This Privacy Policy describes how DropFly Inc. ("DropFly," "we," "us," or "our"), operating the SiteFly service at siteflypro.com(the "Service"), collects, uses, shares, and protects information about you. By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.
1. Information we collect
Information you provide
- Account information — your name, email address, and password when you create an account. Passwords are stored in hashed form by our authentication provider; we never see or store your plaintext password.
- Business information — the business name, address, phone number, hours, service descriptions, photos, videos, and other content you provide (or approve) for the website we build and host for you.
- Payment information — payments are processed by Stripe, Inc.Your full card number never touches our servers. We receive and store only a payment reference (such as a Stripe customer ID, subscription status, and plan) needed to operate your account. Stripe's handling of your data is governed by Stripe's Privacy Policy.
- Communications — messages you send us by email or through forms on the Service.
Information collected automatically
- Usage and analytics data — pages visited, approximate location (from IP address), device and browser type, and referral source, collected via privacy-focused analytics (Vercel Analytics) to understand and improve the Service.
- Cookies and similar technologies — we use strictly necessary cookies to keep you signed in and to secure the Service (for example, authentication session cookies). We do not sell advertising or run third-party ad trackers.
- Server logs — standard technical logs (IP address, timestamps, request paths) retained for security and debugging.
Publicly available business data
To prepare a website preview, we may collect publicly available information about a business — such as its name, address, phone number, hours, and reviews — from sources including the Google Places API and the business's existing public website or profiles. This data is used solely to build and propose a website for that business and is handled in accordance with the source provider's terms.
AI features
Parts of the Service use artificial intelligence, including website generation, an AI editing assistant, website chat widgets, and (on certain plans) an AI phone receptionist. Content you submit to these features — such as edit instructions, chat messages with a website's AI assistant, or voice interactions — is processed by our AI infrastructure providers (including Anthropic) to deliver the feature. We do not permit these providers to use your content to train their generally available models. Do not submit sensitive personal information (such as health, financial account, or government ID information) through AI chat or voice features.
2. How we use information
- To create, host, maintain, and improve your website and account;
- To process payments, subscriptions, and refunds;
- To communicate with you about your account, your website, service updates, and — where permitted — product offers (you can opt out of marketing emails at any time);
- To provide customer support;
- To monitor, secure, and debug the Service, and to prevent fraud and abuse;
- To comply with legal obligations.
3. Visitor data on websites we host
Websites we build and host for customers may collect information from their visitors — for example contact-form submissions, booking requests, page-view counts, and AI chat conversations. For that data, our customer (the business) is the controllerand DropFly acts as a service provider/processor: we collect, store, and forward that information to the business the website belongs to, and use it only to operate the website's features. Visitors should direct privacy requests about a hosted business website to that business.
4. How we share information
We do not sell your personal information. We share it only with:
- Service providers that host and operate parts of the Service on our behalf — including Vercel (hosting and analytics), Supabase (database, authentication, and file storage), Stripe (payments), Resend (transactional email), Google (Places API), and Anthropic and other AI infrastructure providers (AI features) — each bound to use the data only to provide their service to us;
- Professional advisors and authorities where required by law, to enforce our terms, or to protect the rights, safety, or property of DropFly, our customers, or others;
- A successor entity in connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your data.
5. Data retention
We keep your information for as long as your account is active and as needed to provide the Service. After cancellation, we may retain certain records (such as invoices and payment history) as required for tax, accounting, and legal purposes, and we delete or anonymize the rest within a reasonable period. Website codebases delivered to you under a buy-out or custom build are yours; download links we issue may expire, so keep your own copy.
6. Security
We use industry-standard safeguards: encryption in transit (TLS), encrypted storage with our infrastructure providers, hashed passwords, row-level access controls in our database, and webhook signature verification for payment events. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security; if we learn of a breach affecting your personal information we will notify you as required by law.
7. Your rights and choices
Depending on where you live (including under the California Consumer Privacy Act and similar laws), you may have the right to:
- Access the personal information we hold about you;
- Correct inaccurate information;
- Delete your personal information;
- Receive a portable copy of your data;
- Opt out of marketing communications (use the unsubscribe link in any marketing email);
- Not be discriminated against for exercising these rights.
To exercise any of these rights, email hello@dropfly.io. We will verify your request and respond within the time required by applicable law. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under California law.
8. Children
The Service is a business tool and is not directed to children under 13 (or under 16 where a higher age applies). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.
9. International users
The Service is operated from the United States and information is processed on servers in the United States. If you use the Service from outside the U.S., you consent to the transfer and processing of your information in the U.S., where data-protection laws may differ from those in your jurisdiction.
10. Changes to this policy
We may update this policy from time to time. If we make material changes we will update the "Last updated" date above and, where appropriate, notify you by email or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
11. Contact us
DropFly Inc. — SiteFly
Email: hello@dropfly.io