Privacy

Last updated: 1 September 2026

ItsySite operates this website-building service and is responsible for the personal information described here. Operator and contact details are available on the Legal information page. Contact hello@itsysite.com with privacy questions, requests or complaints.

Cookies and local storage

These controls show what ItsySite stores in this browser. Local preferences are stored only after you choose them and are not used for tracking.

Login uses an essential cookie containing a random token. If you do not choose ‘Stay signed in’, your login ends when you close the browser or after 24 hours, whichever comes first. If you choose it, your login lasts up to 30 days. We store only a hash of the token, linked to your account with its expiry date.

Information we collect

• Account information: your chosen display name, current and previous email addresses, password hash, secure session identifiers, verification, short-lived security-attempt counters, Terms-acceptance and update-notice records, and transactional-email delivery status.
• Site information: content, images, events, settings and domains you provide. Published content is public.
• Billing information: plan, transaction and customer identifiers, amounts, tax, discounts, payment status and refunds. Lemon Squeezy processes card details; ItsySite does not receive them.
• Technical information when you use ItsySite or visit a website hosted by ItsySite: security and request data and, where that site's visitor analytics are enabled, country, page counts and a short-lived pseudonymous visitor key. We briefly use an IP address and browser information to create the key, but do not store the raw IP address or browser information in visitor analytics. Visitor analytics use no cookies or browser storage and can be disabled by the site owner or ItsySite.
• Communications: messages and attachments you send when seeking support, making a report or contacting us about privacy.

How and why we use it

• Contract: to create accounts, host and publish sites, manage subscriptions and provide support.
• Legitimate interests: to secure the service, prevent abuse, diagnose faults, provide website traffic statistics and understand broad usage and costs.
• Legal obligations: to keep records required for tax, accounting, fraud prevention or lawful requests.

We do not sell personal information or use it for third-party advertising.

Who receives information

Cloudflare provides hosting, storage, security and analytics. Lemon Squeezy is our merchant of record and handles checkout, payments and tax. We may also disclose information when legally required or necessary to protect users and the service.

Cloudflare Turnstile protects signup from automated abuse. It processes security signals including the IP address, browser and device characteristics, TLS information and the site origin to assess whether a signup is human. We do not use these signals for advertising. Read Cloudflare’s Turnstile Privacy Addendum.

Cloudflare and Lemon Squeezy may process information outside the UK. Where UK adequacy regulations do not apply, information is protected by approved contractual safeguards. Contact hello@itsysite.com for details or a copy.

How long we keep it

• Account and site information is kept while the relevant account or site exists, then the deletion periods below apply.
• Temporary login sessions expire after 24 hours. If you choose to stay signed in, the session expires after 30 days.
• When you delete your account, it closes and all sites go offline immediately. We delete its content, images, events and domains from live systems 28 days later.
• A deleted site goes offline immediately. Its content, images, events and domains are deleted from live systems after 30 days unless you restore it first.
• Cloudflare's D1 database recovery history may retain deleted account information for up to 30 further days. It is not used during normal service, is available only for disaster recovery and expires automatically. If recovery is required, completed account deletions are reapplied before normal service resumes.
• Old calendar events are permanently deleted six months after their end time, or six months after their start time when no end time is set.
• Communications are kept while needed to handle the matter and afterwards where reasonably necessary for security, legal claims or legal obligations.
• Sampled request and error logs are kept for up to seven days.
• Transactional-email delivery records are kept for up to one year for security, support and delivery troubleshooting. We do not store email bodies in these records.
• Failed sensitive-password counters are cleared after a correct password, on account closure, or by daily cleanup once the last failure is more than 24 hours old. Raw billing webhook and moderation records are kept for up to one year. A minimal account-deletion audit record is kept for 90 days after deletion completes. Specific records may be kept longer when required for an investigation, legal claim or law.
• Pseudonymous analytics events are kept for up to three months. Non-identifying daily totals are kept while the site exists and deleted when the site is deleted.
• Billing and transaction records are generally kept for seven years to meet tax, accounting, refund and dispute requirements, then deleted or anonymised.

Your rights

Depending on the law and reason for processing, you may ask to access, correct, delete, restrict or receive your information, or object to its use. Email hello@itsysite.com. We may need to verify your identity.

You may object to processing based on legitimate interests. We will stop unless we have a compelling lawful reason to continue.

You can make a privacy complaint by contacting us. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.

Security

We use access controls, hashed passwords, private storage and encrypted connections. No online service can guarantee absolute security.

Changes

We will update this policy when our practices change and show the new date above. We will give additional notice for significant changes.

Language

Translations are provided for convenience. If they conflict, the English (UK) version applies.