Privacy Policy

1. Introduction

SiteYak ("we", "us", or "our") operates the SiteYak service, which provides AI-powered chat widgets for websites. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our service, either as a site owner (customer) or as a visitor to a website that has installed the SiteYak widget.

Please read this policy carefully. By using SiteYak, you agree to the practices described here. If you do not agree, please discontinue use of the service.

2. Information we collect

2.1 Information you provide (site owners)

• Account information: your name and email address. If you choose to set a password, we store a one-way cryptographic hash of it — never the password itself. You may instead sign in with a one-time link sent to your email.
• Billing information: payment card details processed securely by Stripe. We do not store card numbers.
• Site configuration: your website URL, branding choices, and widget settings.
• Content you index: the text content of pages you choose to index.

2.2 Information collected automatically (site owners)

• Usage data: pages visited within the SiteYak dashboard, features used, and conversation counts.
• Log data: server logs including IP address, browser type, and access timestamps.
• Sign-in records: when you sign in to the dashboard we create a session record containing the IP address and browser user agent of that sign-in, so that you can identify and revoke unrecognised sessions.

2.3 Information collected from widget visitors

• Chat messages: the content of conversations initiated through the SiteYak widget. Chat messages are stored as sent. If a visitor types personal information into the chat, that information is stored with the conversation.
• Session identifiers: anonymous conversation identifiers stored in the visitor's browser sessionStorage to keep a conversation continuous across pages. They are not linked to any personal identity.
• SiteYak does not store visitor IP addresses or device identifiers in its own records. Your visitors' IP addresses are necessarily processed in transit by our hosting and network providers (Railway and Cloudflare) and may appear in their short-term operational logs.

3. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the SiteYak service.
• Process billing and send account-related communications.
• Generate AI-powered responses to visitor chat messages using the content you have indexed.
• Monitor service performance, detect abuse, and improve reliability.
• Send service notifications, including cap alerts and system updates.
• Comply with legal obligations.

We do not sell your data or use it for advertising purposes.

4. Data sharing and disclosure

We share data only as follows:

• OpenAI: Visitor questions and the content you index are sent to OpenAI's embedding API, which converts them into a numeric form so SiteYak can find the pages relevant to a question. OpenAI states that data submitted through its API is not used to train its models. See OpenAI's API data usage policy.
• Anthropic: Chat conversation content is processed by Anthropic's Claude API to generate responses. Anthropic states that data submitted through its API is not used to train its models. See Anthropic's Privacy Center.
• Railway: Our hosting and managed database provider. All data SiteYak stores — indexed content, conversations, and account records — is held on Railway infrastructure in the United States.
• Stripe: Billing and payment information is handled by Stripe. See Stripe's privacy policy.
• Resend: Transactional emails (account notifications, cap alerts) are sent via Resend.
• Cloudflare: Our CDN and network provider. Web traffic may pass through Cloudflare's network.
• Cloudflare Turnstile: our contact and early-access forms use Cloudflare Turnstile to detect automated submissions. Your IP address and limited browser information are sent to Cloudflare for verification. Turnstile is subject to the Cloudflare Privacy Addendum.
• Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of SiteYak, its customers, or the public.

5. AI processing

SiteYak uses two AI providers to answer visitor questions. When a visitor sends a message, that message is first sent to OpenAI's embedding API, which converts it into a numeric form so SiteYak can find the pages of your site that are relevant to it. The message and those pages are then sent to Anthropic's Claude API to produce a response.

Both providers state that data submitted through their APIs is not used to train their models. SiteYak does not use your conversations to train any model. You can review their data handling practices at OpenAI's API data usage policy and Anthropic's Privacy Center.

As a site owner, you are responsible for ensuring that the content you index and the use of AI-generated responses complies with applicable laws and your own terms of service.

6. Cookies and tracking

The SiteYak dashboard sets one cookie, sy_session, on app.siteyak.ai. It holds your sign-in session, is marked HttpOnly and Secure so it cannot be read by scripts, and expires after 30 days or 7 days without use. The dashboard also stores the identifier of the last site you opened in browser localStorage (sy_last_site_id) and the status of any running crawl in sessionStorage, both purely as conveniences. We do not use third-party advertising or analytics cookies.

The SiteYak widget sets no cookies. It uses browser sessionStorage to keep a visitor's conversation in view as they move between pages, and it is cleared when the tab closes. The conversation itself is also stored on our servers, as described in section 2.3.

7. Data retention

• Conversation logs: retained for as long as your site is active. We do not currently operate an automatic deletion schedule; contact us to request deletion.
• Indexed content: retained until you delete the document from your dashboard or close your account.
• Account information: retained until you ask us to delete it. Account deletion is currently handled manually — contact us and we will remove your account and its data.
• Sign-in sessions and one-time sign-in links: sessions expire after 30 days, or 7 days without use; sign-in links expire 15 minutes after they are sent. Expired records are deleted automatically each night.
• Billing records: retained for as long as required by applicable law (typically 7 years).

8. Your rights

Depending on your location, you may have rights under applicable data protection law (including GDPR, UK GDPR, or the CCPA) including:

• The right to access personal data we hold about you.
• The right to correct inaccurate personal data.
• The right to request deletion of your personal data.
• The right to restrict or object to certain processing.
• The right to data portability.
• The right to withdraw consent where processing is based on consent.

To exercise any of these rights, please contact us at privacy@siteyak.ai. We will respond within 30 days.

9. International data transfers

SiteYak operates from, and processes data in, the United States. Data SiteYak stores is held with Railway in the United States. If you or your visitors are located elsewhere, your data will be transferred to and processed in the United States, and may also be processed by the sub-processors listed in section 4. We take steps to ensure appropriate safeguards are in place for any international transfers.

10. Children's privacy

The SiteYak service is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify site owners of material changes by email or by posting a notice in the dashboard. The updated policy will be effective as of the date shown at the top of this page. Continued use of SiteYak after any changes constitutes acceptance of the revised policy.

12. Contact us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact: