Privacy Policy
abcsites.ai
Effective 6 October 2026
1. Who this covers
This policy covers clients (businesses who buy a plan) and businesses we contacted who never became clients. The second group matters as much as the first, and most privacy policies quietly skip it. It also covers businesses that book a call with us, or ask for a free website, without buying a plan: they sit between the two, and section 3 says what we hold about them.
2. If we contacted you and you are not a client
We find businesses from publicly listed business information. From a business's public listing we store its name, address, phone number, hours, review count and star rating. We never store the text of its reviews or its photos. We do not buy consumer data, we do not use personal social profiles, and we do not collect anything about your customers.
If you tell us to stop, we stop permanently, on every channel. To do that we keep one record of you forever: enough to recognise you and never contact you again. That record exists because you opted out — deleting it is what would let us contact you by accident next year. If you would rather it were erased entirely, say so and we will, and we will explain what that means.
3. If you are a client, or you booked a call
We hold what is needed to build and run your site:
- Business name, address, phone, email, hours, services
- Photos, logo, text and reviews you give us or that are publicly on your listing
- Your domain and DNS records
- Support messages and change requests you send us
- The average job value you tell us, so your monthly report can say what your work was worth
- Billing status — not your card. Card details go directly to Stripe and we never see or store them. We do keep which plan you bought, the amounts and dates of your payments, and the numbers Stripe gives your customer record and your subscription.
If you book a call, or ask for a free website. We keep your first name, your business name, your phone number and email, the Google listing of your business, your time zone, the host and the time you picked, the campaign tags in the link that brought you to the booking page, and whether you ticked the text-message box and when. If a person on our team books the call for you, we keep the same things. We also keep what happens to the booking (booked, moved, cancelled, you did not show up, or you went ahead), the notes your host writes during or after the call, and which outcome button they press. To keep one free website per business, we keep the Google listing, the phone number and the internet address of each free-website request.
If you fill in the intake page. Before the call we ask for your logo and photos, the services you want shown, the towns you serve and your hours, a link to your reviews if your business has no Google listing, whether you have a domain and where it is registered, links or handles for your social accounts, whether Drop & Post might suit you, and the text-message box. We ask for no passwords, and the page says so. We remove phone numbers, email addresses and web links that are typed into its free-text boxes.
Photos and clips. Photos reach us through the intake page, by text message or by email, and we keep a copy; we re-save the photos we keep and remove the location and camera data stored inside them. A paid Drop & Post client gets a shared folder for clips (short videos), and we copy each clip from it to our own storage to work on it.
Your social accounts. If you want us to post for you, you add us as a partner or editor on your Facebook, Instagram, TikTok and YouTube accounts, through each platform's own tools. We never ask for or store your passwords or access codes. We keep a note of which accounts you tell us you have connected, and any handle or page link you type. Today the people on our team do the posting by hand; nothing posts to your accounts by itself.
Your domain. If you give us access at your registrar, or add the two DNS records we send you, we keep the domain name, the name of your registrar, the records and a note of the steps. To check that your domain points at your website we use public DNS and registration lookups.
4. Consent records
When you agree to something on screen, we keep a record of it: which box or button, the exact words it showed and their version, the time, and the internet address it came from. That covers the text-message consent line on the booking page and the intake page, the yearly plan and automatic renewal, and, on a payment link page, the two boxes: one to agree to the terms and one to say you understand the plan renews automatically and what is charged today. We keep these records because the law asks us to be able to show what you agreed to, and when.
5. Text messages
We text you only if you agree to it. The consent line beside the phone number box says:
"We'll text you your link and updates about your site and plans. Msg frequency varies. Msg & data rates may apply. Consent isn't required to buy. Reply STOP to end, HELP for help."
It covers texts about your link and your site, and texts about our plans. It only counts when you send the form it sits on; a number typed into a form that was never sent is never called or texted (section 7). Agreeing is not a condition of buying anything.
Before 29 September 2026 our forms and checkout showed different words. We record the exact words each person agreed to, their version and when (section 4), and we send only the texts those words cover. Reply STOP and every text stops. Reply HELP and a person answers. Your number and your consent are never sold or shared for anyone else's marketing.
After you book, the texts about your booking and your website come from one number, (248) 535-0718, and are signed by Jake or Aiden. They are sent from our team's messaging desk and carried by the phone network. If you agreed to texts only on a call, we text you about that booking and your website, and never marketing. If you text us first, we may answer from the number you texted. Reply STOP to any text, or use the unsubscribe link in any email, and we stop texting you and stop emailing you, except the emails a paying customer needs about payments, the plan and the domain. We keep a permanent record that you stopped (section 2).
