Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information — name, email, password hash, and role (user/admin) when you create an account.
• Intake information — business name, category, contact details, and any copy, images, logos, or credentials you submit so we can build your site.
• Billing information — we do not store full card numbers. Stripe, Inc. handles payment collection and stores a customer token (cus_…) we associate with your account.
• AI-generated previews — we send the business information you submit to OpenAI's GPT API to produce homepage drafts, offer copy, and brand guidance. Generated output is stored alongside your project.
• Usage & device data — IP address, browser user-agent, pages visited, and performance metrics. Collected via server logs and (when enabled) Vercel Analytics and PostHog.
• Communications — email you send us, chatbot transcripts, and support messages.

2. How we use information

• To deliver the website build and any active subscriptions you purchase.
• To generate AI previews and copy drafts you can review before launch.
• To charge you, refund you, prevent fraud, and satisfy tax and accounting requirements.
• To send transactional email (receipts, delivery notifications, the 48-hour deadline counter, launch announcements).
• To send product announcements and offers — only if you opt in.
• To diagnose errors, improve performance, and harden security.

3. Third parties we share with

We share the minimum data necessary with the following processors. Each is contractually bound to use it only on our behalf:

• Stripe — payment processing (cards, ACH, subscriptions). See stripe.com/privacy.
• Supabase — database, authentication, file storage. See supabase.com/privacy.
• Vercel — application hosting and edge delivery. See vercel.com/legal/privacy-policy.
• Resend — transactional email delivery.
• OpenAI — AI content generation (GPT API). OpenAI does not use API inputs or outputs to train models by default. See openai.com/policies/privacy-policy.
• Analytics — Vercel Analytics or PostHog for aggregate product metrics. No raw card data or passwords are ever sent to analytics.

We do not sell your personal information, and we do not share it with advertisers.

4. How long we keep it

• Account + project records: while your account is active, plus 7 years for tax/accounting.
• Billing records: 7 years per IRS record-keeping requirements.
• AI preview drafts: retained with your project unless you request deletion.
• Server logs: 30 days rolling.

5. Your rights

Regardless of where you live, you can email hello@expeditemysite.com to:

• Access a copy of the information we hold about you.
• Correct inaccurate information.
• Delete your account and associated data (subject to the retention note above).
• Opt out of marketing email at any time (every marketing email also has an unsubscribe link).
• Port your data to another provider in a machine-readable format.

California residents have additional rights under the CCPA/CPRA, including the right to know what categories of personal information we collect and to request deletion. We honor verified requests within 45 days.

EU/UK residents have rights under the GDPR. Our legal basis for processing is the contract we enter when you purchase, and legitimate interest for fraud prevention and service improvement.

6. Security

We use HTTPS everywhere, encrypt data at rest on managed hosts, enforce row-level security on our database, and restrict admin access to the owner of the business. We don't claim to be bulletproof — if a breach occurs, we will notify affected users within 72 hours of confirmation, as required by applicable law.

7. Children

The service is intended for business owners aged 18 and over. We do not knowingly collect information from children under 13.

8. International transfers

Our processors (Stripe, Supabase, Vercel, Resend, OpenAI) are primarily U.S.-based. If you access the service from outside the U.S., your information will be transferred to and processed in the United States under standard contractual clauses where applicable.

9. Cookies

We use strictly-necessary cookies for authentication and a small number of analytics cookies. We do not run third-party ad trackers. Your browser's Do Not Track signal is honored as an opt-out.

10. Changes to this policy

If we change this policy materially, we'll email active customers and update the effective date at the top. Routine clarifications (typos, reorganization) are applied silently.

11. Contact

ExpediteMySite
Cypress, TX, 77429
Email: hello@expeditemysite.com