SiteAndSell Privacy Policy

Last updated: July 19, 2026

This policy explains what personal information Magic Mountain Software LLC, a Nevada limited liability company ("SiteAndSell", "we", "us") collects, how we use it, and the choices you have. It's written to be read, not skimmed past.

It covers two different situations, and it matters which one you're in:

1. You're a SiteAndSell customer (or visiting siteandsell.com): we decide how your data is handled, and this policy describes that directly.
2. You're a visitor to a website that a SiteAndSell customer built and hosts with us (for example, you filled in a contact form on a business's site): the business that owns that website controls your data. We process it only on that business's behalf, as their service provider/processor. For questions or requests about your data on such a site, contact the business — their site is the right place to look for their own privacy policy. Section 8 describes what we do with visitor data in this role.

1. Information we collect from customers

Account information. Your email address, optional name, and — if you use password sign-in — a hashed password (we never store the plain password). Sign-in events and session data. If you sign in with a magic link, we send that link to your email.

Billing information. Payments are handled by Stripe. We do not receive or store your full card number. We keep what we need to run your account: your Stripe customer ID, plan, subscription status, purchase history, and a ledger of credit grants and spends.

Your sites and prompts. The content of the websites you create — text, images, business details (which may include your business address, phone, and email if you put them on your site), the prompts and instructions you type, version history of your site, and connected domain names.

AI usage records. For each AI action we log which model was used, token counts, computed cost, and credits charged. This is how metered billing works.

Support and correspondence. Emails you send us and our replies.

Technical data. Like nearly every online service, our infrastructure (Cloudflare) processes IP addresses, request logs, and browser information to serve traffic, prevent abuse, and debug problems. Sign-up and login are protected by Cloudflare Turnstile, which analyzes browser signals to tell humans from bots.

We collect all of this directly from you or from your use of the Service. We do not buy data about you from data brokers.

2. How we use it

• Provide the Service: authenticate you, generate and host your sites, store versions, serve your visitors, deliver contact-form messages to you.
• Bill you: meter AI usage, charge subscriptions and top-ups via Stripe, prevent payment fraud.
• Communicate: transactional email (sign-in links, receipts, domain status, form notifications), service announcements, and a monthly "concierge" email with suggested improvements for your published sites. Reply to any concierge email to stop receiving them; transactional mail is unaffected.
• Protect the Service: detect abuse, spam, phishing sites, and bot activity; enforce our Terms and Acceptable Use Policy.
• Improve the Service: understand aggregate usage (for example, generation failure rates and costs). We do not use your content or prompts to train AI models, and we have configured our AI provider relationship so that they don't either (see Section 4).

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We have no advertising trackers.

Legal bases (for readers in the EU/UK, if applicable): performance of our contract with you (most of the above), legitimate interests (security, abuse prevention, service improvement), consent (where required, e.g. marketing email), and legal obligations (tax and accounting records).

3. Cookies

We use only functional cookies:

• Session cookies to keep you signed in to the dashboard.
• Security cookies set by Cloudflare (including Turnstile) for bot protection.

No advertising cookies. On our marketing site (siteandsell.com) we use Google Analytics and Microsoft Clarity to understand how visitors use our pages; visitors from the EU/EEA, UK, and Switzerland see a consent banner and those analytics load only after they accept. The dashboard (app.siteandsell.com) sets only the functional cookies above. Our page-view analytics for site owners are cookieless and aggregate (page path, referrer domain, and country — nothing identifying a visitor). On customer sites whose owners add their own analytics (Google Analytics or Microsoft Clarity), visitors from the EU/EEA, UK, and Switzerland likewise see a consent banner and those analytics load only after they accept; a site owner's own analytics are disclosed in their site's privacy policy, not ours.

Websites our customers publish currently set no cookies for visitors. If that changes (for example, member areas), this policy and customer guidance will be updated first.

4. Who we share data with (subprocessors)

We share personal data only with the service providers below, only as needed to run SiteAndSell, under contracts limiting their use of the data:

| Provider | What they do for us | Data involved | |---|---|---| | Cloudflare | All hosting and infrastructure: application servers, databases, file storage, DNS/TLS for custom domains, bot protection, request logs | Effectively all Service data, including site content, form submissions, and IP addresses | | Stripe | Payment processing, subscriptions, tax calculation | Name, email, payment details (held by Stripe), purchase history | | Resend | Sending transactional email | Recipient email addresses and email contents (e.g. magic links, contact-form notifications) | | Anthropic | AI model that generates and edits websites | The prompts you write and your site's content, sent via API when you use AI features. Under our API terms, Anthropic does not use this data to train its models. |

We'll update this list when it changes. [PLACEHOLDER: consider a /subprocessors page and a mailing-list notification for changes if business customers ask for it.]