6. Who else touches it
| Who | What they handle |
|---|---|
| Stripe | Payments. They receive your card details directly; we do not. We send Stripe your business name, email and phone and your booking reference, so a payment can be matched to you, and Stripe sends us back the payment, plan and customer numbers and the amounts. |
| Netlify | Hosting. They serve your preview and, once it is live, your website, including the photos you gave us for it. |
| Fastmail | Our email with you, in both directions, including everything we send from help@abcsites.ai. |
| Anthropic | Generating the draft copy and layout from the material you give us. For the five-page website we build before your call, that is your business name, the services and towns you chose and any wishes you typed; it is not your photos, your clips or your reviews. |
| Apple (iMessage/SMS) | Texts we send from our business phone, and your replies. A text to an iPhone goes as an iMessage through Apple; any other text goes as an ordinary SMS through our mobile carrier. |
| GoDaddy | Our domain registrar: abcsites.ai is registered there, and the records that route our email and website are kept there. It does not receive your information. |
| Google (Places) | We look your business up in Google's public business listings to gather the facts your preview is built from — name, address, phone, hours, star rating and review count. For your five-page website we may also read the listing's public reviews and a few of its photos. |
| Google (Calendar) | When you book a call we put it on our team's Google Calendar: the event carries your first name, business name, phone, email, Google listing number and time zone, and a private link to the call page. It has no guests, so Google sends you nothing. We read only the busy and free times of our hosts' calendars, and the event titles and notes on the calendars we keep for these calls. |
| Google (Drive) | Photos you send for your website are copied to a folder on our team's Google Drive, named with your business name, your first name and your call date, and shared with our team's systems only. A Drop & Post client's clip folder is shared by a private link, and anyone who has that link can add files to it, so keep it to yourself. |
| Telegram | Alerts to our team: when a call is booked (the name, business, host, time and phone number), when a paid client's folder is set up, and when a client asks for a call to connect their accounts (the phone number). |
| Our team's desk and hub | Our team reads your booking, intake, call, website-ready, clip-count and payment records on a private desk and hub that only our team can reach, over a private network. |
| Unsplash, Pexels | Licensed stock photography used in a preview until your own photos go in. Those pictures are delivered from their servers, so they see the address of anyone viewing a page that still uses one. |
| Meta, TikTok, Google | When you complete a paid checkout, we tell them a purchase happened — never a preview. Meta and TikTok also receive the advertising measurement from abcsites.ai described in section 7, which you can turn off there. If you came to us from a Meta ad and that measurement is on for you, Meta also hears when you book a call, send your intake, we finish your website, you show up for or miss your call, or move it (section 7). We send it as an irreversible scrambled version of your email and phone (SHA-256), never the plaintext. They cannot read your actual email or phone number from it, only match it against their own users. If your browser sends Global Privacy Control, this is skipped entirely. |
Two kinds of company we have not appointed yet, so neither is happening today and neither has any of your information:
- A registrar for your domain. No domain has been registered through us. When we register one for a client, we will name the registrar we use here before we register anything for anybody. The registrar will receive the registrant's name, business, address, email and phone, which the registry requires.
- A call-tracking provider. There is no tracked line, so no call-tracking provider collects or holds call data. What our host records about a call we booked is in section 3. The same applies: named here first.
That list is every company that handles your information. If we add one, this section says so before the change takes effect.
We do not sell your information for money. The purchase confirmation above, the Meta booking steps and the Meta and TikTok measurement in section 7 may count as "sharing" for advertising under some state laws; you can opt out of both with Global Privacy Control, the "No thanks" / "Cookie choices" controls in section 7, or by emailing help@abcsites.ai.
7. Cookies and links
The client portal sets one cookie so you stay signed in.
Advertising measurement on abcsites.ai, and how to turn it off. From 19 September 2026 we advertise, so we need to know which ad brought somebody to us. Since 23 September 2026 the Meta pixel, and since 30 September 2026 the TikTok pixel, are on by default when you visit abcsites.ai, and a notice on the page tells you so and lets you turn both off:
- What the Meta pixel does: it sets two cookies of Meta's own and tells Meta that a page was viewed, that the free-homepage form was started, and that it was completed. We send the form-started and form-completed events to Meta from our own server as well, each tagged with the same event reference so it is counted once, not twice, together with the internet address and browser type of the visit, which Meta uses to match it. We never send what you typed into the form to an ad platform, except your email and phone number scrambled irreversibly (SHA-256) so Meta can match you to an account it already has.
- What the TikTok pixel does: it sets TikTok's own cookies (_ttp and ttcsid) and tells TikTok that a page was viewed (PageView), that you gave us your number for your free site (Lead), and that you started a free trial (StartTrial). With those two events it sends your email and phone number scrambled irreversibly (SHA-256), so TikTok can match you to an account it already has. It never receives your name, what else you typed, or your card details.
- To turn it off: press "No thanks" on the notice, or the "Cookie choices" link in the footer of every page. Both pixels stop, their cookies are deleted, your browser remembers the choice, and nothing further about your visit goes to any ad platform — from your browser or from our server. You can turn it back on the same way.
- If your browser sends Global Privacy Control: neither pixel loads, no advertising cookie is set, nothing about your visit goes to any ad platform and you are not asked. We treat it as a request to opt out of the sale or sharing of your personal information under California law and similar state laws.
