Privacy notice

What this notice covers

This notice describes the data flows used by the SiteRefit website, contact form, and private preview system.

Information submitted through the quote form

The form can collect an existing website URL, name, email address, the biggest problem with the current site, anything the replacement must retain, and an optional desired timeframe. If a callback is requested, the form also collects a phone number, general availability, and time zone. The information is used to assess and respond to the request.

Private preview data

Private preview records can include a business name, industry, general location, preview content, status, creation date, and expiry date. Access codes are stored as one-way hashes using a separate secret pepper; raw codes are not stored in preview records.

Successful access creates a signed, Secure, HttpOnly, SameSite cookie scoped to that preview path. The current session lifetime is 30 minutes. Failed access counters expire after approximately 10 minutes.

Service providers

• Cloudflare hosts the site and can process network, security, rate-limit, Turnstile, and Worker request data.
• Cloudflare Turnstile is used on launch forms to distinguish legitimate requests from automated abuse.
• Resend is the intended email-delivery processor for accepted contact requests.

SiteRefit does not currently include a general-purpose visitor analytics endpoint. If analytics are added later, this notice should be updated before collection begins.

Operational logs and security

The application writes redacted operational event types such as configuration failure, rate limiting, preview denial, malformed preview records, Turnstile failure, delivery failure, and accepted delivery. Application logs are designed not to include access codes, Turnstile tokens, secrets, full IP addresses, or submitted message bodies.

Retention and deletion requests

Short-lived preview sessions and access-attempt counters expire automatically as described above. Inquiry and delivery records are retained only as long as needed to respond, maintain necessary business records, and resolve security or delivery issues.

Use the quote form to request access, correction, or deletion.

Changes

This notice will be updated when processors, forms, analytics, retention practices, or the preview system materially change. The effective date above identifies the current version.