Privacy Policy

This policy explains how Prime UI, Inc. ("we", "us", or "our") handles personal data in connection with SiteOS, including siteos.sh, app.siteos.sh, and the related services, APIs, and command-line tools.

Who is responsible for your data

SiteOS is operated by Prime UI, Inc., 1111b South Governors Ave STE 28388, Dover, DE, 19904, US. Contact us about privacy at help@primeui.com.

We act as a data controller when we decide how to use personal data for our own purposes, such as managing accounts, providing support, and protecting SiteOS.

When a customer processes data from their websites or applications through SiteOS, they normally determine the purpose of that processing. We process that data on their instructions to provide the configured service under our Data Processing Agreement. This may include form submissions, indexed content, consent records, monitoring evidence, and tracking observations. For questions about a customer's website or its handling of your data, contact that website's operator first. We assist customers with requests concerning data processed on their behalf.

Information we handle

The information involved depends on the features you use and the data you or your organization provide:

• Account and organization information: email address, optional profile details, organization membership, invitations, permissions, and authentication or session records.
• Service terms acceptance: the authenticated account accepting on behalf of an organization, account name and email, organization details and role at acceptance, acceptance time, exact version and text of the agreement and acknowledgement, integrity hashes, and whether acceptance came through the application or an authorized API client. Historical records may contain different or fewer fields, including personal account acceptance or names declared in an earlier acceptance form. This evidence is separate from consent decisions made by visitors on a customer’s website. A document hash is an integrity reference, not an independent verification of the representative’s identity. We retain these records to document the agreement, administer the service and address disputes, subject to the retention and legal requirements described below.
• Project information: names, website URLs, domains, environments, service settings, and configuration needed to connect your websites.
• Service content and results: monitoring tests and their logs, screenshots, or recordings; form submissions; indexed content and search requests; consent configurations and records; and observations produced by tracking diagnostics. These may contain personal data depending on the customer's setup and the source website.
• Integrations and credentials: connection details, authorization tokens, destinations, and delivery records needed for integrations you enable. Connected providers may also supply information under the permissions you grant.
• Operational records: service usage and credit balances, request timestamps, IP addresses, browser or device details, errors, and security or access logs generated while delivering and protecting SiteOS.
• Communications: messages and information you send when requesting support, access, or account assistance. Feedback sent from the signed-in application is linked to your account email so we can respond.

Information may come from you, authorized members of your organization, connected providers, or websites and systems you configure. Do not submit information you are not authorized to process. Avoid including sensitive data in tests, URLs, or logs unless you have established that the service and your configuration are appropriate for it.

Why we use information

We use personal data to authenticate accounts, manage organization access, run enabled services, deliver results and notifications, answer support requests, and administer usage limits. We also use operational information to investigate failures, prevent abuse, secure SiteOS, and meet legal obligations.

Where European or UK data protection law applies, our legal basis depends on the purpose:

• Contract: processing needed to provide the service you request under our agreement with you.
• Legitimate interests: operating a reliable business service, administering customer relationships, supporting users, and preventing abuse, where these interests are not overridden by your rights.
• Legal obligation: processing required by applicable law, including responding to valid legal requests and retaining required business records.
• Consent: processing for optional purposes where consent is required, including non-essential cookies and consent-based analytics.

An email address is necessary to create an account. Other information may be necessary for a feature you enable; without it, we may be unable to provide that feature. We do not use personal data to make solely automated decisions that produce legal or similarly significant effects on you.

Signing in and account emails

SiteOS uses Better Auth, self-hosted authentication software running on our servers and database, to manage accounts and sessions. Using this software does not require a hosted Better Auth account. Better Auth's Privacy Policy describes its own websites and services; this SiteOS policy describes how we handle your account data.

You can sign in using a code sent to your email address. Plus Five Five, Inc. (Resend) delivers sign-in codes, invitations and other service emails. This involves the recipient address, email content and delivery information. See Resend's Privacy Policy.

If you choose Sign in with Google, Google handles authentication and shares your account identifier, verified email address and available profile name and picture with SiteOS. We use these details to create or sign in to your SiteOS account. This sign-in requests identity permissions; it does not grant SiteOS access to your Gmail messages, Drive files or other Google services. Connecting a Google product within SiteOS is a separate authorization. Google also receives information about the sign-in request and processes it under Google's Privacy Policy.

Connected Google services

Connecting Google Analytics, Google Search Console or Google Tag Manager is optional and separate from signing in with Google. You choose the Google account, approve the permissions Google shows, and select the resources to share with your SiteOS organization and Project environments.

Depending on the service you connect, SiteOS accesses:

• Google Analytics: accessible account, property and web-stream metadata, and the aggregate traffic, page, event, conversion, realtime, funnel and cohort reports you request. SiteOS uses read-only access to display reports and support measurement diagnostics; it does not change your Analytics settings.
• Google Search Console: accessible properties, search-performance reports, URL-inspection results and sitemap information. SiteOS uses these for search reporting and indexing diagnostics. Submitting a sitemap requires the separate permission to manage Search Console data and an explicit submission action.
• Google Tag Manager: accessible accounts and containers, their tags, triggers, variables and versions. SiteOS uses read-only access for configuration diagnostics and version comparisons; it does not edit or publish your containers.

