Privacy Policy

1. Introduction and scope

This Privacy Policy describes how Sitepur ("Sitepur", "we", "us", "our") handles personal data in connection with the website at sitepur.com and the subscription website-as-a-service that we provide (together, "the Service"). Sitepur copies a chosen design into your account, hosts the resulting static website, and lets you edit its content. This policy applies to visitors to sitepur.com, to persons who register for an account, and to customers who subscribe to the Service ("you", "the Customer").

This policy does not govern the personal data that visitors submit through the websites that you build and publish using the Service. Your responsibilities and our role in relation to that data are described in section 14. This policy should be read together with our Terms of Service, our Cookie Policy, our Acceptable Use Policy, and our Refund and Cancellation Policy.

2. Who we are

For personal data relating to your Sitepur account and your use of the Service, the data controller (and the "Data Fiduciary" under Indian law) is:

• Sitepur (operated by Elicus Technologies Private Limited, GSTIN 08AAECE5283G1ZJ, D9/83, Chitrakoot Scheme, Vaishali Nagar, Jaipur 302021, Rajasthan, India).

For the personal data that your website visitors submit through the site you publish with the Service, you are the controller and we act as a processor on your behalf. In that context we process such data only on your documented instructions, as further set out in section 14.

You can reach us on data protection matters through our contact form at sitepur.com/contact or by post at the registered address above, marked for the attention of the [Data Protection Officer].

3. Information we collect

Depending on how you use the Service, we collect the following categories of data.

• Account details. Your name, email address, password (stored only as a salted hash), business name, chosen subdomain or custom domain, and account preferences.
• Billing details. Subscription plan, billing cycle (monthly or annual), invoices, and payment status. Card numbers and other payment credentials are collected and stored by our third-party merchant of record, not by us. We receive only a limited record of each transaction (for example, the last four digits of a card, the billing country, and the amount) so that we can operate and support your subscription.
• Your site content. The text, images, business information, and configuration you enter or upload when building and editing your website, including the instructions you send to our AI editing feature.
• Usage, log and device data. IP address, browser type, device and operating system information, referring pages, pages viewed, actions taken in the dashboard, dates and times of access, and diagnostic and error logs.
• Cookies and similar technologies. Identifiers and preferences stored on your device, as described in section 6 and our Cookie Policy.
• Support communications. The content of emails, tickets, and other messages you send us, along with our replies.

4. How we collect it

• Directly from you when you register, subscribe, build or edit your site, contact support, or otherwise interact with us.
• Automatically through your use of sitepur.com and the dashboard, by means of server logs, cookies, and similar technologies.
• From our merchant of record and other processors that help us run the Service, for example transaction confirmations, refund and chargeback notices, and delivery status for transactional email.

5. Why we use it and legal bases

We use personal data for the purposes below, relying on the legal bases stated.

• To provide and operate the Service: to create and administer your account, copy your chosen design, host your site, process your edits, and make the Service available. Legal basis: performance of a contract with you. Under the DPDP Act, this is processing for the performance of the Service you have requested.
• To secure the Service: to protect against fraud, abuse, and unauthorised access, and to maintain the integrity of our systems. Legal basis: legitimate interests in keeping the Service secure, and legal obligation where applicable.
• To improve the Service: to understand how the Service is used, diagnose problems, and develop features. Legal basis: legitimate interests, and consent where the law requires it (for example, certain analytics cookies).
• To bill you and keep records: to manage your subscription, issue and retain invoices, and meet tax and accounting duties. Legal basis: performance of a contract and compliance with a legal obligation.
• To communicate with you: to send service and account notices, security alerts, and responses to your requests, and, where permitted, information about the Service. Legal basis: performance of a contract, legitimate interests, and consent where required.
• To comply with law: to respond to lawful requests and meet our legal and regulatory obligations. Legal basis: compliance with a legal obligation.

Where we rely on consent, you may withdraw it at any time as described in sections 11 and 13. Under the DPDP Act, we process personal data on the basis of your consent or on the basis of certain legitimate uses recognised by that Act.

6. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and, with your consent where required, to measure usage. For the categories of cookies we use, their purposes, and how to manage your choices, please see our Cookie Policy.

7. How we share personal data

We do not sell personal data. We share personal data only in the circumstances below, and we require our processors to protect it under written contracts.

• Service providers (processors). Hosting and infrastructure providers that run our servers, the merchant of record that processes payments and issues invoices, our transactional email provider, our artificial intelligence provider that powers the content editing feature, and analytics providers. Each acts on our instructions for the purposes described in this policy.
• Legal and safety disclosures. Where required by applicable law, court order, or lawful request by a public authority, or where necessary to protect the rights, property, or safety of Sitepur, our customers, or others, or to investigate fraud or abuse.
• Business transfers. In connection with a merger, acquisition, financing, reorganisation, or sale of assets, in which case personal data may be shared with the counterparty and its advisers, subject to this policy or a successor notice.

8. International data transfers

Sitepur operates from India, and our providers may process personal data in India and in other countries. As a result, your personal data may be processed outside the country in which you are located, including in jurisdictions whose data protection laws differ from those of your home country.

Where we transfer personal data across borders, we apply appropriate safeguards required by applicable law. For transfers from the European Economic Area, the United Kingdom, and Switzerland, we rely on the European Commission Standard Contractual Clauses (and the UK Addendum where relevant), together with additional measures where needed. You may request a copy of the relevant safeguard through our contact form.

9. Data retention

We keep personal data for as long as your account is active and for as long as needed to provide the Service. After that, we retain personal data where necessary to meet legal, tax, and accounting duties, to resolve disputes, and to enforce our agreements.

