Privacy Policy
Last updated: September 20, 2026
This Privacy Policy explains how Sitein72 handles personal data when you visit the Sitein72 website, create an account, buy a service, complete onboarding, contact support or use the client portal.
1. Data controller
For personal data collected directly through the Sitein72 marketing website, account, checkout administration, onboarding and support processes, the controller is Amortoae Petru PFA, CUI 52361814, Reg. Com. F20/2503/0447007, Sibiu, Romania, Romania. Privacy requests can be sent to info@sitein72.com.
2. Personal data we may collect
- Account data: email address, optional username, name, role, authentication and session information. If you create a password, Sitein72 stores only a salted cryptographic password hash, not the plaintext password.
- Order and billing administration: Stripe customer/subscription identifiers, payment status, invoice/event metadata, currency and amounts. Complete card numbers are handled by Stripe and are not stored in the Sitein72 application database.
- Onboarding data: business name, legal business name, services, target customer, public contact details, domain, service area, business hours, brand preferences, page requests, legal-page choices, supplied links and project notes.
- Project data: project status, preview/live URLs, hosting status, maintenance dates, backup status and mailbox information.
- Support and revision data: support messages, revision requests and Sitein72 replies.
- Consent and contractual records: acceptance of scope, recurring billing, terms, onboarding confirmations and legal-page acknowledgements.
- Security and technical data: login-token records, session data, cryptographic hashes derived from login identifiers/IP addresses for rate limiting and abuse prevention, email-delivery logs and administrative audit records.
- Analytics data: only where optional analytics are enabled and the required consent has been given.
3. How data is collected
We collect data directly from you when you enter it, from service providers when they report billing or infrastructure events, and automatically through necessary technical logs, session mechanisms and optional analytics where enabled.
4. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Create and operate your account; process onboarding; build, host and support your website. | Performance of a contract or steps taken at your request before entering a contract. |
| Process billing, invoices, cancellations and payment-status administration. | Performance of a contract and compliance with legal/accounting obligations. |
| Protect accounts, prevent abuse, investigate incidents and maintain audit trails. | Legitimate interests in security, fraud prevention and service integrity; legal obligations where applicable. |
| Respond to legal requests, tax/accounting duties and disputes. | Compliance with legal obligations and establishment/exercise/defense of legal claims. |
| Optional analytics. | Consent where consent is legally required. |
5. Payment data
Stripe processes checkout and payment-card information. Sitein72 receives identifiers and status information needed to administer the subscription and display billing information. Stripe's own privacy terms apply to the data it collects as an independent service provider/controller where applicable.
6. Hosting, database and email infrastructure
Sitein72 may use Hostinger for MySQL database hosting, website hosting, backups and email infrastructure. Data stored in the Sitein72 application or on hosted client websites can therefore be processed through Hostinger infrastructure as necessary to provide the service.
7. Other service providers
We may use payment processors, hosting companies, transactional email providers, analytics providers, security tools and professional advisers. Providers receive only the data reasonably needed for their role and are subject to applicable contractual or legal obligations.
8. Client website visitor data
When Sitein72 hosts a client's business website, the client generally determines why and how visitor data collected through that website is used. Depending on the processing activity, the client may act as controller/business and Sitein72 may act as processor/service provider for hosting, backup or support activities. The client's own privacy policy should describe its visitor-data practices.
If a particular client requires a data processing agreement or additional processor terms, those can be addressed separately where appropriate.
9. International transfers
Some service providers may process data in countries other than Romania or the country where the user is located. Where cross-border transfer rules apply, Sitein72 relies on the transfer mechanisms, contractual safeguards or adequacy arrangements made available by the relevant provider and required by applicable law.
10. Retention
We keep personal data only for as long as reasonably needed for the purpose for which it was collected, to provide the service, maintain security, handle disputes and comply with tax, accounting and other legal obligations.
- Active account, onboarding and project records are generally retained while the account/service is active.
- After cancellation, a hosted website export or recovery copy is intended to remain available for up to 30 days, subject to provider, security, legal and technical limitations.
- Billing, invoice and accounting records may be retained longer where required by law.
- Security, audit and fraud-prevention records may be retained for a reasonable period proportionate to the risk and legal requirements.