We store connection identifiers, granted permissions and encrypted authorization tokens to keep enabled integrations working. We also store resource selections, configuration snapshots and cached or historical report results needed for the features you use. Google API data is not a separate source for SiteOS's own advertising or visitor tracking.

Connected data is available to authorized people in your SiteOS organization according to the service's access controls. If you explicitly authorize an AI assistant or other API client to read that organization's reports, the requested results are also sent to that client. Review the recipient and permissions before authorizing such access. Our infrastructure providers process data as needed to operate the service, as described in this policy and the DPA.

SiteOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use this information to provide the connected features you request. We do not sell it, use it for advertising, or use it to train generalized AI models. Human access and any other transfer are limited to the circumstances permitted by those requirements, including your affirmative agreement, security needs and legal obligations.

You can disconnect a Google service in SiteOS and revoke SiteOS's access through your Google Account connections. Disconnecting one service stops its future use of that connection; other services you keep connected may continue to use their permissions. Removing the final enabled service clears the connection's stored tokens. Disconnecting does not automatically erase previously stored reports or configuration snapshots. Their retention, deletion requests and restricted backup copies follow the retention and rights sections of this policy and the DPA. Contact help@primeui.com to request deletion or details about a specific record.

Analytics, cookies, and your choices

The application uses authentication and session cookies to keep you signed in and protect account access. These are necessary for the service you request. Blocking or removing them may sign you out or prevent account features from working.

We use Google Tag Manager, provided by Google, to load and manage website integrations. Loading Tag Manager involves a connection to Google's servers, which receive technical request information such as your IP address and browser details. See Google's Privacy Policy for information about Google's processing. Fonts are served by the website itself; loading them does not require your browser to contact Google Fonts.

Analytics, where enabled, helps us understand visits and interactions with SiteOS and improve the service. Depending on the tool and configuration, this may involve page URLs, interaction events, browser or device information, and pseudonymous identifiers. Necessary hosting and security logs may also be generated when you visit.

Where optional analytics or cookies require consent, the cookie banner provides a choice to accept, reject, or select categories. Optional processing that requires consent starts only after you opt in. When these tools are enabled, you can revisit the consent controls to change your choices or withdraw consent. Necessary storage remains available to deliver and protect the service you request.

We do not sell personal data, share it for cross-context behavioral advertising, or use advertising and remarketing trackers on the SiteOS website. Customers are responsible for the analytics, cookies, and notices on their own websites, including when they use SiteOS to manage consent or inspect tracking.

Customer-configured SiteOS Analytics

On customer websites, the operator chooses the measurement mode and is normally the controller. Baseline cookieless measurement uses minimized page information, allowlisted events, sources, approximate country, region and city where available, device categories and daily visitor/session estimates without a persistent browser identifier. This is not a general legal conclusion that all such processing is anonymous or exempt from consent. Separate website restrictions and browser privacy signals can limit or stop collection. Geography is derived from network request metadata at visit entry, not device GPS. It may be inaccurate or unavailable, particularly for VPNs and mobile networks. Analytics does not store raw IP addresses or precise coordinates in its event and visit records. Minimal pageview counts contain no geography.

Optional visitor recognition uses a resource-scoped first-party browser identifier only with an active policy, matching installation and affirmative permission. Its selected lifetime is 1 to 90 days from the original grant, default 30, without automatic activity renewal. Optional identification can associate later events with an opaque account or accepted-submission identifier supplied and signed by the website's own backend and, if individually selected and permitted, email, display name and an account email-verification assertion. SiteOS does not scrape these fields from pages, fetch profile photos or merge profiles by email. A submitted contact is not a verified account. Previous cookieless history is not retroactively linked.

Recognition-enabled installations can also use bounded, resource-scoped browser storage for pending identity transitions and withdrawal/deletion cleanup. That storage contains random cleanup credentials and deadlines, not email, names or signed claims; completed cleanup removes the corresponding records. A separate full-opt-out preference remains until the visitor resets it or clears browser storage. If a page cannot persist necessary privacy state, it must not claim that a preference will survive reload. Website operators must disclose their actual storage, purposes, lifetimes and available choices, including those of other installed tools.

Detailed event and profile history follows the customer's selected 30 to 730-day limit, default 30. Existing records have fixed expiry; increasing the setting does not restore deleted or expired history. Withdrawal stops future processing under that permission; deletion is a separate operation and does not immediately rewrite backups. Restricted profile access, deletion markers and the existing backup periods are described in the DPA. These optional customer capabilities do not imply that all are enabled on SiteOS's own website or application.

