Privacy Policy
Draft — not yet reviewed by legal counsel. This text describes how Siteon is designed to handle personal data, but it is not final and may change before launch. Items marked [TBD] are still open.
Last updated:
1. Who we are
Siteon is operated by Saucer Inc. (株式会社Saucer), a company incorporated in Japan (“we”, “us”).
| Item | Details |
|---|---|
| Company | Saucer Inc. (株式会社Saucer) |
| Address | Room 309, Sun Patio Takadanobaba, 3-1-5 Takadanobaba, Shinjuku-ku, Tokyo 169-0075, Japan |
| Representative | Satoshi Murakami |
| Contact for privacy requests | our contact form (saucer-inc.com/contact) |
| Representative in the EU (GDPR Art. 27) | [TBD: not yet appointed] |
| Representative in the UK (UK GDPR Art. 27) | [TBD: not yet appointed] |
| Data protection officer | [TBD: confirm whether a DPO is required; none appointed] |
This policy covers Siteon (the management app, the API, the CLI, the MCP server, the hosting of customer sites and the script that customer sites embed) and this website (siteon.dev).
2. Our two roles
We handle personal data in two different roles, and the rules that apply depend on the role.
- As a controller for the data of our customers and their team members (accounts, billing, security logs), for Google user data that a customer connects, and for visitors to this website.
- As a processor (a service provider acting on instructions) for the data that visitors to our customers’ sites submit or generate — form submissions, bookings, page-view analytics and the content that customers publish. For that data, the customer who runs the site (the “site operator”) is the controller. We process it only to provide Siteon to the site operator, under our Terms of Service and a data processing agreement [TBD: publish the data processing agreement (DPA) and incorporate it into the Terms].
If you are a visitor to a site hosted on or connected to Siteon and you want to access or delete your data, please contact the operator of that site. If you contact us instead, we will pass your request to the site operator where we can identify them.
3. Data we collect as a controller
Account data
- Email address, and your name if you sign in with Google.
- Sign-in identities: a password hash if you set a password, and your Google account ID if you use Sign in with Google.
- Session records, sign-in links that we email to you, and the accounts, sites and roles you belong to.
- API keys you create (we store them in a form that cannot be read back) and the approvals you give to the CLI or to an AI agent.
Billing data
- Billing country and address, company name, and a VAT or tax ID if you choose to give one.
- Plan, billing cycle, currency, invoices and payment status.
- Card details are entered on Stripe’s pages and held by Stripe. We do not receive or store full card numbers.
Security and usage data
- IP address, browser or client information and timestamps when you use the app, the API, the CLI or the MCP server.
- An audit log of important operations (for example, plan changes, API key changes, deployments and Google connections), including whether an action was taken through an API key used by an AI agent.
- Usage counters that enforce plan limits, including a ledger of free-plan grants that stores only a keyed hash, so that deleting and recreating an account does not reset the free allowance.
Messages and reports
- Emails you send us, and abuse reports about hosted sites (the reporter’s email address and the content of the report).
Visitors to this website
- This website does not use advertising or analytics cookies.
- If you choose a language, the choice is saved in your browser’s local storage so that the language banner is not shown again. It is not sent to us.
- Fonts are loaded from Google Fonts, so your browser sends your IP address to Google when the page loads.
4. How we use data and our legal bases
For people in the European Economic Area (EEA) and the United Kingdom, the legal bases under the GDPR and the UK GDPR are shown below.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the service: accounts, sign-in, sites, hosting, forms, bookings, analytics, notifications | Account data, content, usage data | Performance of a contract (Art. 6(1)(b)) |
| Billing, invoicing and tax (including VAT ID checks) | Billing data | Performance of a contract; legal obligation (Art. 6(1)(b), (c)) |
| Keeping records required by accounting and tax law | Billing data, invoices | Legal obligation (Art. 6(1)(c)) |
| Security, fraud and abuse prevention, rate limits, enforcing plan limits, handling abuse reports | Security and usage data, reports | Legitimate interests in keeping the service and its users safe (Art. 6(1)(f)) |
| Service emails (sign-in links, billing notices, alerts, important changes) | Email address | Performance of a contract (Art. 6(1)(b)) |
| Improving the service using aggregated statistics | Usage data | Legitimate interests (Art. 6(1)(f)) |
| Product news and marketing emails | Email address | Consent where required (Art. 6(1)(a)); you can unsubscribe at any time. [TBD: decide whether we send marketing emails at all] |
We do not sell personal data, and we do not use it for advertising. Google user data has stricter rules, described in the next section.
5. Google user data
Siteon uses Google APIs in two separate ways, with two separate Google Cloud projects: Sign in with Google, and an optional Google connection that lets a site send form responses to Google Sheets and take bookings against Google Calendar.
5.1 Sign in with Google
Scopes: openid, email, profile. We receive your Google account ID, email address and name, and use them only to sign you in and to show who is signed in.
