Privacy Policy
Sitebefy is operated by Flexa, registered at Vietnam ("we", "us"). For anything in this policy, contact us through the contact page or at chidang@flexa.vn.
This policy covers the Sitebefy platform: the website, the dashboard, and the hosting of websites you build with it. Websites our customers build have their own visitors; how we handle those visitors' data on a customer's behalf is described in our Data Processing Agreement, and the customer's own privacy policy governs their site.
What we collect, and why#
Your account. Name, username, email address, an optional phone number, a password (stored only as a hash), and your language preference. We need these to operate your account. Legal basis: performance of our contract with you.
Your websites. The sites you create, their content, their settings, and the files you upload, including archives you import. This is the service. Legal basis: contract.
Sign-in and security records. When you sign in we record the time, IP address, browser and device, and we keep a history of security-relevant account activity. We use this to secure your account: to show you your own active sessions and devices, to detect sign-ins that do not look like you, and to let you report one that was not. Legal basis: our legitimate interest in keeping accounts secure, and yours in the same thing.
Billing records. Your subscription, payments, wallet transactions and invoices. Payments are processed by our payment providers; we do not store card numbers. Legal basis: contract, and legal obligations that apply to invoices.
AI activity records. When you use AI features we record that a request happened, when, for which site, and its outcome, because your plan includes a number of AI requests and we have to count them, and because you can see this history yourself. The content you submit to AI features is sent to the AI providers listed under "Who else touches your data". Legal basis: contract.
Support conversations. Messages you send through the contact form, and the notes needed to answer them. Legal basis: contract and legitimate interest in answering you.
Product analytics, only with your consent. If you consent, we set first-party cookies to recognize your browser across visits and to remember which page brought you here. Without consent we still count page views, but anonymously: no cookie is set and the identifier changes every day, so visits cannot be linked across days. Details in the Cookie Policy. Legal basis: consent, which you can withdraw at any time in Settings, Privacy, or through the cookie icon in the corner of the page.
We do not buy data about you, and we do not sell or rent your data to anyone.
How long we keep it#
| Data | Kept for |
|---|---|
| Account and websites | As long as your account exists |
| IP addresses in security records | 90 days after last seen, then anonymized (the part that identifies the individual machine is zeroed) |
| Data-export archives you request | Deleted 7 days after the download link is issued |
| In-app notifications | 90 days |
| Platform backups | Up to 14 days |
| Web server logs | 14 days |
When your account is deleted, your data is removed from routine backups as those backups expire, within the 14 days above.
Your rights#
You can access, correct, export and delete your data, object to processing based on legitimate interest, and withdraw consent. Concretely, on this platform:
- See and correct: your account data is editable in Settings.
- Export (data portability): Settings, Privacy, "Download my data" produces a machine-readable archive of your account, sites metadata, activity, sign-in history and billing events. You can request one export per day.
- Delete: send us a deletion request from the contact page. We take your websites offline and schedule the deletion; you then have 14 days to change your mind, after which everything is permanently removed and the records we must keep (invoices) are detached from your identity.
- Withdraw consent: Settings, Privacy for analytics and marketing; the cookie choice on the site for visitor analytics.
You also have the right to complain to a supervisory authority. Ours is FLEXA; if you are in the EU or EEA you may also complain to the authority where you live.
Who else touches your data#
We use a small number of service providers, each only for what is listed:
| Provider | What for |
|---|---|
| Vultr | Runs the servers that host the platform and your websites (Singapore) |
| Vercel | Serves the platform's web frontend and counts its visits without cookies |
| Cloudflare | Runs the AI models that generate the content you ask the AI to produce (Workers AI) |
| Pixabay | Finds stock images for generated sites; it receives search terms drawn from your site brief, never your account data |
| Mailgun | Sends transactional email |
| Stripe | Card payments, when card checkout is offered |
| PayPal | Payments, when PayPal checkout is offered |
Your data is hosted in Singapore, so if you are in the EU or EEA it is processed outside the EEA.
Security#
Transport is encrypted everywhere. Passwords are stored hashed. Each hosted website runs isolated from every other under its own system account. Sensitive account actions require you to re-enter your password, and two-factor authentication is available in Settings, Security. More detail is in the Security Policy.
Changes#
We will post changes to this policy here, with the date below, and for material changes we will tell you in the dashboard before they take effect.
Last updated: 5 Sep 2026