When Analytics uses durable Edge delivery, Cloudflare temporarily stores minimized event envelopes while they await import. Depending on the permitted measurement level, these contain event and resource references, timestamps and allowlisted website details, daily visitor pseudonyms, approximate country, region and city where available, device categories and scoped permission or recognition digests. Minimal pageview envelopes omit website details, geography and visitor references. The buffer does not retain raw IP addresses, User-Agent headers, recognition credentials, customer identity assertions, account identifiers, emails or names. Identity and privacy-control requests are forwarded without entering this event buffer.

Buffered events become ineligible for import seven days after their first acceptance, without renewal on retry. Imported, rejected and expired envelopes are removed through bounded cleanup; a storage failure may delay physical deletion and requires retry. Import rechecks current permissions and revocation. Buffering does not add seven days to report history: history expiry uses the original event acceptance time. Cloudflare's network processing is distinct from the location of stored objects.

Who can receive information

Access is limited to what is needed for the relevant purpose. Recipients may include:

• Authorized people within your organization, according to the service's access controls.
• Our personnel and providers supporting hosting, storage, security, email delivery, and customer support.
• Providers and notification destinations your organization chooses to connect, as needed for the configured integration.
• Authorities or other parties where disclosure is legally required or necessary to protect rights or safety or investigate abuse.
• Parties involved in a merger, acquisition, or transfer of our business, subject to applicable protections and notice requirements.

Our infrastructure and operational providers include Hetzner (production hosting), Cloudflare (network delivery, security and storage), Pixel Point LTD (development and technical operations), Vercel (public website hosting), and Plus Five Five, Inc., trading as Resend (service email). DataForSEO OÜ supplies requested SEO/GEO research where enabled. The DPA supplier list describes their roles when processing customer data on instructions. This list does not mean every provider receives every category of information.

Connected third-party services have their own privacy terms. Review the permissions and information you share with them.

International processing

Prime UI, Inc. is based in the United States. Depending on the infrastructure and providers used for a feature, information may be processed in the United States or other countries with different data protection laws.

Transfers subject to European or UK data protection requirements require an applicable transfer mechanism, such as an adequacy decision or approved contractual safeguards. Our DPA incorporates applicable EU Standard Contractual Clauses and the UK Addendum for covered customer transfers. Resend's primary processing is in the United States; Cloudflare operates a global network. The encrypted off-host database/configuration backup repository uses Cloudflare R2's EU jurisdiction, which does not make all SiteOS processing EU-only. Contact help@primeui.com for information about locations and copies of applicable safeguards. This policy does not represent that SiteOS holds a particular transfer certification.

Retention and security

We retain information for the purposes described here. The appropriate period depends on whether an account or project remains active, the service and retention settings involved, the need to investigate security incidents or resolve disputes, and legal recordkeeping duties.

Customer service data follows the service configuration, processing instructions and the return/deletion periods in the DPA. Regular database/configuration backups expire after 30 days and pre-release copies after 14 days, during daily maintenance. These copies exist on the production server and in a separate encrypted repository. Deletion from an active system does not immediately rewrite an existing backup; copies remain restricted until expiry, and deletion instructions must be reapplied after restoration.

Account and organization information remains while needed to provide and secure the account. On closure we remove information no longer needed, subject to legal exceptions. Contract acceptance evidence is normally retained for the relationship and up to six years after it ends to establish the agreement and address disputes, with earlier deletion where appropriate or longer retention where law or a specific legal claim requires it. Operational and security records are retained only as needed for their purpose, applicable configured limits and incident investigation; we do not use a general legal-record exception to keep unrelated service content indefinitely. Contact us for the period applicable to a specific record or request.

We use access controls and other technical and organizational measures intended to protect personal data. No online service can guarantee complete security. Keep access links and credentials private, limit integration permissions, and contact us if you suspect unauthorized access.

Your choices and rights

Depending on your location and the law that applies, you may have rights to access or copy your personal data, correct it, request deletion, restrict processing, receive certain data in a portable format, or object to processing based on legitimate interests. You can withdraw consent without affecting processing that was lawful before withdrawal.

Send requests to help@primeui.com. We may need to verify your identity and authority. Rights can be subject to legal exceptions, and we will explain any applicable limitation. For data controlled by a SiteOS customer, we may direct your request to that customer or assist them with responding.

You may also complain to your local data protection authority. We will not discriminate against you for exercising applicable privacy rights.

Children

SiteOS is for adults acting in a business or professional capacity. It is not directed at children, and we do not knowingly collect children's personal data for our own account services. Contact us if you believe a child has provided us with personal data so we can investigate and take appropriate action.

Changes and contact

We may update this policy as SiteOS develops or our practices change. The date above identifies the latest version. We will provide additional notice of material changes where required and obtain consent when a change requires it.

For questions or requests, contact Prime UI, Inc. at help@primeui.com, or write to 1111b South Governors Ave STE 28388, Dover, DE, 19904, US.