5.2 Google connection (Sheets and Calendar)
An account owner, or the owner of a single site, can connect a Google account. A connection made by a site owner can only be used for that site. Each Google account can be connected to only one Siteon account at a time. We request only the scopes below, and only for the features you turn on.
| Scope | What we read or write | What we store |
|---|---|---|
openid, https://www.googleapis.com/auth/userinfo.email | Your Google account ID and email address, to show which Google account is connected and to recognise it when you reconnect. | Google account ID and email address |
https://www.googleapis.com/auth/drive.file | Creates a spreadsheet in your Google Drive and adds form responses to it as rows. This scope only gives access to files that Siteon created (or that you choose for it). We read only the header row and the first column of the tabs we manage, to keep the columns aligned. We cannot see your other files. | The IDs of the spreadsheet and tabs. The responses themselves live in your spreadsheet. |
https://www.googleapis.com/auth/calendar.calendarlist.readonly | Lists your calendars (ID, name, whether it is primary, your access level) so that you can choose which calendars to check for availability. | Only the IDs of the calendars you choose, and whether each one could be read. Calendar names are not stored. |
https://www.googleapis.com/auth/calendar.events.freebusy | Reads busy time ranges on the calendars you chose, to work out which booking slots are free. | Nothing. Busy times are used and discarded. |
https://www.googleapis.com/auth/calendar.events.owned | Creates, reads and deletes the booking events that Siteon itself creates on your primary calendar (with a Google Meet link if you turn that on). To warn about conflicts, it reads only the start and end time, status and transparency of events, and your own response — not titles, descriptions or other guests. | The event ID and the Meet link of each booking. |
The Meet link and the booking details are sent to the visitor who made the booking, because that is the purpose of the feature. Google user data is not shared with anyone else.
5.3 Limited Use
Siteon’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the features that you can see in the app and that you turned on (Sheets delivery, availability checks and bookings).
- We do not use Google user data for advertising, including retargeting, personalised or interest-based ads.
- We do not sell Google user data, and we do not transfer it to third parties, except as needed to provide the features above (for example, sending a Meet link to the visitor who booked), to comply with the law, or as part of a merger or acquisition with notice to you.
- People at our company do not read Google user data, except (a) with your affirmative agreement for specific data, (b) when needed for security purposes such as investigating abuse or a bug, (c) to comply with the law, or (d) when the data is aggregated and anonymised for internal operations.
- We do not use Google user data to develop, improve or train generalised AI or machine learning models, and we do not send it to the AI features described in section 7.
Our staff can see, for operating the service, the email address of a connected Google account, the state of the connection and the state of pending operations. They cannot see access tokens.
5.4 Storage and security
- Refresh tokens are encrypted before they are stored and are never shown to anyone, including our staff.
- The email address of a connection is shown to its owner and to members of the same account. For a connection made for a single site, it is shown only to its owner and the owners of that site.
5.5 Retention and deletion
- Busy times and the event details read for conflict checks are not stored.
- When you disconnect, we revoke the token with Google and delete it. If Google tells us a token is no longer valid, we delete it at once.
- The connection record (Google account ID and email) is deleted 30 days after you disconnect, once any pending operations have finished. We keep a non-reversible hash of the Google account ID to detect reuse and abuse.
- While our app is awaiting Google’s verification, Google limits how many people can grant access. To stay within that limit we keep a hash of each Google account ID that has ever connected; it is not deleted when you disconnect.
- Event IDs and Meet links are deleted when the booking is cancelled, when the response is deleted, or when the site is permanently deleted.
- Spreadsheets and calendar events in your Google account are yours. Siteon does not delete them when you disconnect.
5.6 How to disconnect
- In the Siteon app, open the Google connection settings and choose “Disconnect”. The owner of the connection, the account owner or an account admin can do this. Moving a site to another account also disconnects a connection made for that site.
- You can also remove access at any time from your Google Account at myaccount.google.com/permissions. We detect this and stop using the connection.
- After disconnecting, Sheets delivery and bookings that used the connection are paused until you connect again.
6. Data of visitors to our customers’ sites
For the data below, we act as a processor for the site operator (see section 2). The site operator decides which fields a form has, where submissions are sent and how long they are kept.
| Feature | Data | Notes |
|---|---|---|
| Forms, surveys and sign-ups | The fields the operator defines (often name, email address and a message), the time, the page URL, and campaign information (UTM parameters, gclid, fbclid, landing page and referrer) | Campaign information is kept in the visitor’s browser for up to 90 days and sent with a submission. Submissions can be delivered to the operator by email, Slack, webhook or the operator’s own Google Sheets. Bot checks may use Cloudflare Turnstile. |
| Bookings | Name, email address, answers to the booking form, the chosen time | A calendar event (and a Meet link if enabled) is created in the operator’s Google Calendar. Confirmation and reminder emails are sent to the visitor. |
| Analytics | Page path and time; the IP address is used to remove duplicates and to apply rate limits | The IP address is turned into a keyed hash and not stored in plain form. [TBD: state how long the hashes are kept]. The script sets no cookies. |
| Hosting | Requests to sites on *.siteun.com and on custom domains | Cloudflare processes request data (such as IP address and user agent) to deliver pages and protect against attacks. |
Browser storage used by the embedded script
- Campaign information (first and last visit source), kept for up to 90 days.