• Account and site content are retained while your subscription is active and for the periods described in the Terms of Service.
• Data relating to a suspended site is retained in line with the suspension and purge terms set out in the Terms of Service; suspended-site static files and content are not deleted except as described there.
• Billing and invoice records are retained for the periods required by applicable tax and accounting law.

When a retention period ends, we delete or anonymise the personal data, unless a longer period is required or permitted by law.

10. Security

We maintain reasonable security practices and procedures designed to protect personal data, consistent with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and with the security obligations under the Digital Personal Data Protection Act, 2023. Our measures include:

• encryption of data in transit using recognised protocols (for example, HTTPS and TLS);
• access controls that limit access to personal data to authorised personnel on a need-to-know basis;
• hashing of account passwords and protection of authentication credentials;
• logging, monitoring, and periodic review of our systems.

No method of transmission or storage is fully secure, and we cannot guarantee absolute security. If we become aware of a personal data breach, we will handle it in accordance with applicable law, and we will notify the relevant supervisory authority and affected persons where the law requires, within the applicable timelines.

11. Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom, you have the following rights, subject to the conditions and exceptions in the applicable law:

• Access: to obtain confirmation of whether we process your personal data and a copy of it.
• Rectification: to have inaccurate personal data corrected and incomplete data completed.
• Erasure: to have your personal data deleted in the circumstances the law provides.
• Restriction: to have our processing restricted in certain cases.
• Portability: to receive certain personal data in a structured, commonly used, machine-readable format and to have it sent to another controller where technically feasible.
• Objection: to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Withdraw consent: to withdraw consent at any time where we rely on it, without affecting processing carried out before withdrawal.
• Complaint: to lodge a complaint with your local supervisory authority.

To exercise these rights, reach us through our contact form. We may need to verify your identity before acting on a request.

12. Your rights under the CCPA and CPRA

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, subject to the conditions and exceptions in that law:

• Right to know: the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Right to delete: the personal information we have collected about you, subject to legal exceptions.
• Right to correct: inaccurate personal information we maintain about you.
• Right to opt out of the sale or sharing of personal information. We do not sell personal information, and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of.
• Right to non-discrimination: we will not deny you goods or services, charge you a different price, or provide a different quality of service because you exercised your rights.

To exercise these rights, reach us through our contact form. You may use an authorised agent where the law allows, and we may verify the request.

13. Your rights under the DPDP Act

If Indian law applies to the processing of your personal data, you (the Data Principal) have the following rights under the Digital Personal Data Protection Act, 2023:

• Access: to obtain a summary of the personal data we process about you and the processing activities.
• Correction and erasure: to have your personal data corrected, completed, updated, or erased in accordance with the Act.
• Grievance redressal: to have your grievances addressed by us through the readily available means described in section 16.
• Nomination: to nominate another individual to exercise your rights in the event of death or incapacity.
• Withdraw consent: to withdraw your consent at any time where processing is based on consent, with the same ease with which it was given; withdrawal does not affect processing carried out before withdrawal.

To exercise these rights or to raise a grievance, contact our Grievance Officer through our contact form at sitepur.com/contact, as set out in section 16.

14. Personal data of your website visitors

When visitors submit personal data through the website you publish with the Service (for example, through a contact or enquiry form), you are the controller of that data and we act as a processor on your behalf. In that role:

• we process such personal data only on your documented instructions and to provide, secure, and maintain the Service;
• you are responsible for maintaining your own privacy notice for your website visitors and for the lawfulness of your instructions;
• you are responsible for obtaining any consents and providing any notices that the law requires before collecting personal data from your visitors;
• we make available to you the information reasonably needed to demonstrate compliance and, where the law requires, we will assist you with data-subject requests, breach notification, and security, taking into account the nature of the processing.

Our processing of your website visitors' data is also governed by the data processing terms in the Terms of Service.

15. Children

The Service is not directed to children, and we do not knowingly collect personal data from children to create an account. We do not process the personal data of a child without the verifiable consent of a parent or lawful guardian as required by the Digital Personal Data Protection Act, 2023, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a child has provided us with personal data without the required consent, reach us through our contact form at sitepur.com/contact and we will take appropriate steps to delete it.

16. Grievance Officer and data contact

In accordance with the Information Technology Act, 2000 and the rules made under it, and with the Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer and Data Protection Officer for any concern about this policy or the processing of your personal data:

• Name: [Grievance Officer Name] / [Data Protection Officer]
• Contact: through our contact form
• Address: D9/83, Chitrakoot Scheme, Vaishali Nagar, Jaipur 302021, Rajasthan, India
• GSTIN: 08AAECE5283G1ZJ

We will acknowledge grievances and respond within the timelines required by applicable law. Under the IT Act rules, we aim to acknowledge a grievance within twenty-four hours and to resolve it within fifteen days of receipt. Requests under the GDPR are generally answered within one month, and requests under the CCPA and CPRA within forty-five days, in each case subject to any extension the law permits.

17. Third-party links

sitepur.com and the dashboard may contain links to third-party websites and services that we do not operate or control. This policy does not apply to those sites, and we are not responsible for their content or privacy practices. We encourage you to read the privacy notices of any third-party site you visit.

18. Changes to this policy

We may update this policy from time to time to reflect changes in the Service, our practices, or the law. When we make a material change, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through the dashboard. Your continued use of the Service after an update takes effect means you have read the revised policy.

19. How to contact us

For questions about this policy or your personal data, contact us:

• Privacy and data protection: through our contact form
• General and support: through our contact form
• Legal, grievance, and copyright: through our contact form
• Post: Sitepur (operated by Elicus Technologies Private Limited, GSTIN 08AAECE5283G1ZJ, D9/83, Chitrakoot Scheme, Vaishali Nagar, Jaipur 302021, Rajasthan, India).