Privacy Policy

1. Introduction

Sitenyx ApS ("Sitenyx", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website builder platform and related services. This policy applies to all users of sitenyx.com and websites created through our platform.

2. Data Controller

Sitenyx ApS, registered in Denmark, is the data controller responsible for your personal data. We process your data in accordance with the EU General Data Protection Regulation (GDPR) and Danish data protection legislation. For any data protection inquiries, you can reach our data protection contact at [email protected].

3. Information We Collect

We collect several categories of personal data to provide and improve our services:

• Account Information: Name, email address, password (hashed), billing address, and payment details when you create an account or subscribe to our services.
• Usage Data: Information about how you interact with our platform, including pages visited, features used, website editor actions, and session duration.
• Device Information: Browser type and version, operating system, screen resolution, IP address, and device identifiers used for security and analytics purposes.
• Cookie Data: Data collected through cookies and similar tracking technologies as described in our Cookie Policy.

4. Legal Basis for Processing

Under the GDPR, we process your personal data based on the following legal grounds:

• Consent: For marketing communications and non-essential cookies (GDPR Art. 6(1)(a)). Marketing consent is granted per channel — email, SMS, and automated phone calls from Sitenyx's AI assistant — each as a separate, optional opt-in that is never pre-selected. You may withdraw consent at any time, as easily as you gave it: from your account settings, and for email also via the one-click unsubscribe link included in every marketing message.
• Existing Customer Marketing: If you are a paying customer, we may send you email about Sitenyx services similar to those you have already purchased, without separate consent, as permitted by the Danish Marketing Practices Act (markedsføringsloven § 10, stk. 2). Every such message includes a free and easy way to opt out, and we stop as soon as you use it.
• Contractual Necessity: To fulfill our obligations under your service agreement, including account management, service delivery, and billing.
• Legitimate Interests: For fraud prevention, platform security, service improvement, and analytics, where our interests do not override your fundamental rights.
• Legal Obligation: To comply with applicable laws, regulations, and legal processes, including tax and accounting requirements.

5. How We Use Your Information

We use the collected data to provide and maintain our website builder service, process transactions and send related information, respond to your requests and provide customer support, send you technical notices and security alerts — transactional service messages, not marketing — monitor and analyze usage patterns to improve our platform, detect and prevent fraud and abuse, comply with legal obligations, and personalize your experience based on your preferences. Marketing messages are sent only on the bases described in section 4: your per-channel consent or, for existing customers, email about similar services under markedsføringsloven § 10, stk. 2.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with the following categories of recipient: payment processors (Stripe, EU) for transaction processing, cloud infrastructure and security providers (Cloudflare) for hosting, content delivery and bot protection, email providers (Resend, EU) for transactional email, SMS providers (Twilio, US) for notifications, AI service providers in the United States for processing prompt content in the platform's AI features, and law enforcement or regulatory authorities when required by law. We use no third-party analytics services. All third-party processors are bound by data processing agreements that ensure GDPR compliance.

7. International Data Transfers

Your application database, file storage and backups are kept within the EU/EEA. Two transfers to the United States happen systematically: prompt content from the platform's AI features is processed by our AI service provider in the US, and SMS notifications are processed by Twilio in the US. Both transfers run under the EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework. For providers that serve from the EU (Stripe, Cloudflare, Resend), control-plane metadata may transit the US under the same clauses. You can obtain a copy of the safeguards in use by writing to [email protected].

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy. Account data is retained for the duration of your account and up to 30 days after deletion. Billing records and other accounting material are retained for 5 years from the end of the financial year they relate to, under section 12 of the Danish Bookkeeping Act. Usage statistics and technical event logs are retained for a maximum of 90 days and are then deleted automatically. Support correspondence is retained only for as long as necessary to handle and document your enquiry, and is deleted thereafter.

9. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data under certain conditions.
• Right to Restriction: Request restriction of processing in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.

10. Account & Data Deletion

You can request deletion of your account and your personal data at any time. Accounting and billing material is exempt, see section 8, and if you are the only administrator of a workspace you must first give someone else administrator access. Use any of the following methods:

• Account Settings: Log in to your account, navigate to Account Settings and select "Delete Account". We verify your identity, and your account and profile information are permanently removed within 30 days. Accounting and billing material — including the name and address on invoices already issued — is however retained for 5 years from the end of the financial year it relates to, under section 12 of the Danish Bookkeeping Act and GDPR Art. 17(3)(b), as described in section 8.
• Email Request: Send a deletion request to [email protected] from the email address associated with your account. We will process your request within 30 days as required by GDPR.
• Social Login Users: If you signed up using a social login provider (Google, Facebook, LinkedIn, or Apple), deleting your Sitenyx account will remove all data we received from that provider, including your name and email address. You may also revoke Sitenyx's access from your social provider's settings independently.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS 1.2/1.3), encryption at rest for files and media at our storage provider and for particularly sensitive database fields, regular security assessments, access controls and authentication requirements, and incident response procedures. While we strive to protect your data, no method of transmission over the internet is 100% secure.

12. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately, and we will take steps to delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at [email protected]. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at [email protected] or your local supervisory authority.