Privacy Policy

This Privacy Policy explains how BrightSite, Inc. ("BrightSite," "we," "us") collects, uses, and shares personal information about people who use our website builder and hosting service (customers and their team members) and people who visit onbrightsite.com.

If you're a visitor to a site built on BrightSite, that site's owner decides what it collects and is responsible for it. We process that information for the site owner under our Data Processing Addendum. See "Information we process for our customers" below, and contact the site owner about their practices.

The short version:

• We collect what we need to run BrightSite: your account, billing, your sites, and how you use the dashboard.
• We don't sell your personal information.
• We use a few advertising and analytics tools on onbrightsite.com to measure our own marketing, and you can turn that off.
• Your sites' visitor data belongs to you. We process it for you and don't use it for our own marketing.

Information we collect about customers

Account information. Your name, email address, password (stored as a one-way hash), and optional profile details such as photo, bio, location, website, social links, timezone, and display preferences. If you turn on two-factor authentication, we store the information needed for it.

Organization and team information. Organization names, the people you invite, their roles, and invitations.

Billing information. Your plan, billing history, and billing contact. Payments are processed by Stripe. We don't receive or store full card numbers.

Your Content. The sites, pages, posts, media, forms, products, emails, and settings you create, and the files you upload.

AI conversations. What you send to Lumi and other AI features, including attached images, and the responses.

Connected accounts. If you connect Google, Facebook, Instagram, LinkedIn, X, TikTok, or Stripe, we store the access tokens (encrypted) and the account details needed to post, sync reviews, or take payments for you.

Support and communications. Messages you send us and your email preferences.

Usage and device information. How you use the dashboard (pages viewed, features used, actions taken), IP address, browser, device, operating system, and approximate location derived from your IP address.

Sign-in records. IP address, browser, and time of each sign-in, used for security.

API and agent activity. Requests made with your API keys or through our MCP server, including which tools were called and when.

Information we collect on onbrightsite.com

When you visit onbrightsite.com, we collect page views, referrer, campaign tags (UTM), device and browser type, approximate location, and a cookie that recognizes you when you return and, if you sign up, links your earlier visits to your account. Unless you decline in our cookie banner, we also use:

• Analytics tools to understand how people use our site
• Advertising measurement. If you reached us from an ad and then start a trial, we may send the ad platform a hashed (scrambled) version of your email address, your IP address, browser information, and the ad's click identifier, so we can measure which ads lead to sign-ups.

If you decline in our banner, or your browser sends a Global Privacy Control signal, we don't load these tools or send this information.

How we use information

• To provide, maintain, secure, and support the Service and your account
• To process payments, send receipts, and manage trials and subscriptions
• To send service emails, such as security alerts, billing notices, and trial reminders
• To send product updates and offers (you can unsubscribe at any time)
• To understand how the Service is used and improve it, including using AI tools to analyze trial and product activity in aggregate and for individual accounts so we can help customers succeed
• To prevent fraud, spam, and abuse, and enforce our Terms and Acceptable Use Policy
• To measure our marketing, as described above
• To comply with the law

AI

Our AI features send the information needed for each request to our AI providers. We don't use your content, your AI conversations, or your sites' visitor data to train AI models, and we use our AI providers' paid business services, which don't use API data to train their models. We keep AI conversations and related logs for up to 2 years to support you, investigate problems, and improve the Service.

How we share information

• Service providers that host, secure, and operate the Service for us, including hosting, network security, storage, email delivery, payment (Stripe), AI, and search and review data providers.
• Services you connect. When you connect a third-party service or ask us to post, sync, or send something, we share what's needed with that service.
• Your team. People in your organization can see the organization's content and activity based on their roles.
• Advertising and analytics partners, only as described in "Information we collect on onbrightsite.com," and not if you opt out.
• For legal reasons and safety, when we believe in good faith it's required by law or a valid legal request, or needed to protect the rights, property, or safety of BrightSite, our customers, or others.
• Business transfers, if BrightSite is part of a merger, acquisition, or sale of assets.
• With your permission.

Our staff. Authorized BrightSite staff can access accounts to provide support, fix problems, and investigate abuse. Staff access is logged.

