Fasite Privacy Policy

1. Summary

Fasite is a website-as-a-service for trades and home-services businesses. We help small business owners launch a site, collect leads from that site, and manage paying customers. This policy explains what we collect, why, who we share it with, and the rights you have over your data.

If you are a Fasite customer (a business that signed up for our service), we collect your account info, billing details (through Stripe), and the business intake you provide so we can build and run your site.
If you submitted a contact form on a Fasite-built site (e.g. you asked a landscaper for a quote), we collect your contact info and request on behalf of that business so they can reply to you. We act as a processor for them; the business itself is the controller of that data.
We do not sell personal information. We do not use it to build our own advertising audiences. Google signals is turned on for Google Analytics, so Google may associate visits with a Google account, as described in Section 3c.
We use Google Analytics 4 on fasite.org to understand traffic and usage, with Google signals turned on (see Section 3c). We do not run session recording or advertising pixels.
We do not use customer business data or end-user lead data to train our own AI models. Our voice provider, Retell, may use de-identified, aggregated call data to train and improve its models under its own terms. AI is used to write and illustrate your site, to draft up to two articles a week, and, once the AI receptionist is connected, to answer and summarize calls. Call audio goes to our voice provider. A visitor who starts the recorded demo on fasite.org gives a first name and an email address, and the call, its transcript, a summary, and the visitor's IP address are stored with our voice provider.

2. Scope and Our Role

This policy covers personal information processed through:

Our marketing site at fasite.org, the customer dashboard at fasite.org/dashboard, and the admin console (operated internally by Fasite).
Customer-facing websites we host on customer subdomains (*.fasite.org) and custom domains pointed at our infrastructure.

For account, billing, and business-owner data, and for demo calls on fasite.org, Fasite is the data controller. For leads, call recordings, texts, bookings, and the customers, crew, and job records a business keeps in the product, Fasite is the processor acting on behalf of that business. The business is the controller of those records.

3. Information We Collect

3a. Information you provide directly (Fasite customers)

Account identifiers: name, email, password (hashed; we never see the plaintext), profile photo (optional).
Business intake: business name, phone, email, street address, service area, years in business, services offered, certifications, tagline, target audience, brand voice preferences, niche, and color palette. We use this to generate and host your site.
Billing information: payment method, billing email, subscription status. Card numbers are handled by Stripe directly; Fasite never stores them. We retain a Stripe customer ID and subscription metadata locally.
Support communications: any email, chat, or form messages you send us.
Texting registration: legal business name, address, email, phone, website, and employer identification number. A sole proprietor provides their own name and mobile number instead of an employer identification number. We send this to the phone carrier to register your texting campaign. We do not keep the employer identification number in our own database. The carrier keeps it with your registration.
Work records you keep in the product: your customers, their property addresses, jobs, estimates, invoices, payments, crew names and phone numbers, a per-person hourly cost, and notes. When your customer answers an estimate online, we store the name, email, and signature they type, their answer, and the terms shown on that document.
Demo calls on fasite.org: a first name, an email address, the IP address, the call audio, the transcript, and an AI summary. Our voice provider (Retell) stores the call record, we email the name and email address to our team, and we email the visitor a summary of the call.

3b. Information collected from end users (visitors to a customer's site)

When someone contacts a Fasite-hosted business through a web form, a phone call, a text message, or an online booking, we collect what the visitor provides on behalf of the business that owns the site:

Contact name, email, phone
Property or job-site address (free-form text)
Service type requested
Free-form message
Call recordings and transcripts: once the AI receptionist is connected, inbound and some outbound phone calls are recorded and transcribed by it. We collect the audio recording, the text transcript, an AI-generated summary, and call metadata such as the caller's phone number, the time and duration of the call, and the business the call was placed to.
Text message (SMS) content and metadata: the content of text messages sent to and from the business's dedicated number, the participating phone numbers, timestamps, and delivery status. How we share phone numbers and text consent is in Phone numbers and text messaging.
Booking and appointment data: the requested service, appointment date and time, and any details the visitor provides when booking.
Lead and contact history (CRM): the combined record of a contact's web-form submissions, calls, and texts, kept together so the business can follow up.
Submission metadata: timestamp, the source page, the business ID it was submitted to

We do not put a visitor's IP address or browser type on the ordinary lead row. We do store them with a website form's text consent, as evidence of that agreement. Our hosting providers (Vercel, Render) keep short-term request logs that may include IP address and browser type for fraud prevention and infrastructure security. A spam filter on customer sites keeps a copy of a submission it flags, or of a repeat of one already received, with its IP address and browser type. That submission is not delivered to the business, and the record is kept indefinitely.

