Privacy Policy

Sitepromptr, the service at sitepromptr.com, decides how the personal data described here is used. For anything to do with your data, write to lumovoice@gmail.com.

Only what the service needs to work.

• Your account. Email address, and your name if you sign in with Google and Google gives it to us. A password is never stored by us; sign-in is handled by Supabase.
• What you type into the builder. The business descriptions, answers and change requests you write, and any web address you paste. These are kept against the site so the conversation is still there tomorrow.
• What you upload. Images you drop into the builder.
• The sites you make. Their content, their published versions, and their addresses.
• Billing details. Your plan, your credit balance and the record of what credits were spent on. Card numbers go straight to Stripe and never reach our servers.
• Basic technical data. Server logs, and the IP address a request came from, which is used to limit how often the expensive parts of the service can be called.
• Which of our own pages were viewed. Our home page, pricing page and the two sign-in pages count visits, so we know how many people arrive and how many reach the form. This is done by Cloudflare Web Analytics, which sets no cookie, cannot recognise you on a later visit, and cannot follow you to any other website. No page of a site you build for a client counts anything.

We do not use advertising trackers, analytics that follow you across other sites, or third-party marketing pixels.

This is the part worth reading carefully. When you describe a business, answer a question or ask for a change, that text is sent to Anthropic, which runs the model that writes the site. If you paste a link to a business’s existing website, we read that public page and send its text too.

Do not put anything into the builder you would not want processed by a third party. It is a description of a business, and that is all it needs to be.

Sitepromptr is a small product built on a few services. Each one gets only what it needs.

• Supabase. The database, sign-in, and image storage. Holds your account, your sites and your uploads.
• Anthropic. The AI model that writes and edits sites. Receives your prompts and the site being edited.
• Stripe. Payments. Receives your email address and card details, which you give it directly.
• Railway. Hosting. The servers the app and the site builder run on.
• Google. Only if you choose to sign in with Google, in which case Google confirms who you are and gives us your email address and name.
• Cloudflare. Counts visits to our home page, pricing page and sign-in pages. It receives the address of the page and your browser type. It sets no cookie and keeps nothing that identifies you.

We do not sell your data, and we do not share it with anybody else except where the law requires it.

A published site is a website. Anything on it, including images you upload, is visible to anyone who visits it. Uploaded images are stored at public addresses so that a visitor with no account can see them.

A site you have not published is private to your account.

One kind only: the cookie that keeps you signed in. There are no advertising or tracking cookies, and there is no consent banner because there is nothing to consent to.

Sites you publish contain no cookies or tracking of their own unless you add them.

Under UK and EU data protection law we rely on two grounds. Most of it is performance of a contract: we cannot run your account or build your sites without it. A small part, server logs and rate limiting, is our legitimate interest in keeping the service working and not being abused.

Your account, sites and conversations stay while your account exists. Delete your account and we remove them within 30 days, except billing records, which we keep for as long as tax law requires.

Server logs are kept for a short period and then discarded.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to send it somewhere else, or object to us holding it. Email lumovoice@gmail.com and we will answer within 30 days.

To delete your account, email us from the address you signed up with and say so. We will confirm before anything is removed, because it cannot be undone. Download any sites you want to keep first.

If you think we have handled your data badly, you can complain to your national data protection authority. In the UK that is the Information Commissioner’s Office.

Our providers run in data centres in the UK, the EU and the United States. Where data leaves the UK or the EU it is covered by the standard contractual clauses those providers use.

Access to your data is enforced in the database itself, so one account’s sites cannot be read by another even if the application has a bug. Connections are encrypted. Passwords are handled by Supabase and never seen by us.

No system is perfect. If a breach affects you, we will tell you and the relevant authority as quickly as we can.

There is no minimum age for using Sitepromptr, and we collect the same small amount of data whoever you are: an email address, what you type into the builder, and the sites you make.

If you are under 16, please check with a parent or guardian before signing up. Paying for a plan needs an adult in any case, because a subscription is a contract.

A parent or guardian can email lumovoice@gmail.com at any time to see what we hold about a young person’s account or to have it deleted, and we will do it.

If this policy changes, the date at the top changes with it. If a change materially affects you, we will email you.