Privacy Policy

Last updated: 15 October 2026

Sitebrief is operated by KUDAI CO PTY LTD (ACN 681 442 697, ABN 86 681 442 697, "we", "us", "our"). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what we collect, why, and what you can do about it.

1. What we collect

When you use Sitebrief we may collect:

• Business details you give us through the questionnaire or your site's portal — business name, trade, services, hours, service area, and similar.
• A business type you type yourself — if none of the listed business types fits and you type your own, that text is sent to Google's Gemini AI service to match it to one of our website templates. If none fits, Gemini also writes starting wording for a new template from those words, and we keep that wording and reuse it for other people who type the same kind of business. Only that text is sent: never your name, contact details or other answers.
• An address you type on the Google page — if you use "Find your address", the text you type is sent to Google's Places API to suggest matching addresses, along with the address you pick. It is sent from our servers, not your browser, so Google doesn't see your device. Only that text is sent: never your name, contact details or other answers.
• Contact details — name, email address, phone number.
• Team members you invite — the email address of anyone you invite to your site's team, so we can send them the invitation link and record who is on the team.
• Your site's country — each site has a country, which is Australia, New Zealand or the United States. Every new site starts as Australia: we don't ask for it when you build your site, and we never work it out from your IP address. You can change it in your site's Settings. We use it to read and show phone numbers the way that country writes them, for example which country code goes with a number. The country itself is not sent to anyone else. We keep it with the site and delete it with the site.
• Messages and booking requests from visitors to a site we host — if you have a website on Sitebrief, the people who visit it can send the business a message or ask to book a time, and what they type comes to us to pass on. If you are that visitor, for a message we collect the kind of enquiry you choose, your name, your email address, your phone number if you give one, and your message (up to 2,000 characters); for a booking request we collect the day and time you pick, what it is for, your name, your mobile number and an optional note (up to 500 characters). With either we keep a salted, one-way hash of your IP address (we store the hash, not the address), used to limit spam. We hold this for the business you sent it to: sections 3 and 5 say who sees it and how long it is kept.
• Content you upload — photos and other material for your site.
• An early-access list for a new product — if you leave your email address and your website's address on the early-access page for a product we are planning (today, Watch, which would check a website and email its owner when it stops working), we keep both, with the tags of the ad you came from (if any) and a salted, one-way hash of your IP address (we store the hash, not the address), used to limit spam. We use them to tell you when that product opens and to count how many people asked. We send you nothing before then, we do not check your website, and no account is made.
• Domain registration details — if you buy a domain through Sitebrief, the registrant's name, postal address, phone number and email address. The rules for registering a domain require these to be given to the registrar and to the registry that runs that domain ending, because the domain is registered in your name. We ask for them to be kept out of the public WHOIS directory. We keep our own copy only until the domain is registered or the payment is refunded. If you start a purchase and never pay, we delete it after 7 days.
• Account credentials — an email and password, or a Google sign-in, for your site's portal.
• Payment information — handled by Stripe. We never see or store your full card number. We receive confirmation that a payment succeeded or failed, and we keep the card's type (such as Visa) and its last four digits, so we can show which card is on your subscription. Stripe's receipts and our emails about payments and domains go to the email address on your account (the one you confirmed or signed in to Google with, or otherwise the one you signed up with), and to the email on your site's details only if there is no account. If your site has no contact email yet, we fill it in with your account's email address, or, if there is none, the one you gave Stripe at checkout. The billing address and ABN you give at checkout are kept by Stripe, not by us.
• Technical information — a salted, one-way hash of your IP address (we store the hash, not the address), used to rate-limit requests and prevent abuse. We also keep your browser's user-agent string (the browser and device type it reports) with your brief. Our web server also keeps an access log of requests to sitebrief.au: your IP address, the page requested and when. We keep it for 30 days, to investigate security problems, and then delete it. It does not include the websites we host for businesses, so their visitors are not recorded in it.
• Usage data — how you use Sitebrief's own site: the pages you visit and the elements you click, collected with PostHog, a product-analytics service. Your IP address is sent to PostHog to derive an approximate location (such as your city) and is discarded rather than stored.
• Advertising source — if you arrive by clicking one of our ads or a tagged link, or by using a short link, the campaign tags in that link (such as which ad it was), the click identifier the ad platform adds to it, and the site that referred you. We keep these with your brief.