- A random key that prevents the same form submission from being counted twice.
- For surveys that allow one answer per browser, a marker that the browser has already answered.
These are stored in local storage, not in cookies, and only on the site that uses them. Whether a consent banner is needed depends on the law that applies to the site operator, and is the operator’s responsibility. [TBD: confirm the ePrivacy analysis for campaign storage]
Retention
Visitor data is kept until the site operator deletes it. When a site is deleted, or an account is closed, the data is permanently deleted 30 days later (see section 10).
Abuse reports
Anyone can report a site hosted on our service. We use the report, and may use an AI model to sort reports by urgency, but a person makes the decision to suspend a site.
7. AI features and AI agents
- AI features (for example, translating CMS content or helping with text) send the content you ask to process to an AI model provider. Our current provider is the Google Gemini API. [TBD: confirm the provider’s terms on data retention and training, and list any other provider before it is used]
- When you operate your account through the CLI, the MCP server or an API key — including from AI coding tools — we receive only the API requests. We do not receive the conversation you have with your AI tool. Actions taken this way are recorded in the audit log.
8. Service providers (sub-processors)
We use the following providers to run the service. Each processes personal data only on our instructions.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, application servers, database and file storage, bot checks (Turnstile), custom domains | All data stored in the service | [TBD: regions; United States and worldwide edge network] |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices, tax calculation (Stripe Tax) and VAT ID checks | Billing data, email address | United States, Ireland [TBD: confirm] |
| Twilio Inc. (SendGrid) | Sending emails: sign-in links, notifications, booking confirmations and reminders | Email addresses and email content | United States |
| Google LLC | Sign in with Google; Gemini API for AI features and sorting abuse reports; Google Fonts on this website | Account sign-in data; the content sent to AI features; report content; IP address for fonts | United States [TBD: confirm] |
Destinations that a customer sets up — their own Google account, Slack workspace or webhook endpoint — are chosen and controlled by the customer and are not our sub-processors.
[TBD: decide how customers are notified of changes to this list]
9. International transfers
We are based in Japan, and our providers process data in other countries, mainly the United States.
- Japan is covered by an adequacy decision of the European Commission and by UK adequacy regulations, so data can be transferred from the EEA and the UK to Japan.
- For transfers to other countries, such as the United States, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, or on the EU-US Data Privacy Framework where the provider is certified. [TBD: confirm the mechanism for each provider]
- Under Japan’s Act on the Protection of Personal Information (APPI), when we provide personal data to a party in a foreign country, we give information about that country’s data protection system on request. [TBD: prepare the country information]
10. How long we keep data
| Data | How long |
|---|---|
| Account data and content | While the account is open. When an account is closed, there is a 30-day period for exporting data, after which it is permanently deleted. |
| Deleted sites | Permanently deleted 30 days after deletion. |
| Billing records and invoices | 7 years, as required for accounting and tax. [TBD: confirm the period with a tax adviser] |
| Free-plan ledger | Only a keyed hash is kept, without a fixed end date, to prevent repeated free sign-ups. |
| A deleted user’s profile | Anonymised right away. The anonymised record remains so that audit and billing history stay consistent. |
| Security and audit logs | [TBD: retention period] |
| Google user data | See section 5.5. |
| Visitor data | See section 6. |
11. Your rights in the EEA and the UK
If the GDPR or the UK GDPR applies to you, you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting processing before the withdrawal.
We do not make decisions with legal or similarly significant effects based solely on automated processing. To use your rights, contact us through our contact form (saucer-inc.com/contact). We will answer within one month and may need to confirm your identity.
You can also lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where an alleged infringement took place. In the UK, this is the Information Commissioner’s Office (ICO).
For data we process for a site operator (section 6), please contact the site operator first.
12. Japan (Act on the Protection of Personal Information)
- We use personal information only for the purposes in section 4, and do not use it for other purposes without consent unless the law allows.
- We do not provide personal data to third parties without consent, except where the law allows. Providers in section 8 receive data as our contractors (entrustment), and we supervise them.
- You can ask us to notify you of the purposes of use, to disclose, correct, add to or delete your data, to stop using or providing it, and to disclose records of third-party provision. Send requests to the contact in section 1. [TBD: identity check procedure and any fee]
- Security measures we take include: encryption in transit, encryption of Google tokens at rest, access controls by role, two-factor authentication for our staff tools, and audit logs of staff actions. [TBD: complete the description of security control measures]
14. Children
Siteon is a service for businesses and adults, and is not directed at children. You must be at least 18 to create an account. [TBD: confirm the minimum age] If a site operator collects data from children through their site, the operator is responsible for meeting the rules that apply.
15. Changes to this policy
We will post any changes on this page and update the date at the top. If a change is significant, we will tell account owners by email or in the app before it takes effect. [TBD: notice period, e.g. 30 days]
16. Contact
Saucer Inc. (株式会社Saucer), Room 309, Sun Patio Takadanobaba, 3-1-5 Takadanobaba, Shinjuku-ku, Tokyo 169-0075, Japan, our contact form (saucer-inc.com/contact)
This policy was last updated on 2026-10-24.