Privacy Policy

1. Who we are

XSiteBuilder is operated by Steve Haase DBA AttentionSoft (“we”, “us”), based in Nevada, USA. This policy explains how we handle personal information when you use XSiteBuilder: the dashboard, editor, Help Center and our emails. It also explains how we handle information from people who visit websites built with XSiteBuilder. It should be read with our Terms of Service.

For your account information, we decide how it’s used (we are the “controller”). For information that visitors submit through your websites, you are the controller, and we process it on your behalf (see section 4).

2. Information we collect

Information you give us

• Account details: your name, email address and password. We store your password only as a secure one-way hash (bcrypt), so we never know what it is.
• Workspace and team details: workspace names, and the email addresses of people you invite. We also store each member’s role.
• Your content: the sites, pages and templates you create, and the images and files you upload. We also keep reusable blocks, page version history (the last 30 versions of each page), site settings and custom domain names.
• Connected services: if you connect your own mail server or email account for contact forms, we store its settings and password. If you turn on AI site generation, we store your AI provider’s API key. Both the password and the API key are encrypted (AES-256-GCM) and never shown back in your browser.
• Support messages: anything you send us by email or through our help desk.

Information from payments

Paid plans are bought through ThriveCart, which uses its own payment processors. They handle your card details. We never receive your full card number. ThriveCart tells us your name, email address, the product you bought, your order or subscription reference and changes to your subscription status, so we can set your plan.

Information collected automatically

• Activity in the app: when you last signed in and were active. We also log account events, such as creating a site, publishing, saving a page, uploading a file and inviting a member. We use these records for your activity feed, for support and to keep the Service secure.
• Technical information: like most websites, our servers process your IP address, browser type and the pages you request. We use this to deliver pages, prevent abuse (for example, limiting repeated contact-form submissions) and fix problems. Our servers may keep this in their logs for a limited time.
• Cookies: we use only essential cookies. xsb_session keeps you signed in for up to 30 days, or until you sign out. xsb_admin_return is used only when one of our administrators is signed in to your account to help you. We don’t use advertising cookies, cross-site tracking or third-party analytics.
• Bot protection: our sign-up, sign-in and password-reset forms may use Google reCAPTCHA to tell people from bots. reCAPTCHA collects hardware and software information, such as device and browser data, and may set its own cookies. It sends this to Google, which uses it under the Google Privacy Policy and Terms of Service.

3. How we use your information

• to provide the Service: run your account, save your work, publish and host your sites, and serve them over HTTPS;
• to manage your plan and payments, and to apply plan limits;
• to send account emails, such as welcome emails, password resets (the links expire after 2 hours), team invitations (they expire after 7 days), contact-form notifications and important notices about the Service;
• to send product news and offers. Every one of these emails has an unsubscribe link, and unsubscribing doesn’t stop account emails;
• to give support. With your request or permission, or when we need to investigate a problem or abuse, an administrator may sign in to your account to see what you see. These sessions are logged;
• to keep the Service secure, prevent fraud and spam, and enforce our Terms;
• to understand how the Service is used and improve it;
• to meet legal obligations.

If you’re in the European Economic Area or the UK, our legal bases are: performing our contract with you, our legitimate interests in running a secure and useful service, your consent (which you can withdraw at any time), and complying with the law.

4. Visitors to websites built with XSiteBuilder

When someone visits a site published with XSiteBuilder, our servers deliver the pages and process the visitor’s IP address and browser information, as any web host does. XSiteBuilder doesn’t add tracking or advertising cookies to published sites. Pages with a contact form may load Google reCAPTCHA to block spam, which sends device and browser information to Google as described in section 2. However, a site owner may add their own scripts, such as analytics, chat or embedded videos. The site owner is responsible for those.

When a visitor sends a message through a site’s contact form, we store the fields they filled in. We also store the page it was sent from, the time and their IP address (to help prevent spam). We then email the message to the site owner. We handle these messages only on the site owner’s behalf and don’t use them for our own purposes. If you visited a site built with XSiteBuilder and have a question about your information, please contact the owner of that site. They can see and delete your message. If you can’t reach them, email us and we’ll pass your request on.

5. Who we share information with

We don’t sell your personal information, and we don’t share it for targeted advertising. We share it only:

• With service providers who help us run XSiteBuilder, under their own privacy and security commitments. These are our server and storage hosting providers, our email delivery provider, ThriveCart and its payment processors, and our help desk provider.
• With Google, when reCAPTCHA runs on a form, to check that it’s being used by a person (see section 2).
• With Let’s Encrypt, which receives the domain names of published sites in order to issue their free HTTPS certificates.
• With services you connect. If you use AI site generation, the details you enter in the AI form are sent to the AI provider you chose (such as OpenAI or Anthropic) using your own API key. If you connect your own mail server, contact-form emails are sent through it.
• Within your workspace: members of a workspace can see its sites, files and form messages, according to their role.
• For legal reasons: if the law requires it, or to protect the rights, property or safety of our customers, the public or us.
• In a business transfer: if the business is sold or reorganized, your information may transfer to the new owner, who must keep honoring this policy.

6. How long we keep information

• Account information and content are kept while your account is open.
• Page version history keeps the last 30 versions of each page, and older versions are removed automatically.
• Contact-form messages are kept until you delete them or your site or account is deleted.
• Password-reset links and invitations stop working when they expire.
• When an account is closed, we delete its data within 30 days. Copies in our backups are removed as those backups expire. We keep records we must hold by law, such as payment records, for as long as the law requires.

7. How we protect information

All traffic to XSiteBuilder and its published sites uses HTTPS. Passwords are hashed. Stored API keys and mail passwords are encrypted. Sign-in cookies can’t be read by page scripts, and access to our servers is restricted. No system is perfectly secure, so if we ever learn of a breach that affects your information, we’ll tell you as the law requires.

8. Your choices and rights

• Download your sites at any time as a .zip of static HTML.
• Delete pages, sites, files and form messages yourself in the app. To close your account and delete all of its data, email admin@attentionsoft.com from the address on the account.
• Unsubscribe from product news and offers with the link in any of those emails.
• Ask us for a copy of your information, or ask us to correct or delete it. Depending on where you live, you may also have the right to restrict or object to how we use it, to receive it in a portable format, and to complain to your local data protection authority.
• California residents: you have the right to know what we collect, and to ask us to delete or correct it. We don’t sell or share personal information as those terms are defined in California law, and we won’t treat you differently for using your rights.

To use any of these rights, email admin@attentionsoft.com. We may need to confirm your identity first, and we’ll respond within 30 days, or sooner if the law requires.

9. International users

We’re based in the United States. Your information may be processed in the United States and in other countries where our service providers operate, which may have different data protection laws from your country. Where the law requires it, we use appropriate safeguards for these transfers.

10. Children

XSiteBuilder is for adults running businesses and projects. Account holders must be at least 18, and we don’t knowingly collect information from children. If you believe a child has given us personal information, email us and we’ll delete it.

11. Changes to this policy

We may update this policy as XSiteBuilder changes. We’ll update the “Last updated” date above. If the changes are significant, we’ll also let account owners know by email or with a notice in the app before they take effect.

12. Contact us

Questions or requests about privacy:
Steve Haase DBA AttentionSoft
Email: admin@attentionsoft.com