Information we process for our customers

Our customers use BrightSite to collect information about their own visitors, customers, and email subscribers, including:

• Website analytics: pages viewed, referrer, campaign tags, device, browser, approximate location, and a hashed identifier based on IP address and device characteristics. If the site owner turns on visitor identification, a first-party cookie also recognizes returning visitors.
• Session recordings, if the site owner turns them on: page activity such as clicks, scrolling, and mouse movement, with typed text always masked.
• Form submissions, including the information visitors enter, uploaded files, the page, and the IP address.
• Email marketing: subscriber names, email addresses, consent records, and whether emails were opened or clicked.
• Online stores: shopper accounts, addresses, orders, and product reviews. Payments are handled by Stripe.
• Cookies set by tools the site owner chooses, such as Google Analytics, Google Tag Manager, or Meta Pixel, and the site owner's cookie banner.

The site owner is responsible for this information and for telling its visitors about it. We process it only to provide the Service to the site owner, including spam filtering and AI features they use, under our Data Processing Addendum. We don't sell it or use it for our own marketing. If you're a visitor and want to access or delete your information, contact the site owner. If you contact us, we'll pass your request to them.

Cookies

The BrightSite dashboard uses essential cookies to keep you signed in and secure. onbrightsite.com uses a cookie for our own analytics, a cookie that remembers your cookie banner choice, and, unless you decline, cookies set by analytics and advertising tools. You can change your choice anytime with the Cookie settings link at the bottom of every page.

How long we keep information

• Account information and Your Content: while your account is open. When an organization is closed, we delete its content and its sites' visitor data within 30 days after the export period described in our Terms.
• Backups: encrypted backups are overwritten on a rolling schedule, typically within about 60 days.
• Session recordings: 30 days by default, or as set by the site owner.
• AI conversations and logs: up to 2 years.
• Billing records: as long as tax and accounting laws require.
• Sign-in and security records: as long as needed to protect accounts and the Service.

We may keep information longer when the law requires it, to resolve disputes, or to prevent abuse, and we may keep aggregated or de-identified information that can't identify you.

Your choices and rights

• Update your account in your account settings.
• Export your content with the export tools in your dashboard.
• Delete your account or organization by emailing support@onbrightsite.com.
• Marketing emails: use the unsubscribe link in any marketing email. We'll still send service emails about your account.
• Cookies and ad measurement: decline in our cookie banner. We also treat a Global Privacy Control (GPC) signal from your browser as an opt-out.

Depending on where you live, including California, Virginia, Colorado, Connecticut, Texas, Oregon, and other U.S. states, you may have the right to know what personal information we have about you, get a copy of it, correct it, delete it, and opt out of targeted advertising, the "sale" or "sharing" of personal information, and certain profiling. Our use of advertising measurement on onbrightsite.com may count as "sharing" or targeted advertising under some of these laws, and you can opt out as described above. We give these rights to everyone, wherever you live.

To make a request, email support@onbrightsite.com with "Privacy request" in the subject line. We'll verify your identity, usually by confirming the request comes from your account email, and respond within 45 days. You may use an authorized agent. We won't treat you differently for using these rights. If we deny your request, you can appeal by replying with "Appeal" in the subject line. If you're not satisfied with the outcome, you can contact your state attorney general.

Security

We protect information with encryption in transit, encrypted backups, encrypted storage of connected-account tokens, hashed passwords and API keys, two-factor authentication, role-based access, and logged staff access. No system is perfectly secure. If a breach affects your personal information, we'll notify you as the law requires. See onbrightsite.com/security for details.

Age requirement

BrightSite is for people 18 and older. We don't knowingly collect personal information from children under 13 for our own purposes. If you believe we have, contact us and we'll delete it.

Where we process data

BrightSite is based in the United States, and our servers are in the United States. Some of our service providers process data in other countries. If you use BrightSite from outside the United States, your information will be processed in the United States.

Changes to this policy

When we update this policy, we'll change the "Last updated" date. If a change materially affects how we use your personal information, we'll notify account owners by email or in the dashboard before it takes effect.

Contact

BrightSite, Inc.
8 The Green #25266
Dover, DE 19901
support@onbrightsite.com
(617) 682-9368