Effective date: 1 August 2026

1. About this policy

This Privacy Policy explains how SiteAction (“SiteAction”, “we”, “us” or “our”) processes personal data when you visit our website, create an account, use the SiteAction service, contact us, or connect a third-party service. SiteAction is operated by the service provider identified in your SiteAction agreement. For privacy questions, contact siteaction@itbs.net.

This policy should be read with your organisation’s agreement with us and any notices shown when you connect Google, Shopify, GA4 or another integration. It is not a substitute for the privacy notices of those providers.

2. Our role

We are generally the data controller for SiteAction account, contact, billing, security and service-administration information. When a tenant connects its own website, search, analytics or Shopify data, that tenant will usually remain the controller of the business data it provides or makes available, and SiteAction will process that data on the tenant’s documented instructions as a service provider or processor. The tenant is responsible for having the necessary rights, notices and permissions to connect its systems and provide that data to SiteAction.

3. Information we collect

Depending on how the service is used, we may process the following categories of information:

• Account and identity information: name, email address, password hash, two-factor authentication settings, profile image, account role, invitations and account activity.
• Organisation information: tenant name, contact details, business address, website name, primary domain, platform type and service-plan information.
• Website and SEO information: URLs, page titles, descriptions, page content, crawl findings, technical signals, PageSpeed results, SEO recommendations, reports, implementation tasks and approval history.
• Google Search Console information: selected property details and imported performance data such as dates, pages, queries, devices, countries, clicks, impressions, click-through rate and average position.
• Google Analytics information: selected GA4 property information and, only when an authorised user enables it, page-level sessions, engagement, conversions and recorded revenue used as outcome evidence. SiteAction does not use GA4 data as proof that a recommendation caused a result.
• Shopify information: shop domain, shop identity, products, collections, pages, articles, SEO fields, content, webhook events and update-draft history that the connected Shopify store permits us to access.
• AI and support information: prompts, evidence, page content and recommendation context submitted for AI-assisted drafting, plus messages and contact details submitted through our contact form or support channels.
• Technical and security information: session identifiers, authentication and audit events, approximate request information, IP address and security logs where needed to protect the service and investigate abuse.

4. How we collect information

We collect information:

• directly from you when you register, update your profile, contact us or use SiteAction;
• from your organisation or an administrator who invites or manages your account;
• from connected providers when you authorise an integration and select a property or shop; and
• automatically through essential session, security and operational logging.

5. Why we use information

We use information to:

• create and administer accounts, tenants, permissions and subscriptions;
• authenticate users, provide two-factor security, prevent fraud and protect the service;
• connect to authorised Google, Shopify, GA4 and other providers;
• import and analyse SEO, search, analytics and technical evidence;
• generate, store and explain evidence-backed recommendations and AI-assisted drafts;
• create reviewable implementation tasks and Shopify update drafts, subject to approval controls;
• measure changes after implementation and produce reports;
• provide support, respond to enquiries and improve reliability; and
• meet legal, accounting, security and regulatory obligations.

6. Legal bases

Where UK or European data-protection law applies, our legal basis will normally be performance of a contract, our legitimate interests in operating and securing the service, compliance with a legal obligation, or consent where we ask for it. For example, optional GA4 conversion evidence requires an authorised user to enable the relevant evidence and select the events that may be used. You may withdraw that consent through the available service controls or by contacting us, although this does not affect processing that occurred before withdrawal.

7. AI-assisted processing

If AI features are enabled, SiteAction may send relevant page, search, crawl, analytics and recommendation context to our configured AI service provider to generate a structured draft or recommendation. We send only the context needed for that request, treat connected website content and search queries as untrusted evidence, and do not permit an AI response to publish changes directly to Shopify. AI output must be reviewed by an authorised user and may be incomplete or incorrect.

8. Who we share information with

We may share or make information available to:

• hosting, database, backup, monitoring, security and email providers that support SiteAction;
• Google, Shopify, GA4, PageSpeed Insights and other providers selected by an authorised user;
• our configured AI provider when AI-assisted features are used;
• payment and billing providers where a plan or payment feature is enabled;
• professional advisers, auditors, insurers or purchasers where reasonably necessary and lawful; and
• public authorities or other parties where required by law, court order or to protect rights and safety.

We do not sell personal data. We do not use connected Search Console, GA4 or Shopify data for unrelated advertising.

9. International processing

Some service providers may process information outside the UK or European Economic Area. Where required, we use an adequacy decision, standard contractual clauses, the UK International Data Transfer Addendum, or another lawful safeguard. Provider-specific processing is also governed by the relevant provider’s terms and privacy notice.

10. Security

We use access controls, authentication protections, session security, two-factor authentication where enabled, HTTPS, encrypted storage for integration credentials and audit logging appropriate to the service. No internet service can guarantee absolute security. You must keep credentials, recovery codes and connected-provider permissions secure and tell us promptly about suspected unauthorised access.

11. Retention

We retain information only for as long as reasonably necessary for the purposes described in this policy, including providing the service, maintaining audit and security records, resolving disputes and meeting legal or accounting obligations. Account and integration information is generally retained while the account or tenant service remains active. Disconnecting an integration stops new access but does not automatically delete historical records already imported into SiteAction.

SiteAction may archive older Search Console data according to the tenant’s selected history window and plan. Archived Search Console rows are normally eligible for permanent deletion after 90 days. Session and temporary authentication data expire according to the service configuration. When an account or tenant is closed, we will delete or anonymise information when reasonably practicable, subject to legal, security, backup and dispute-retention requirements.

12. Your rights

Subject to applicable law, you may ask for access to, correction of, deletion of, restriction of, or portability of your personal data, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent. Tenant business data may need to be requested through the tenant organisation that controls it. To make a request, email siteaction@itbs.net. We may need to verify your identity and may retain a limited record of the request.

If you are in the UK and remain unhappy with our response, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. If you are in the EEA, you may contact your local data-protection authority.

13. Cookies and similar technologies

SiteAction uses an essential session cookie to keep users signed in, protect forms and maintain secure authentication. We do not currently use non-essential advertising cookies. If optional third-party features are added, we will update this policy and provide any consent choices required by law.

14. Children

SiteAction is a business service and is not directed to children. Do not create an account or submit information if you are not authorised to do so.

15. Changes to this policy

We may update this policy when the service, law or our processing changes. We will publish the updated version here and change the effective date. Where a change is material, we will provide additional notice where reasonably practicable.

16. Contact

Privacy requests and questions should be sent to siteaction@itbs.net.