Privacy Policy.

This Privacy Policy explains how Innoveta Pty Ltd (ACN 692 415 946) (“SiteRoot”, “we”, “us” or “our”) collects, holds, uses and discloses personal information through siteroot.com.au and the SiteRoot website-building service (together, the “Service”).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Service, you agree to the collection and use of information as described in this policy.

We collect information in three ways:

• Information you give us: your name and email address when you create an account; details about your business (e.g. business name, industry, location, services, opening hours, contact details) that you enter during onboarding; logos, images, copy and other content you upload or generate while building your site; and anything you write to us directly, such as support requests.
• Information from sign-in providers: if you sign in with Google or Microsoft, we receive the basic profile information (name, email address) those providers share with us. We never see or store your Google/Microsoft password.
• Information collected automatically: standard technical data such as IP address, browser type, device information, and session cookies needed to keep you signed in. We also use Google Analytics and Google Ads cookies on siteroot.com.au to understand how people find and use SiteRoot, and to measure our advertising. These are not used on the websites we build for customers.

We use the information we collect to:

• Create and manage your account, and authenticate you when you sign in;
• Generate, host and publish the website we build for your business;
• Provide ongoing suggestions and insights to help your site and business grow;
• Respond to support requests and communicate with you about the Service;
• Monitor, secure, and improve the Service, including diagnosing technical issues; and
• Comply with our legal obligations.

Building your site involves sending the business details and content you provide to trusted third-party service providers who process it on our behalf, under contractual confidentiality and data-protection obligations. These currently include:

• Anthropic: the AI model that generates and edits your site’s copy, layout and structure from the information you give us;
• Amazon Web Services (AWS): cloud infrastructure used to build, store and host your published site;
• Sentry: error-monitoring, used to detect and fix technical problems in the Service; and
• Google Maps: optional address autocomplete when you enter your business location.

As SiteRoot adds new capabilities (for example, billing, analytics, or marketing tools), we may engage additional service providers. We’ll update this list, and this policy, as that happens.

We use strictly necessary cookies to keep you signed in and to protect the Service from cross-site request forgery. Most browsers let you block or delete cookies, but doing so may stop parts of the Service (like staying signed in) from working properly.

We also use Google Analytics and Google Ads cookies on siteroot.com.au. They tell us how many people visit, which pages they read, and whether someone who arrived from one of our ads went on to create an account. We use this to decide where to spend our advertising budget. Google may also use these cookies to show you SiteRoot ads elsewhere.

The websites we build for our customers also carry Google Analytics. Each site has its own separate Analytics property, so its visitor numbers are kept apart from every other site and from siteroot.com.au, and we use them to show the site’s owner how their website is performing. Those sites do not carry our advertising cookies. If a customer’s website is deleted, we delete its Analytics property with it. You can opt out of Google Analytics entirely with Google’s browser add-on, or block cookies in your browser.

We don’t sell your personal information. We only share it with:

• The service providers described in section 4, to operate the Service;
• Law enforcement or regulators, where we’re required to by law;
• A buyer or successor, if SiteRoot is involved in a merger, acquisition, or sale of assets — you’ll be notified before your information becomes subject to a different privacy policy; and
• Anyone else, with your consent.

SiteRoot is a paid subscription and a payment method is required to start your free trial. Card details are collected and processed by Stripe, a PCI-compliant payment processor, on Stripe’s own pages. Your full card number never reaches SiteRoot’s systems and we could not store it if we wanted to. What we do keep is the card brand and its last four digits, so that you can recognise which card is on file, along with your subscription status and billing dates. Stripe processes this information as an independent controller under its own privacy policy.

Your information is stored on secure infrastructure provided by AWS and our other service providers, some of whom may process or store data outside Australia (including in the United States). We take reasonable technical and organisational steps to protect your information against misuse, interference, loss, and unauthorised access, modification or disclosure.

We keep your information for as long as your account is active, or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. If you close your account, we’ll delete or de-identify your personal information within a reasonable period, unless we’re required to keep it for longer by law.

Under the Australian Privacy Principles, you have the right to ask us:

• What personal information we hold about you, and to access it;
• To correct any personal information that’s inaccurate, out of date or incomplete;
• To delete your account and associated personal information; and
• How to make a complaint if you think we’ve mishandled your information.

To exercise any of these rights, contact us using the details in section 12. If you’re not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

The Service is intended for business owners and is not directed at children. We don’t knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, please contact us and we’ll delete it.

We may update this Privacy Policy as SiteRoot evolves, for example when we add new features, service providers, or a paid plan. We’ll post the updated policy here with a new “last updated” date, and for material changes we’ll take reasonable steps to let you know directly (such as by email) before they take effect.

If you have any questions about this Privacy Policy or how we handle your personal information, contact us at:

Innoveta Pty Ltd (ACN 692 415 946)
Trading as SiteRoot
Email: admin@siteroot.com.au