- When a portal account is deleted, application records linked by database cascade are removed, while limited non-identifying deletion logs and external records that must lawfully be retained may remain.
11. Account deletion
Clients can use the account-deletion function in the portal where available. The deletion flow requires confirmation and removes the associated Sitein72 application account data subject to legal retention needs. Deleting an account does not require Stripe, tax authorities or other independent providers to erase records they are legally entitled or required to retain.
12. Cookies and local storage
Sitein72 uses necessary authentication/session technology and a local-storage preference for cookie choices. Optional analytics are loaded only after the relevant choice where required. Details are in the Cookie Policy.
13. Security
Sitein72 uses measures such as HTTP-only session cookies, salted scrypt password hashing, one-time authentication tokens, login rate limiting, role-based access controls, encrypted application secrets, administrative audit logging and established infrastructure providers. No internet service can guarantee absolute security.
Do not place passwords, payment-card numbers, government identifiers, health information or other unnecessary sensitive data into ordinary onboarding or support fields.
14. Your data-protection rights
Depending on your location and the applicable law, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. Withdrawal of consent does not affect processing that was lawful before withdrawal.
To make a privacy request, email info@sitein72.com. We may ask for reasonable information to verify the account before acting on a request.
15. Right to complain
If GDPR applies, you may lodge a complaint with a competent supervisory authority. In Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP), whose official website is dataprotection.ro. You may also have the right to complain to the supervisory authority in the EU/EEA country where you live or work.
16. Automated decision-making
Sitein72 does not use account or onboarding data to make solely automated decisions that produce legal or similarly significant effects on clients.
17. Children's data
Sitein72 is a business website service and is not directed to children. We do not knowingly solicit orders from children who are not legally able to enter the relevant contract.
18. Legal requests and business transfers
We may disclose data where reasonably necessary to comply with law, enforce rights, protect security, respond to lawful authority requests, or in connection with a business reorganization or transfer, subject to applicable legal safeguards.
19. Changes to this policy
We may update this policy when the service, providers or legal requirements change. The current version and update date will be shown on this page. Material changes will be communicated where required.
20. Contact
Privacy questions and requests: info@sitein72.com.
21. AuditIn72 in ChatGPT
AuditIn72 is a website-audit workflow used in ChatGPT. It can work with the website URL you provide, optional information about the website's purpose, public website content and technical observations, and reports or excerpts you choose to supply. Its results may include inspected URLs, capture dates, evidence, scores, limitations, and recommended improvements.
These inputs and results are handled in ChatGPT and the browsing, file, or inspection tools available in the conversation. AuditIn72 has no separate publisher-operated audit server, lead-submission endpoint, or user database. It does not automatically send your conversation, website URL, audit report, or contact details to Sitein72. Sitein72 does not receive access to your ChatGPT conversation simply because you use the plugin.
ChatGPT and any browsing or external tools used to inspect a website have their own data-handling practices and controls. Website inspection can involve ordinary requests to the websites being reviewed. This section does not replace the policies of ChatGPT, those tools, or the websites you visit.
You do not need to provide your name, email address, phone number, or credentials to unlock an AuditIn72 report. Please avoid including personal or confidential information that is unnecessary for the audit, and do not provide passwords or access tokens.
If you voluntarily contact Sitein72 about AuditIn72, we receive the information you include in your message, such as your email address, your support question, and any report excerpts or files you choose to share. We use that correspondence to handle your request under the existing support-data purposes, service-provider arrangements, safeguards, and retention rules described in this Privacy Policy. Support and email-delivery providers may process that correspondence as described in the policy.
There is no automatic Sitein72 archive of reports generated through the plugin. Support correspondence that you choose to send is retained under the existing purpose-based retention rules in this policy, including responding to requests and meeting applicable security, dispute-resolution or legal needs. We do not apply the hosted-website export/recovery period to ChatGPT audit reports.
For requests concerning information you have sent directly to Sitein72, contact info@sitein72.com using the rights and request process described in this Privacy Policy. Information kept in your ChatGPT account or by another tool is subject to that provider's controls and request process; contacting Sitein72 does not delete a ChatGPT conversation.