Skip to content
SOSEI
Get Started

Privacy Policy

Effective date: November 3, 2026

SOSEI (“we”, “us”) respects your privacy. This Privacy Policy explains what personal data we collect when you use sosei.site and the SOSEI platform, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and comparable laws.

1. Data Controller

The data controller for personal data processed about you as an account holder or as a visitor to sosei.site is Innov8it OÜ, the company that operates SOSEI, registered in Estonia under commercial-register code 16788295 (registered office: Narva mnt 7, 10117 Tallinn, Estonia). Contact: [email protected].

Where a website we host for you collects personal data from its own visitors (for example, through the built-in contact form), you are the controller of that visitor data and SOSEI acts as your processor under Article 28 GDPR — processing it only to provide the Service and on your instructions. A data-processing agreement is available on request; see our Terms of Service, Section 14.

2. Data We Collect

  • Account data — your name, email address, authentication metadata and password hash (or, if you sign in with Google, the name and email address Google shares with us).
  • Project data — the source URLs you submit, scraped content, generated site content, hosting slugs.
  • Contact-form submissions on your hosted sites — stored so you can reply to your visitors.
  • Billing data — minimal information forwarded to our payment processor; we do not store full card numbers.
  • Technical data — IP address, browser user-agent, and request logs, used for security and abuse prevention.
  • Cookie and advertising data — only if you choose Accept all in the cookie banner on sosei.site: the identifiers set by Google Analytics, Google Ads, the Meta Pixel and the OpenAI Ads pixel, the pages you visit, and conversion events such as completing a free audit or creating an account. See our Cookie Policy.

You need to give us an email address and password, or sign in with Google, to create an account. Without them we cannot provide the Service. Everything else on this list is either generated by your use of the Service or optional.

3. Legal Bases (GDPR Art. 6)

  • Contract — to provide the Service you requested.
  • Legitimate interest — to operate, secure, and improve the platform.
  • Consent — for optional analytics and advertising cookies on sosei.site. You can withdraw consent at any time with Cookie settings in the site footer; withdrawal does not affect processing that took place before it.
  • Legal obligation — to comply with tax, accounting, and lawful requests.

4. How We Use Data

  • Rebuilding, hosting, and maintaining your site.
  • Account management, billing, support.
  • Security, fraud prevention, and abuse mitigation.
  • Aggregated, non-identifying analytics to improve the product.
  • Only with your consent: measuring our advertising and showing ads to past visitors (see “Cookie and advertising data” above).

We do not sell personal data, and we do not hand your content to anyone to train AI models.

Your published website is public, and by default its robots.txt allows AI crawlers to index it, quote it and use it for model training. To stop that, switch off Allow AI training in the site’s settings. The site then asks crawlers not to train on it and turns away crawlers that only collect training data. Search and AI answers are not affected.

AI models write and edit website content for you. They do not make decisions about you: we do not take decisions that produce legal or similarly significant effects for you based solely on automated processing (GDPR Art. 22).

5. Sharing & Sub-processors

We share data with trusted vendors who process it on our behalf under a data-processing agreement, including:

  • Supabase (authentication + PostgreSQL database hosting)
  • DigitalOcean (application hosting and custom-domain certificates)
  • Cloudflare, Inc. (bot protection on our sign-up, login and contact forms — the challenge sends the visitor's IP address and browser signals to Cloudflare; and TLS termination for customer domains connected through Cloudflare)
  • Anthropic PBC (AI models that generate and edit website content, translations and support-chat answers — receives the content of the site being rebuilt and the instructions you give the editor)
  • Google LLC (Gemini AI models for image and video generation and for AI-visibility checks; Google Places for the business-rating badge you confirm; and, on the product website only and only after you consent to marketing cookies, Google Analytics 4 and Google Ads conversion tracking — see our Cookie Policy)
  • OpenAI (image generation requested from the editor — receives the prompt and any image you supply) and fal.ai (image upscaling — receives the image being enlarged)
  • Perplexity AI (queries about your business used for the AI-visibility report — brand and site names, no visitor data)
  • Firecrawl (page fetching for some source websites during a rebuild — receives the public URLs being crawled)
  • Resend (transactional email — receives recipient addresses and the message content of account, contact-form and report emails)
  • Stripe, Inc. (payments and invoicing when you subscribe)
  • ipapi.co (country lookup of a visitor's IP address for regional abuse limits — only when we have that lookup switched on; no other data is sent)
  • Meta Platforms, Inc. (advertising-conversion measurement via the Meta Pixel and Conversions API — only on the product website, and only after you consent to marketing cookies; see our Cookie Policy)
  • Google LLC (advertising-conversion tracking and remarketing via Google Ads — only on the product website, and only after you consent to marketing cookies; see our Cookie Policy)
  • OpenAI (advertising-conversion measurement via the OpenAI Ads pixel — only on the product website, and only after you consent to marketing cookies; see our Cookie Policy)

Our advertising partners (Meta, Google and OpenAI) may also use what their pixels collect for their own purposes, under their own privacy policies. For the collection and transmission of that data through our website, we and the partner act as joint controllers.

Some of these vendors are located outside the European Economic Area, mainly in the United States. Those transfers rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework, where the recipient is certified) or on the European Commission's Standard Contractual Clauses.

6. Retention

We retain account and project data for the life of your subscription. If your subscription ends or lapses, your hosted site is taken offline and we keep the generated site and its data for a grace period (currently 30 days) so you can reactivate it by resuming payment; after that we may permanently delete the generated site, its version history, and its backups, subject to any legal retention obligations. Logs are retained for a limited period for security and debugging. You can request earlier deletion at any time.

7. Your Rights

Under GDPR (and similar regimes) you have the right to:

  • access the personal data we hold about you,
  • rectify inaccurate data,
  • request erasure (“right to be forgotten”),
  • restrict or object to processing,
  • receive a portable copy of your data,
  • withdraw consent at any time, without affecting processing that took place before you withdrew it,
  • lodge a complaint with a data-protection supervisory authority.

To exercise these rights, write to [email protected].

Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You can also complain to the authority in the EU country where you live or work, or where you believe the infringement took place.

8. Security

We use TLS in transit, row-level security at the database layer, least-privilege service credentials, and infrastructure isolation. No method is 100% secure, but we work continuously to meet modern best-practice standards.

9. Children

SOSEI is not directed to children under 16 and we do not knowingly collect their data.

10. Changes

We may update this Privacy Policy. Material changes will be announced on this page with a revised effective date.

11. Contact

Privacy questions or requests: [email protected].