2. Why we collect it

We use this information to:

• generate and operate your website;
• bill your subscription and handle payment issues;
• provide support when you contact us;
• tell you when a product you asked about on an early-access list opens;
• pass on to a business the messages and booking requests that visitors send to it through its website, and show the business those messages and requests;
• protect the public parts of Sitebrief from abuse and fraud;
• understand and improve Sitebrief — how it is used and what to fix;
• measure whether our own advertising works;
• show your site's name, a preview of it and a link to it in our public gallery, if you choose to be included (you can turn this off in your account at any time);
• meet our legal and accounting obligations.

We do not sell your personal information. We do not use it to show you advertising for anyone else, and we do not build advertising profiles of you. The one advertising use is measuring our own ads, described in section 6.

3. Who we share it with

We use a small number of service providers to run Sitebrief, and share only what each one needs to do its job:

• Stripe — payment processing and billing.
• Cloudflare — DNS, receiving email sent to sitebrief.au, and, if you buy a domain through us, registering it in your name (Cloudflare Registrar). Cloudflare passes your registrant details on to the registry for that domain ending.
• Google — Google sign-in, if you choose to use it; the Gemini AI service, which matches a business type you typed yourself to one of our templates and, when none fits, writes starting wording for a new template from it (which we keep and reuse for others who type the same kind of business); the Places API, which suggests addresses as you type on the Google page; and Google Search Console, which we tell the web address of every live site (and, for a domain bought through us, verify with Google by adding a record to its DNS) so that Google can find and index the site.
• DigitalOcean — the servers and file storage Sitebrief runs on, in Sydney.
• Resend — sending transactional email on our behalf, including the email that tells a business about a new message or booking request from its website, which carries what the visitor typed.
• OpenStreetMap — the map on a business's website. See below: the visitor's browser contacts it directly, so we send it nothing.
• PostHog — product analytics (how visitors use our site).
• Meta (Facebook and Instagram) — measuring our own ads, only if you arrived from one of them (see section 6).

Some of these providers process information outside Australia: Stripe, Cloudflare, Google, Resend and Meta mainly in the United States (Cloudflare also across its worldwide network), PostHog in the European Union, OpenStreetMap outside Australia, and the registry for your domain ending wherever it operates (for .com and .net, the United States). DigitalOcean stores Sitebrief's data in Sydney. Where information goes overseas, we rely on their own compliance obligations (each of the above is a well-known provider with its own privacy and security commitments) and, where required, on the safeguards the Australian Privacy Principles allow for overseas disclosure.

The map on a business's website. A website we host for a business may have a "Where we work" map, which is an OpenStreetMap map. Sitebrief's own pages do not have one. The map is not loaded by us: a visitor's browser fetches it from openstreetmap.org when the visitor opens the site (browsers usually wait until the map is close to the screen). So OpenStreetMap receives the visitor's IP address and the details their browser reports about itself, such as the browser and device type, and may record them under its own privacy policy; the page also asks for a particular area of the map, which is the suburbs the business works in, not where the visitor is. We send OpenStreetMap nothing about the visitor, and a business's website tells the browser not to pass on the address of the page the visitor was reading. A website with no map does not contact OpenStreetMap.

Messages and booking requests from a business's visitors. These are shown only to the business they were sent to. Everyone on that site's team can read them in the site's portal, and we email each new one (through Resend) to the address the business chose for messages or, if it chose none, to the confirmed email address of the site's owner and admins. Our staff inbox shows how many have been sent, not what they say. They are not shown to other Sitebrief customers.

We do not otherwise share your personal information with third parties, except where required by law.

4. Security

We take reasonable steps to protect the personal information we hold, including storing passwords hashed rather than in readable form, and using encrypted connections (HTTPS) throughout. No system is completely secure, and we cannot guarantee absolute security.

