Privacy Policy

When you use SiteIntoApp, we collect the following categories of information: **Account data:** Name, email address, password hash (bcrypt), account creation date, and plan tier. **Project data:** Website URLs you paste, app configuration (package names, icons, version codes), build logs, and generated APK/AAB metadata. **Usage data:** Session events, page views within the admin panel, feature toggle interactions, and build trigger events. We use this to improve the product. **Payment data:** Processed entirely by Paddle. We do not store card numbers. We receive billing confirmation, subscription status, and invoice data from Paddle. **Crash & performance data:** Anonymous stack traces and performance metrics collected from the admin panel UI.

We use the information we collect to: • Provide and improve the SiteIntoApp platform • Process builds and deliver APK/AAB downloads • Send transactional emails (build completion, billing receipts) • Send product updates and feature announcements (opt-out available) • Monitor for abuse and enforce our Terms of Service • Analyze aggregate usage patterns to guide product development • Respond to support requests

We retain account data for as long as your account is active. Build artifacts (APK/AAB files) are retained for 90 days. Build logs are retained for 30 days. Analytics data is retained for 14 months in aggregated form. When you delete your account, we delete personal data within 30 days, except where retention is required by law.

We do not sell your personal data. We share data with the following categories of third parties: **Infrastructure providers:** AWS (hosting, S3 storage), GitHub (CI/CD build runners). **Payment processing:** Paddle (billing and subscription management). **Push notification delivery:** Firebase (FCM) and OneSignal — only if you enable these features and connect your accounts. **Analytics:** We use privacy-respecting, self-hosted analytics for admin panel usage (no third-party ad tracking).

We use strictly necessary cookies to maintain your session. We do not use advertising cookies or cross-site tracking. You can clear cookies at any time via your browser settings without loss of service functionality (you will need to sign in again).

If you are based in the UK or EEA, you have the right to: • Access the personal data we hold about you • Correct inaccurate data • Request erasure of your data ("right to be forgotten") • Object to or restrict processing of your data • Request data portability in machine-readable format • Lodge a complaint with your supervisory authority (ICO in the UK) To exercise these rights, contact: privacy@siteintoapp.com

We implement industry-standard security measures including TLS in transit, encryption at rest for sensitive fields, bcrypt password hashing, and role-based access controls. We conduct regular security reviews. In the event of a data breach affecting your personal data, we will notify you within 72 hours as required by applicable law.

Data is processed on AWS infrastructure in the EU (eu-west-2). Build pipeline runners are located in the UK and EU. If data is transferred outside the UK/EEA, we ensure adequate safeguards are in place (Standard Contractual Clauses or equivalent).

We may update this Privacy Policy from time to time. We'll notify you of material changes via email or an in-app banner at least 14 days before changes take effect. Continued use constitutes acceptance.

Data Controller: SiteIntoApp Ltd., London, United Kingdom Privacy enquiries: privacy@siteintoapp.com DPO: dpo@siteintoapp.com