- Our iPhone app never loads either pixel.
There is never any advertising tracking on a preview, whether or not you agreed — your own customers looking at your site are not ours to measure.
Booking, intake and call pages. The booking page, the intake page and your call page run no advertising pixel and no analytics tag. The booking page keeps your booking code in your browser's local storage so you can get back to your booking, and keeps the campaign tags of the link you came by in session storage until the tab closes. The intake page keeps a draft of your answers in session storage for that tab only.
Booking and purchase steps we send to Meta from our server. If you came to us from a Meta ad, and advertising measurement is on for your visit (the choices above), we tell Meta when you book a call (Schedule), when you send your intake (IntakeSent), when your website is ready (BuildReady), when the call happens (Showed), when it is missed (NoShow), when you move it (Rebook) and when you buy (Purchase). We send these from our own server, each with its own event reference so it is counted once. Each carries your email and phone scrambled irreversibly (SHA-256), your internet address and browser type, Meta's two browser cookie values, the page you were on with your private booking code removed, the campaign tags that brought you, the plan and the host, and for a purchase the amount charged before tax. We never send your name, your business name, what you typed, or your card details. A booking our team makes for you by phone sends nothing. If your browser sends Global Privacy Control, nothing is sent, and pressing "No thanks" stops it too. Our iPhone app sends nothing.
When a paid checkout completes, one purchase confirmation goes to Meta, TikTok and Google as described in section 6. Global Privacy Control turns this off too. None of it follows you across other websites, and no ad platform ever receives your name, card details or what you bought. Your own website may use analytics — if it does, we will tell you and it will be disclosed on your site.
One thing we do count on your preview, ourselves. While a preview is still locked, the page tells us when you have clicked around it or scrolled most of the way down, and whether the "want us to finish and publish it?" prompt was shown or followed. It is three small messages to our own server, carrying only the reference already in your preview's web address — no cookie, no advertising network, nothing that identifies your visitors. It is how we know a preview was worth building. It stops the moment you pay, because the locked part of the page is removed.
When you fill in the form for a free site, we also note which link brought you to it: the campaign tags in the web address, an ad's click reference if you came from an ad, a tracked link from one of our own accounts or people, the customer who referred you if you came from their link, the first page you landed on, and the name of the website that sent you. We keep two copies of it in first-party cookies on abcsites.ai for 30 days: the first link that brought you here, and the most recent one, so a visit that comes back later is still credited to the right place. They are sent to us only when you submit the form, kept with your request so we can tell which of our marketing works, and never shared with anyone. We do not use them to follow you around other websites.
The form sends the business name as you go. From 21 September 2026, when you pick or type the business on the first step, and when you answer what it does on the second, those two answers go to our own server as each step is completed — together with what Google's public listing says about that business (its trade, town and website), which section 2 already covers. It is so that if you leave partway we know which business asked, not just that somebody did. It is tied to your browser tab only, by the same throwaway token as the counter above — not a cookie, gone when the tab closes.
The last step is saved as you type, too. From 22 September 2026, your name, email address and mobile number on the last step are sent to us as you fill each one in, before you press the button, and the form says so right beside them. If you leave without sending, we may email you about the homepage you started — every email says how to stop them, and stopping is permanent (section 2). We will not text or call a number from a form you did not send: text messages need the consent box on that step, and it only counts when you press the button (section 5). If you never send the form, we delete your name, email and phone number after 90 days, unless you have become a client or asked us to stop, in which case sections 3 and 2 apply.
8. How long we keep it
Client material: while you are a client. When you ask us to delete it, we delete it within 30 days of the request, from our own systems, by a person on our team: your records, your photos and clips, and the files in your folders. Our backups roll off on their own schedule, and what a platform or Stripe holds is theirs, not ours. We keep what the law asks us to keep: payment records, consent records and the opt-out record. Opt-out records: permanently, for the reason in section 2. Consent records: as long as the law requires us to be able to show them. Name, email and phone from a form that was never sent: 90 days (section 7).
If you booked a call and never became a client: we keep your booking, intake, call and message records until you ask us to delete them. A preview or full website we built for you before the call and you did not go ahead with: we hold it for at least 14 days from the day we first offered you a call time, then archive it (put it aside, not deleted) or delete it; an archived one stays until you ask us to delete it. Our record of a Studio build that finished, failed or was cancelled is deleted after 30 days. Copies of the emails and texts we sent you stay with your record.
9. What you can ask for
A copy of what we hold, a correction, deletion, or to opt out of advertising sharing (section 7). Email help@abcsites.ai and a person will answer. We do not require a specific form of words.
10. Children
The service is for businesses. We do not knowingly collect information from anyone under 18.
11. Changes
If this policy changes materially we will email clients rather than quietly re-dating the page. Each of our four documents carries its own effective date, so a change to this one does not silently re-date the others.
12. Contact
help@abcsites.ai · 28588 Northwestern Service Dr, Suite 200, Southfield, MI 48034, US