3c. Information collected automatically

Authentication cookies: Supabase session cookies (sb-<ref>-auth-token). These are strictly necessary for sign-in.
Server logs: Vercel and Render keep request metadata for operational and security purposes. Retention is governed by their respective policies.
Analytics cookies. fasite.org, including sign-up, sign-in, and the customer dashboard, uses Google Analytics 4 (property G-EEK3YPS73T). It does not load on the private invoice, estimate, booking, and job-list links a business sends, or on approval links, and it does not load on websites we build for our customers. Google Analytics sets first-party cookies named _ga and _ga_EEK3YPS73T (a _ga_* cookie), which last up to two years unless your browser shortens that. Google receives your IP address, device and browser information, the pages you visit, and how you arrived, and gives us aggregate reports.
Google signals. We have turned on Google signals. For visitors who are signed in to a Google account and have allowed ad personalization in that account, Google may associate these visits with that account to produce cross-device reports. We use Google Analytics only to understand traffic and usage. We have not linked it to Google Ads, we do not use it to build advertising audiences, and we do not run advertising pixels, including Meta's, on fasite.org or on customer websites. See Section 6 to opt out, and Google's page on how Google uses data from sites that use its services.
Performance measurement: fasite.org pages also send page-load timing, the page address, and device type to Vercel Speed Insights. It does not set cookies.

3d. Information from third parties

We also receive personal information from services you connect, or that people use to reach a business on the platform:

Public Google reviews of a business, including the reviewer's name, profile photo, rating, and text. Each month we collect them for every live site through Monid and Apify, and show the newest four- and five-star reviews on that business's site.
Google, when you sign in with Google: your name, email address, and profile picture.
Stripe, for subscription billing and, if the business connects Stripe, card payments that business's customers make.
The phone and text carriers that deliver calls and texts.

4. How We Use Information

For each purpose below, we identify the GDPR lawful basis.

Provide the Service (build, host, and bill your site; deliver leads to you). Lawful basis: contract (GDPR Art. 6(1)(b)).
Generate site content and articles via AI. We pass your business intake, and the services and site content needed to write pages and up to two articles a week, to large language model providers (currently OpenAI) and image prompts to image providers (currently fal.ai). Photos you upload are sent to OpenAI so it can describe them and place them on your site, and if you give us your existing website, we send its text to OpenAI to pull out your services and details. We do not pass lead contact details, call recordings, text messages, or payment card data to OpenAI or fal.ai for that generation. Lawful basis: contract.
Email notifications for new leads. When a lead is submitted, we email the business owner via Resend. The email contains the lead's contact information and message. Lawful basis: contract (for the customer); legitimate interest of the business (for the end user, which the customer business is responsible for).
AI receptionist, texting, and booking (once the AI receptionist is connected). To answer calls, record and transcribe them, send and receive text messages, and take bookings, we pass the relevant call audio, text content, and phone numbers to our voice and messaging providers (currently Telnyx for voice and SMS connectivity, and Retell for the AI voice agent). We use this to operate the feature for the business and to store the resulting lead. Lawful basis: contract (for the customer); legitimate interest of the business (for the end user, which the customer business is responsible for).
Account security and fraud prevention (rate limits, spam filtering on lead forms, audit logs of admin actions). Lawful basis: legitimate interest (GDPR Art. 6(1)(f)).
Billing and tax compliance. We retain subscription records as required by accounting law. Lawful basis: legal obligation (GDPR Art. 6(1)(c)).
Service improvement. We may use aggregate, de-identified metrics (number of leads received, sites published, generation latency) to improve the platform. We do not use identifiable customer or end-user data to train our own AI models. Retell may use de-identified, aggregated call data to train its models, as described in Section 1. Lawful basis: legitimate interest.
Support and communication. Lawful basis: legitimate interest.

5. How We Share Information

We share personal information with the following categories of third parties for the purposes described. We do not sell personal information.