5. How long we keep it

We keep your information for as long as you need it to use Sitebrief, and we delete it when it is no longer needed:

• Unsaved sites: A site that is not saved to a confirmed email address is kept until you make an account or delete it.
• Cancelled subscriptions: If a site was never saved to an account and its subscription ends, we delete it within about a month after 12 months have passed since the subscription ended. A saved site whose subscription ends is kept on the free plan (deleted only when the account or site is deleted).
• Messages and booking requests from a business's visitors: These are kept with the site they were sent to for as long as that site exists. There is no shorter time limit, and neither a business nor a visitor can delete one on its own; they go when the site is deleted, in any of the ways described here (the owner deleting the site or account, a fourth free site, or the 12-month deletion above). The salted hash of the sender's IP address that was stored with one goes with it. The separate record we use to limit how fast one source can send things to us holds only those hashes, a time and an outcome, and is deleted after 60 days.
• The early-access list: Your email address and website address are kept for up to 12 months, then deleted, or sooner if you ask us to (contact us at the address below). If you delete your Sitebrief account, an entry made with your account's email address is deleted with it. The salted hash of your IP address that was stored with it goes with it too.
• Deleting your account: You can delete your account from your account page. We wait 7 days before deleting your account and sites, during which time your sites are offline but you can change your mind.
• Deleting a site: You can delete a site from your account and keep your account. We wait 7 days before deleting the site. It is offline during this time, but you can change your mind.
• Making a fourth free site: An account can usually hold three sites that are not on a paid subscription. If you choose to make a fourth, after we have warned you and named the site, we delete your oldest free site straight away, without the 7 days above, and remove its data as described below. (If you build a site using "Continue with Google" while at the limit, we allow one extra free site without warning or deletion, so you may hold four.) Sites on a paid subscription are never deleted this way.

When your account or site is deleted, we remove your data, with a few exceptions required for legal, tax, or technical reasons:

• Tax and billing records: We keep payment and invoice records to meet our legal and tax obligations, for as long as tax law requires. Invoices already issued keep the details they were issued with, including the billing address and ABN you gave at checkout, and Stripe keeps that address and ABN on your customer record too. We remove your card details, and the name, email address and phone number on your Stripe customer profile.
• Late payments: After a site is deleted, we keep its Stripe customer reference, with no set end date, so that a payment that arrives late can be refunded.
• Backups and logs: Your data may remain in our encrypted backups for up to 30 days. Our web server's access log is kept for 30 days. Records of emails we have already sent are kept for a short period and then deleted.
• Analytics and advertising: We delete your site analytics through PostHog's API. If you arrived from a Meta ad, the hashed conversion data we already sent to Meta (described in section 6) cannot be recalled by us.
• Domains: If you bought a domain through us, we keep a minimal record of it until it expires or is transferred.

6. Cookies, local storage and analytics

Sitebrief uses cookies and local storage for two things. First, for the service to function — for example, keeping you signed in to your site's portal. Second, for product analytics: we use PostHog to measure how people use our own site, so we can see what is working and what to improve. PostHog sets cookies to tell visitors apart and to link the pages one visitor sees in a single session.

Through PostHog we learn which pages are visited and which elements are clicked (a button, for example), and we use your IP address to work out an approximate location such as your city. That data is processed in the European Union, and your IP address is discarded rather than stored. We do not use session replay, and we do not record the text you type into the site.

If you arrive from one of our Facebook or Instagram ads, our server tells Meta that you arrived, and if you then start building a site (by choosing your business type), send us a brief, confirm your email address (or sign the site in with Google) or start a subscription, it reports that the ad led to that result, so we can tell which ads are worth running and Meta can show them to similar businesses. What we send is: the event, the click identifier Meta added to the ad link, your browser's user-agent and IP address, a random identifier our analytics gives your browser (which lets Meta connect your steps from arriving to subscribing, but is not a name or contact detail), the type of business you chose, for a subscription its monthly price, and your email address and phone number if you gave them — with the analytics identifier, email and phone number hashed (converted to a one-way code) before they leave our server, never in readable form. Nothing is sent to Meta about visitors who did not come from a Meta ad, and no Meta code or cookie runs on our site. Meta handles this data under its own terms and privacy policy, and may process it outside Australia.

We do not use third-party advertising cookies, and we do not sell your information.

7. Accessing or correcting your information

You can ask us for a copy of the personal information we hold about you, or ask us to correct it, at any time by contacting us at the details below. That includes a message or booking request you sent through a business's website: tell us which website and roughly when you sent it. We will respond within a reasonable time and will not charge you for making the request. Much of your own business information is also editable directly from your site's portal. You can also initiate the deletion of your account and its data at any time from your account page (Your account > Your details), subject to the retention periods described in section 5.

8. Complaints

If you have a concern about how we have handled your personal information, contact us first at the address below so we can try to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date.

10. Contact us

support@sitebrief.au