection and removes the stored connection credentials, subject to limited backup, security, and legal-retention requirements.

5. Sharing and international transfers

We may share information with vetted providers that support hosting, infrastructure, email delivery, payments, customer support, security, analytics, AI-assisted features, and integrations requested by you. We may also disclose information when required by law, to protect people or the service, in connection with a business reorganisation, or with your direction.

Some providers process information outside the United Kingdom. Where required, we use recognised safeguards such as adequacy regulations or approved contractual protections.

6. Retention and security

We keep information only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, resolve disputes, maintain security and audit records, and meet legal, tax, and accounting obligations. Retention depends on the type of record, account status, customer instructions, and applicable legal requirements.

We use administrative and technical measures designed to protect information. These include access controls, encrypted transport, encryption of stored OAuth credentials, restricted staff access, backups, and monitoring. No system can guarantee absolute security.

7. Cookies

Sitewell uses cookies and similar storage needed for login sessions, security, preferences, and core service operation. We may also use limited measurement technologies where permitted. You can control cookies through your browser, but blocking essential cookies may prevent account features from working.

8. Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict, or receive your personal information; object to processing; withdraw consent; and complain to the Information Commissioner’s Office. These rights can be limited by law and may depend on the lawful basis for processing.

Contact us through our contact page to exercise a right. If your information was submitted to one of our customers through their website, contact that customer first because they usually control that information.

9. Children and changes

Sitewell is a business service and is not directed to children. We do not knowingly collect children’s information through customer accounts.

We may update this policy as the service or legal requirements change. We will publish the revised policy here, update its effective date, and provide additional notice where a material change requires it.