Hosting and infrastructure: Vercel (customer site hosting, admin and customer dashboards), Render (API backend), Supabase (authentication and PostgreSQL database, US East), Upstash (Redis for job queues), Cloudflare R2 (image and asset storage).
Website analytics: Google LLC (Google Analytics 4, property G-EEK3YPS73T) receives IP address, device and browser information, and page-level usage data from visitors to fasite.org, including sign-up, sign-in and the customer dashboard but not the private invoice, estimate, booking, and job-list pages a business sends. Google signals is on for this property, as described in Section 3c. It does not run on customer-built sites. Vercel Speed Insights receives page-load timing from fasite.org pages.
Payments: Stripe handles card processing and subscription billing. Stripe receives your name, email, billing address, and card data directly. We do not currently use Stripe Tax to calculate or collect sales tax on your behalf. Their privacy policy governs payment data.
Email delivery: Resend delivers transactional email (lead notifications, password resets, billing receipts, support-ticket updates) and, when a business asks, review-request email to that business's customers. Review-request email includes an unsubscribe link.
AI generation: OpenAI (LLM inference for site copy and SEO content) and fal.ai (image generation). They receive the business intake and the site and service details needed to write pages and articles. They do not receive lead contact details, call recordings, text messages, or payment card data for that work.
Voice and messaging (once the AI receptionist is connected): Telnyx provides phone numbers and carries voice calls and SMS, and Retell powers the AI voice agent that answers and transcribes calls. They receive the call audio, transcripts, text message content, and the participating phone numbers needed to deliver these features. Retell runs the conversation and writes the call summary on language models from OpenAI or Google that we choose, and may pass call audio or a transcript to its own speech and voice vendors. They do not receive your payment information. Telnyx also receives the legal name, address, and employer identification number (or a sole proprietor's name and mobile number) submitted to register a texting campaign.
Bot checks: Cloudflare Turnstile checks sign-up, sign-in, password reset, and the demo call on fasite.org. It receives the visitor's IP address and browser data needed to run that check.
Reviews and fonts: Monid and Apify fetch a business's public Google reviews for us. Google Fonts receives a visitor's IP address when a customer site loads fonts.
Legal and safety: we may disclose information if required by law, subpoena, court order, or to prevent fraud or abuse.
Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred subject to the same protections described here.

Phone numbers and text messaging

We do not sell personal information. We do not sell, rent, or share mobile phone numbers, or text-message opt-in data and consent, with third parties or affiliates for their marketing or promotional purposes. Phone numbers and text consent are used only to provide the service, for example so a business can text its own customers about visits, estimates, and invoices. Text messaging originator opt-in data and consent will not be shared with any third parties, except the service providers that deliver our calls and texts (such as our phone provider, Telnyx, and the mobile carriers), which may use it only to provide that service. All of the categories of sharing described in this policy exclude text messaging originator opt-in data and consent.

6. Cookies and Tracking Technologies

Fasite uses two categories of cookies:

Strictly necessary cookies: Supabase session cookies used for sign-in and authentication (see Section 3c). These cannot be disabled without breaking sign-in.
Analytics cookies: the Google Analytics 4 cookies named _ga and _ga_EEK3YPS73T on fasite.org, described in Section 3c. We use Google Analytics only to understand traffic and usage. We have not linked it to Google Ads and we do not use it to build advertising audiences. Google signals is on, so Google may associate visits with a signed-in Google account as described in Section 3c.

You can opt out of Google Analytics by adjusting your browser's cookie settings, using a browser extension such as the Google Analytics Opt-out Browser Add-on. Google describes how Google uses data from sites that use its services. We do not run advertising pixels, including Meta's, on fasite.org or on customer websites. We do not currently change analytics behavior in response to a Global Privacy Control signal.

If we add advertising or marketing cookies in the future, we will update this policy and present a cookie consent prompt to visitors in jurisdictions that require one (e.g. EU ePrivacy).

7. Data Retention

Sign-in account: your login (name, email, and password hash or Google sign-in) is kept while it exists. Closing a business does not by itself delete it. Email privacy@fasite.org to have it deleted.
Business intake and generated site content: retained while your subscription is active. When a subscription ends, the site goes offline and we keep the business's records for 180 days in case you come back. We then mark the business deleted, and our weekly cleanup removes it about 30 days later.
Leads (visitor submissions): kept while the business keeps them. Archiving a customer hides the record. It does not by itself delete it. After the business account is closed, these records are removed with the business on the schedule above.
Call recordings, transcripts, and text messages: kept to provide the service and to meet legal obligations. Recordings and transcripts held by our voice provider, Retell, are kept while the account is active. When a business account is closed we delete that business's call records, including the copies held by Retell, on the deletion schedule above. Telnyx keeps its own call and message records under its policies.
Text-consent records a business keeps: the number, the words shown, when the person agreed, and, for a website form, the IP address and browser. These are kept for at least four years, including after the person is archived or the business account is closed, because a carrier or a regulator may ask for them. The product does not delete that proof on the same schedule as the message contents. Your own agreement to Fasite's account texts is removed when you turn those texts off.
Billing records: retained as long as required by tax and accounting law (typically 7 years in the US).
Audit logs: retained indefinitely for security and compliance purposes; access is limited to operations personnel.
Server access logs: retained by Vercel and Render per their policies (typically 30 to 90 days).

