Privacy & Cookie Policy
This policy explains how SiteReady handles personal data when you visit siteready.now, contact us, receive a message from us about a website we built for your business, or use our services.
- Who we are and how to contact us
- Data we collect
- Purposes, legal bases and retention
- Messages to businesses and demo websites
- Websites we build and host for clients
- Service providers we use
- International transfers
- Your rights
- Notice for US residents
- Cookies and browser storage
- Automated processing
- Security and changes to this policy
1. Who we are and how to contact us
The controller of your personal data is:
ul. Poniatowskiego 3, 41-300 Dąbrowa Górnicza, Poland
Company registration no.: 365489047 (REGON) · Tax ID: PL 6292263889 (NIP)
Privacy contact: hello@siteready.now
"SiteReady", "we" and "us" refer to the company above. For anything about your data, email us. We reply within 30 days, usually much faster.
2. Data we collect
- Contact form data: business name, your name, email, phone number and anything you write to us.
- Client data: details needed to build, host and bill your website: company details, contact people, content you send us (logo, photos, texts), domain details, billing and payment records.
- Public business data: for businesses we contact first, information that the business itself made public: business name, address, phone, website, Google Business Profile details, public reviews and photos. See section 4.
- Third-party content on demo websites: public Google reviews (the reviewer's first name and last initial, and the review text) and public photos the business posted, which may show its staff or work sites.
- Outreach records: the business contact details we used, the messages we sent, whether they were delivered, opened or clicked (see section 4), replies, and opt-out requests.
- Demo page usage: when someone opens a demo website we built for a business, we record that the page was opened, when, and how many times.
- Text messages: if you give us your phone number, the messages we exchange with you by SMS.
- Client account and service data: for hosted plans, access you grant us (for example to your domain settings or your Google Business Profile), change requests, and service reports such as the number of calls and quote requests your website generated.
- Technical data: IP address, browser type, request and error logs, and data used to prevent abuse and spam.
- Internal panel data: sign-in and activity records of SiteReady staff using our internal tools.
Sources: directly from you; from public sources (Google Maps and Google Business Profiles, business websites, public business directories and registries); from our service providers (for example delivery and open data from our email tools); and from your website visitors on hosted plans.
Providing data is voluntary, but we cannot reply or deliver a website without the required fields. Please do not send us sensitive data (health, financial account numbers, government IDs).
3. Purposes, legal bases and retention
| Purpose | Legal basis (GDPR) | How long we keep it |
|---|---|---|
| Replying to your inquiry and preparing your free website | Steps at your request before a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | Up to 12 months after our last contact, unless you become a client |
| Building, hosting and maintaining your website; support | Performance of a contract (Art. 6(1)(b)) | For the duration of the contract, then up to the limitation period for claims |
| Contacting businesses about a website we built for them | Legitimate interest in offering our services to businesses (Art. 6(1)(f)) | Up to 12 months without a response; deleted sooner on request |
| Sending you the link to your website by text message, when you asked us to | Steps at your request (Art. 6(1)(b)); your consent where required (Art. 6(1)(a)) | Up to 12 months after our last contact |
| Honoring opt-out requests (suppression list) | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) | As long as needed to keep honoring the request |
| Showing public reviews and photos on a demo website | Legitimate interest (Art. 6(1)(f)) | Until the demo is deleted (max. 12 months) or you object |
| Demo page visit statistics | Legitimate interest (Art. 6(1)(f)) | Together with the related business record |
| Monthly reports and Google Business Profile management on hosted plans | Performance of a contract (Art. 6(1)(b)) | For the duration of the contract |
| Internal tools access and audit | Legitimate interest (Art. 6(1)(f)) | Up to 12 months |
| Accounting, invoicing and tax obligations | Legal obligation (Art. 6(1)(c)) | As required by tax law (typically 5–7 years) |
| Security, fraud and spam prevention | Legitimate interest (Art. 6(1)(f)) | Logs up to 90 days |
| Establishing or defending legal claims | Legitimate interest (Art. 6(1)(f)) | Until the claim is resolved or time-barred |
| Optional analytics on our website | Your consent (Art. 6(1)(a)) | See section 10 |
4. Messages to businesses and demo websites
We build free demo websites for local businesses and send the business a short message with a link. To do this we use only information the business has made public, for example its Google Business Profile, its current website and public listings.
- We contact businesses at business contact details (for example the email or phone listed on their website or profile), not private individuals.
- We send messages from SiteReady-branded domains using email delivery tools. These tools may record whether a message was delivered, opened (using a small tracking image) and whether a link was clicked, so we don't send follow-ups to people who already responded and can stop when you aren't interested. We also use these tools to keep our sending domains healthy ("warm-up"), which exchanges automated messages only between participating mailboxes.