We may also disclose information if required by law or legal process, to protect the rights, safety, or property of SiteAndSell, our customers, or the public, or as part of a merger or acquisition (in which case this policy continues to apply to your data until you're told otherwise).

5. Data retention

• Account and site data: kept while your account is active. After you delete your account (or your subscription ends and the grace period lapses), we retain your data for 90 days — so you can reactivate or export — then delete it from production systems.
• Contact-form submissions: automatically deleted 12 months after they arrive (sooner if you delete them or your account).
• Billing records: kept as long as tax and accounting laws require (typically 7 years).
• Logs: infrastructure logs are short-lived (typically ≤ 30 days). AI usage/cost records are kept with billing records.
• Backups: deleted data may persist in encrypted backups until those backups age out on our normal cycle (35 days).

6. Your rights

Depending on where you live (for example, California's CCPA/CPRA, other US state privacy laws, or the GDPR if it applies), you may have rights to:

• Know / access the personal information we hold about you and get a copy;
• Correct inaccurate information;
• Delete your information;
• Portability — receive your data in a usable format (site export is built into the product);
• Opt out of "sales" and targeted advertising — we don't sell personal information or share it for targeted advertising, so there's nothing to opt out of;
• Non-discrimination for exercising these rights.

To exercise any of these, email privacy@siteandsell.com from your account email, or use the in-app tools (export and account deletion). We'll verify the request via your account email and respond within the time the applicable law requires (45 days under CCPA, extendable once). You may use an authorized agent where the law allows; we'll verify the agent's authority. If we refuse a request, you may appeal by replying to our decision, and (depending on your state) contact your state attorney general.

We are not currently over the CCPA's applicability thresholds, but we follow these practices as our standard for all customers regardless. EU/UK residents (if applicable) also have the right to object to or restrict certain processing and to lodge a complaint with their supervisory authority.

7. Security

Data is encrypted in transit (TLS everywhere, including automatically provisioned certificates for customer domains) and at rest on Cloudflare's infrastructure. Passwords are stored hashed. Access to production systems is limited to Magic Mountain Software LLC's principal and protected by strong authentication. Payments are handled by Stripe, a PCI-DSS Level 1 provider; card numbers never touch our systems. No system is perfectly secure — if we learn of a breach affecting your personal information, we'll notify you and regulators as the law requires.

8. Visitor data on customer websites (our processor role)

When you interact with a website hosted by SiteAndSell (addresses ending in .siteandsell.com, or a business's own domain):

• Contact forms: what you submit is stored in our database and emailed to the website's owner. We use it for nothing else — no marketing, no profiling, no sale. The website owner decides how it's used from there; their privacy policy (not this one) governs.
• Technical data: serving any website involves processing IP addresses and request metadata; ours are processed by Cloudflare to deliver the site, cache pages, and block abuse.
• Cookies: customer sites as rendered by us set no cookies today.
• Requests: if you ask us to delete or disclose your data from a customer's site, we'll pass your request to the site owner and assist them; the decision is theirs as controller. If the site itself violates our Acceptable Use Policy, report it to abuse@siteandsell.com.

For business customers who need it: these Terms and this policy function as our data-processing commitment. If your business needs a formal data-processing agreement, email legal@siteandsell.com.

9. International transfers

We are a US company and data is processed in the United States (Cloudflare's network is global, but primary storage and our operations are US-based). If you use the Service from the EU, UK, or elsewhere, you're sending your data to the US. Our subprocessors (Cloudflare, Stripe, and others listed above) each maintain recognized transfer mechanisms for EU/UK data (EU-US Data Privacy Framework certification and/or Standard Contractual Clauses in their data-processing terms), and we rely on those mechanisms plus the necessity of the transfer to provide the service you signed up for.

10. Children

The Service is for adults running businesses. We don't knowingly collect personal information from children under 13 (or the higher age your local law sets). If you believe a child has given us personal information, contact us and we'll delete it.

11. Changes to this policy

We'll post changes here and update the date at the top. For material changes, we'll email account holders before the change takes effect. Prior versions are available on request.

12. Contact

Magic Mountain Software LLC 304 S Jones Blvd #3330 Las Vegas, NV 89107, USA privacy@siteandsell.com