8. Security

We use industry-standard safeguards including TLS encryption in transit, encrypted-at-rest databases through Supabase, scoped service-role credentials, row-level security policies on customer-data tables, and password hashing via Supabase Auth.

Access to personal information, including lead contact information, is restricted to authorized personnel on a need-to-know basis and is recorded in administrative access logs. To help with support, Fasite staff can open a business's dashboard as its owner. Each time is recorded in the same logs.

No system is perfectly secure; we will notify affected users without undue delay (and within statutory windows where applicable) in the event of a personal-data breach.

9. International Data Transfers

Fasite is based in the United States and serves only businesses located in the United States. Our database and API servers run in US data centers (Supabase and Render, US East). If you reach Fasite or a Fasite-hosted site from outside the US, your data is processed in the US.

10. Your Privacy Rights

10a. Everyone

Regardless of location, you can email privacy@fasite.org to request a copy of the personal information we hold about you, to correct inaccurate information, or to request deletion. We will verify your identity before acting on requests that involve personal data.

10b. European Economic Area, UK, and Switzerland (GDPR / UK GDPR)

You have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Erase your data (the "right to be forgotten")
Restrict processing
Object to processing based on legitimate interest
Data portability (receive your data in a portable format)
Withdraw consent at any time, where consent was the basis
Lodge a complaint with your national data protection authority

Fasite does not currently appoint an EU representative because we do not specifically target the EU market. We will appoint one if we cross the GDPR Article 27 threshold or expand to EU-focused operations.

10c. California (CCPA / CPRA)

California residents have the right to know what personal information we collect, the right to delete it, the right to correct it, the right to opt out of sale or sharing (we do not sell personal information; Google signals is described in Section 3c and Section 11), the right to limit use of sensitive personal information, the right to non-discrimination for exercising these rights, and the right to data portability.

Categories of personal information collected in the past 12 months: identifiers (name, email, phone, address, and, for texting registration, an employer identification number or a sole proprietor's name), commercial information (subscription details, invoices, and payments a business records), internet activity (authentication session, request metadata, and the IP address and browser stored with a website form's text consent), audio and electronic message information (call recordings, transcripts, and text contents), professional information (business attributes and crew records), and customer records (property addresses and the name typed on an estimate approval). We do not collect biometric, health, or precise geolocation data. We record calls, but we do not create voiceprints or use anyone's voice to identify them.

To exercise California rights, email privacy@fasite.org with the subject "California Privacy Request".

10d. Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, and Maryland have similar rights under their respective state privacy laws. Send requests to the same email with your state and the action you want taken.

11. Do Not Sell or Share My Personal Information

Fasite does not sell personal information. Phone numbers and text consent are not sold or shared for marketing; see Phone numbers and text messaging. We use Google Analytics only to understand traffic and usage. We have not linked it to Google Ads, we do not use it to build advertising audiences, and we do not run advertising pixels. Google signals is turned on, so Google may associate visits with a signed-in Google account that allows ad personalization, as described in Section 3c. We do not offer a separate "Do Not Sell or Share My Personal Information" link for advertising we run, because we do not run that advertising. If we start sharing personal information for our own cross-context advertising, we will update this policy and provide that link before such sharing begins.

12. Children's Privacy

Fasite is intended for business owners and is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, email privacy@fasite.org and we will delete it.

13. Third-Party Links

Fasite-built sites and our marketing pages may link to third-party websites. We are not responsible for the privacy practices of those sites; check their respective policies.

14. Automated Decision-Making

Fasite uses AI models to create website content and up to two articles a week, and, once the AI receptionist is connected, to answer calls, summarize them, and book a visit. Booking a visit or filing a lead does not decide credit, insurance, employment, or eligibility for a public service. The business can confirm, decline, reschedule, or archive the result, and can take an article down. You can ask us to review AI-generated content on your site through our contact form.

15. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. For material changes, we will provide reasonable advance notice by email to active customers and a banner on the marketing site. Continued use after the effective date of an update constitutes acceptance.

16. Contact Us

Privacy questions, data requests, or complaints: privacy@fasite.org
Legal notices, DMCA, or contract questions: legal@fasite.org
General account or product help: our contact form

See our Terms of Service for the contract terms governing use of Fasite.