- We send at most a short sequence of messages (typically up to 4). We do not send unsolicited text messages or make automated calls to businesses.
- Each demo page has its own address. When it is opened, we record the visit (date, time, count) to know whether the business saw it. We do not use cookies for this.
- Demo pages are not indexed by search engines and are not linked publicly.
- Every message tells you who we are and how to stop further messages. Reply "stop" or email hello@siteready.now and we will not contact you again. We keep a minimal suppression record (business name and contact) only to honor that request.
- If you don't respond, we delete the demo page and the business record within 12 months.
- Reviewers and people in photos: demo pages may quote public Google reviews (first name and last initial only) and show public photos the business posted. If you appear in a demo and want to be removed, email us and we will remove it promptly, no questions asked.
- Some demo images are generated or edited with AI to illustrate a trade. They are illustrations, not photos of the business's real work, and are replaced with the client's real photos if they buy the website.
5. Websites we build and host for clients
On our hosted plans, your website's quote form sends requests from your customers to you. For that data you are the controller and we act as your processor, handling it only on your instructions and to run the service. Requests about a specific quote should go to the business that received it.
- Google Business Profile (Growth plan): if you give us access, we use it only to update and optimize your profile as agreed. You can remove our access at any time in your Google account.
- Reports: monthly reports show counts of calls, quote requests and search rankings. We do not use call tracking numbers and we do not record calls..
- Own It plan: when we hand over your website files, you become responsible for hosting them and for any data collected through them. We delete our working copies within 90 days after handoff, except records we must keep for accounting.
- When a hosted plan ends, we delete or hand over your website and its form data within 30 days, at your choice.
- A data processing agreement is available on request at hello@siteready.now.
6. Service providers we use
- Cloudflare, Inc.: hosting of our website, demo pages and client websites, content delivery, database, email notifications and security (including request logs with IP addresses).
- OpenAI: generating images and draft texts for demo websites from public business information. We do not send your contact form data to AI services.
- Email delivery and outreach tools (sending, deliverability and domain warm-up): Google Workspace (Gmail), MailReach (mailbox warm-up) and MillionVerifier (address verification).
- Business email and SMS providers used to talk with you: Google Workspace.
- Domain registrar for our and, on request, our clients' domains: [e.g. Porkbun / Cloudflare Registrar].
- Public data sources we look up business information in: Google Maps / Google Business Profiles and business websites.
- Payment providers:[e.g. Stripe], when you pay for a website.
- Analytics (only with your consent): Google Analytics 4.
- Google Fonts: loading fonts on our pages.
- Accounting, legal and IT advisers, and public authorities when the law requires it.
We do not sell your personal data.
7. International transfers
Some of our providers process data in the United States or other countries outside the European Economic Area. Where required, transfers rely on adequacy decisions (including the EU–US Data Privacy Framework) or standard contractual clauses. Ask us for details at hello@siteready.now.
8. Your rights
You can ask us to access, correct, delete, restrict or transfer your data, and you can object to processing based on legitimate interest, including at any time and without giving a reason to processing for direct marketing. Where we rely on consent, you can withdraw it at any time without affecting earlier processing. You also have the right to lodge a complaint with a data protection authority, in particular the President of the Personal Data Protection Office (UODO), Poland.
9. Notice for US residents
Depending on your state (for example California, Colorado, Virginia, Connecticut, Texas), you may have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of its sale or use for targeted advertising. We do not sell personal information and do not share it for cross-context behavioral advertising. To make a request, email hello@siteready.now. We will verify your request and will not discriminate against you for using your rights. Our commercial emails follow the CAN-SPAM Act and include a working way to opt out, and we honor opt-outs within 10 business days.
- Categories collected in the last 12 months: identifiers (name, email, phone, IP address), commercial information (services purchased), internet activity (demo page visits, email opens and clicks), and professional information (business name and role). We do not collect sensitive personal information.
- Global Privacy Control: we treat a GPC signal from your browser as a request to opt out, and our optional analytics stay off.
- You may use an authorized agent to make a request on your behalf. If we deny a request, you can appeal by replying to our decision.
11. Automated processing
We use automated tools, including AI, to research public business information and draft demo websites. A person reviews what we send. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing, and we do not profile you for advertising.
12. Security and changes to this policy
We use technical and organizational measures to protect data, including encrypted connections, access controls, password-protected internal tools and limited staff access. If a personal data breach happens that is likely to put your rights at risk, we will notify the competent authority and, where required, you, without undue delay.
Our services are meant for businesses and are not directed to children under 16. We do not knowingly collect data from children. If you believe a child sent us data, contact us and we will delete it.
If our business is transferred to another company, that company becomes the controller under this policy and we will tell you. If we update this policy, we will post the new version here with a new version number and date.