Privacy Policy

This policy explains how Site Hunts handles information when you use Site Hunts — the application at sitehunts.com and its dashboard.

It also explains, separately, what happens to information belonging to the businesses you research, and to visitors of websites you publish, because those people are not our users but their information passes through the Service.

Account information

Your name, email address and a password, which you give us when you register. The password is never stored: we keep only a PBKDF2-SHA256 hash with a random per-account salt, which cannot be reversed back into your password.

We also record the date and version of the Terms of Service and Privacy Policy you accepted at signup, so we have a record of what you agreed to.

Session information

When you sign in we create a random session token, store it against your account, and set it in a cookie. See Cookies below.

Your work in the app

Everything you create or save in the dashboard is stored against your account: saved leads and your notes on them, generated and edited websites, the contact and booking settings you configure for each site, pipeline stages, documents such as proposals, contracts and invoices, outreach drafts and a record of messages you sent, client portals you create, your plan and any billing history rows, and simple usage counters.

Business information you research

When you search, we retrieve information about local businesses — name, address, coordinates, category, published phone number, email address and website where the source has them, opening hours, social profiles and photographs. This comes from third-party sources, not from you. It is held in your account only for the businesses you save.

Integration credentials

If you connect a business’s booking or scheduling system, the credentials you enter are sent to the server and stored encrypted at rest. They are never held in your browser’s storage and are never returned to the browser after you save them.

Technical information

Site Hunts runs no analytics, advertising or tracking service, and we do not build behavioural profiles. Our hosting and database providers keep their own operational and request logs, which ordinarily include IP addresses and timestamps, under their own policies and retention periods.

• To create and run your account, sign you in, and keep your work available to you across devices.
• To provide the features you ask for — searching for businesses, checking website status, generating and editing sites, publishing them, drafting and sending outreach, and preparing documents.
• To keep the Service secure, to prevent abuse, and to enforce usage limits.
• To take payment when you buy a plan.
• To record which version of our legal documents you accepted.
• To meet legal obligations that apply to us.

When you successfully publish a website for a business, we record that business’s identifier from the underlying map data, its name and coordinates, the published web address, the time, and which account published it. This exists so the business is no longer offered as one without a website, to you or to any other user. Other users see only that a site exists; they are not shown who published it.

Site Hunts sets one cookie, sh_session, which holds your session token. It is strictly necessary: without it you cannot stay signed in. It is marked HttpOnly, so page JavaScript cannot read it, SameSite=Lax, and Secure in production. It expires after 30 days or when you sign out.

We set no advertising, analytics or tracking cookies, so there is no consent banner to dismiss.

Websites you publish are static pages. They set no cookies of their own, and they load web fonts from Google Fonts, which means a visitor’s browser makes a request to Google when the page loads.

We use third-party providers to operate the Service. Each receives only what it needs for its part of the work. Depending on how your installation is configured, these are:

• Database hosting (Neon) — stores accounts, sessions, your saved work and the published-site record.
• Application hosting and deployment (Vercel) — serves the application, and hosts the websites you publish.
• Map and business data (OpenStreetMap: Nominatim and Overpass) — receives your search terms and the area you search, and returns business listings.
• Business profiles (Google Places), when configured — receives a business name and coordinates to confirm its details and website.
• AI text generation (Anthropic) — receives the business information and instructions needed to draft copy, summaries and outreach messages.
• AI image generation (OpenAI, Google or Replicate), when configured — receives the image prompt describing the business and style.
• Email delivery (Resend, or an SMTP provider you configure) — receives the recipient address and message content for outreach you send and for submissions to forms on your published sites.
• Payments (Stripe) — takes payment on its own hosted page and tells us the outcome.
• Website checks — to judge whether a business has a working website, our servers make DNS lookups and ordinary web requests to candidate addresses. Those sites see a request from our infrastructure, not from you.

We do not sell your personal information, and we do not share it with anyone for their own advertising.

Payments are handled by Stripe on its own hosted checkout page. Your card number and security code are entered there and never reach Site Hunts’s systems. We receive the result of the payment and the plan it relates to.

Businesses in search results

Business contact details in the Service come from public sources such as OpenStreetMap and, where configured, Google. For a sole trader these details can be personal information. When you save a business, contact it, or publish a site for it, you are deciding how that information is used — which means you are responsible under the data-protection law that applies to you for having a lawful basis to do so, and for responding if that business objects.

People who use a published site’s form

A published website can carry a contact or reservation form. When a visitor submits it, the details they enter — typically a name, contact details, date, party size and a message — are passed through our server and delivered by email to the address configured for that site. The submission is not stored in a database; it exists in that email and in the logs our infrastructure providers keep. The business receiving it is responsible for what happens to it after delivery.

To stop the form being used to send mail to arbitrary addresses, the recipient address is signed by our server and the signature is verified before anything is sent.

We keep your account and the work in it for as long as your account exists, so that it is there when you come back. Sessions expire 30 days after they are created, and an expired session is deleted when it is next presented.

We do not currently operate an automatic deletion schedule for inactive accounts. If you want your account and its contents removed, ask us and we will delete them; see Your choices.

Two things outlive deletion of your account by design, and you should know about them before you publish: a website you published stays live at its public address until it is taken down at the host, and the published-site record for that business remains so the business is not re-offered as having no website. That record holds the business’s public details and the published address, not your personal information beyond the account identifier that published it. Our providers’ own logs and backups also follow their retention periods, not ours.

What we actually do:

• Passwords are hashed with PBKDF2-SHA256 at 210,000 iterations with a random 16-byte salt per account, and compared in constant time. The plain password is never stored or logged.
• Sessions use a 256-bit random token in an HttpOnly, SameSite=Lax cookie, Secure in production, so page JavaScript cannot read it.
• Every read and write of your work is scoped to the account in your session cookie, never to an identifier supplied in a request, so one account cannot ask for another's data.
• Integration credentials you save are encrypted at rest and are not sent back to the browser.
• Traffic to the application travels over HTTPS, and our database connection is encrypted in transit.
• API keys for the providers above are held server-side only and are never included in anything sent to a browser.

No system is perfectly secure, and we cannot guarantee that yours or anyone’s information will never be accessed without authorisation. If you believe your account has been compromised, change your password and tell us.

Site Hunts and its providers operate internationally, so your information may be processed in a country other than the one you live in — including the United States, where several of the providers listed above are based. Those providers may not offer the same protections as your home country’s law.

You can view and change your name and password in the dashboard, edit or delete individual leads, sites and documents at any time, and take your work with you by exporting any generated site as HTML.

Depending on where you live, you may have rights to request a copy of your personal information, to have it corrected or deleted, to object to or restrict how it is used, or to complain to your local data-protection authority. To make a request, write to support@sitehunts.com. We will need to be satisfied you are the account holder before acting on it.

Deleting an account is not yet a self-service button in the dashboard — ask us and we will do it for you.

Site Hunts is a business tool and is not directed at children. You must be at least 18 years old to hold an account. We do not knowingly collect information from anyone below that age; if you believe someone under 18 has created an account, tell us and we will remove it.

We will update this policy as the Service changes. The date at the top always identifies the current version, and the version you accepted at signup is recorded against your account. If a change materially affects how we use your information, we will give notice by email or in the app before it takes effect.

For anything in this policy — a question, a correction, or a request to delete your account:

• Email: support@sitehunts.com

See also our Terms of Service.