Privacy notice

Privacy notice: SiteManager Memory

Draft of 22 October 2026

1. Who we are

SiteManager Memory ("Memory") is a service of SiteManager NV, Dreefstraat 7A, 9260 Wichelen, Belgium, enterprise and VAT number BE-0656.994.559 ("SiteManager", "we", "us").

Privacy contact: privacy@sitemanager.io. Postal address: SiteManager NV, Dreefstraat 7A, 9260 Wichelen.

2. What this notice covers

• The Memory customer app: accounts, memories (one per website), chat, reports and downloads.
• Memory request forms ("embeds") that agencies place on their own websites, and SiteManager's own form.
• The emails Memory sends.
• The websites and Google reviews that Memory reads to build a memory, and the people who appear in them (section 5).

It does not cover the agency's own website that shows an embed form. That website has its own privacy and cookie information.

3. Our role: controller or processor

Where we are a processor, the agency or business customer is responsible for informing you and for answering your requests. We pass requests on to them and help them (section 10).

4. What data we use, why, and on what legal basis

4.1 Your account

• Data: e-mail address, a display name if given, password (we store only a one-way hash, never the password), the workspaces you belong to and your role (agency manager or client), interface language, account status.
• Why: to create and run your account, let you sign in, send service emails, and show you the memories you have access to.
• Legal basis: performance of the contract with you (GDPR article 6(1)(b)). Where you use Memory for your employer or for an agency, our legitimate interest in providing the service that your organisation uses (article 6(1)(f)).

4.2 Sign-in, security and abuse prevention

• Data: sign-in session tokens (we store only a digest), signed form-security tokens, counters of sign-in and mail attempts keyed by a digest of your IP address and of your e-mail address, and request logs kept by our hosting provider (IP address, browser type, requested address, time).
• Why: to keep accounts secure, limit abuse (too many sign-in attempts or mails), and find faults.
• Legal basis: our legitimate interest in a secure service (article 6(1)(f)).

4.3 Memory requests through an embed form

• Data: the website address you enter, your e-mail address, the time, whether you confirmed, and the agency whose form you used.
• Why: to send you a confirmation link, create your account and memory after you confirm, and tell the agency that a confirmed request arrived (the agency receives your e-mail address and the website).
• Legal basis: steps you ask for before a contract (article 6(1)(b)). For the agency's own use of your request, the agency's legal basis applies; see the agency's privacy notice.
• If you do not confirm, nothing is created and we delete your e-mail address 7 days after the 24-hour link expires.

4.4 Websites and what Memory derives from them

• Data: the public pages of the website that was added: page text, headings, links, page metadata (description, canonical address, Open Graph fields, HTTP status) and the type names of structured data. Pages can contain personal data, for example names, job titles and contact details of staff or contact people, or names in testimonials. Memory reads HTML only (no images or files), respects robots.txt, and skips login, account, cart, checkout and admin pages.
• Derived data: a business profile ("Identity"), llms.txt, SEO/GEO strategy and reports, website copy drafts, and search indexes used by the chat.
• Why: to describe the business, its offer, audience and voice, and to produce the documents the customer asks for.
• Legal basis: where we act as processor, the customer's legal basis (usually its legitimate interest in analysing its own or its client's website). For SiteManager's own memories, our legitimate interest in understanding businesses we work with or may work with (article 6(1)(f)), consistent with purpose 2.H of SiteManager's general privacy policy.

4.5 Google reviews

• Data: up to the 100 newest reviews of the business's Google listing: star rating, review text, date and language, plus the listing's rating and review count. We do not ask our provider for reviewer names or profile data. Review text can still mention people or personal circumstances, including health.
• Why: to summarise recurring opinions about the business ("review themes"). Themes never contain names. Memory shows the rating, count and themes, never review texts or reviewer names.
• Legal basis: the legitimate interest of the customer that added the website, or of SiteManager for its own memories, in knowing how customers perceive the business (article 6(1)(f)). We limit the data: no reviewer names or profiles are requested, the provider's copy is deleted after capture, themes describe opinions shared by several reviews, and review texts are never shown. [to approve]
• Health details: Memory does not look for, extract or show health details. Where a reviewer mentions their own health, it stays only in the stored review text, which is used for business-level themes only. For such details we rely on article 9(2)(e) GDPR (data the person has manifestly made public). You can ask us to remove a review (section 5). [to approve]

4.6 Company register data

• Data: a copy of the Belgian company register's open data (KBO/BCE), for legal persons only. We do not load enterprises of natural persons, and we keep only the domain part of register e-mail addresses.
• Why: to show the official details (name, VAT number, legal form, address, activity) of the business that matches a memory, with the source "KBO Open Data" and its date.
• Legal basis: this is mostly not personal data. Where it is, our legitimate interest in identifying the business correctly (article 6(1)(f)), within the conditions of the KBO open data licence. We do not use register data for direct marketing.

4.7 SEO data

• Data: the website's domain, the search country, keyword phrases derived from the website, and search figures returned by our SEO data provider (rankings, traffic estimates, competitors, links, AI-search visibility).
• Why: to measure the website's search and AI-search presence and to write the strategy.
• Legal basis: as in 4.4. This is normally not personal data, except where a domain or brand identifies a sole trader.

4.8 Chat, reports and actions

• Data: your questions, the answers and reports, pre-call notes, proposed and confirmed actions and their results, the interface language, times, and the cost of each answer.
• Why: to answer your questions about a memory and to run the actions you confirm.
• Who sees it: only you. Your conversations are personal: your agency, other clients and SiteManager's staff apps do not show them.
• Legal basis: as in 4.1 for running your account; for the content about the website, as in 4.4.
• Please do not enter sensitive personal data (for example health data) or confidential data of other people in the chat.
• You can delete a conversation yourself. Deleting erases the messages and inputs; a minimal record without content stays for cost accounting.

4.9 Emails

• Data: your e-mail address, the website concerned, and the message.
• Messages: confirm your e-mail, reset or changed password, invitation, confirm a memory request, "your memory is ready" or "could not finish", and for agency managers a notice of a new confirmed request.
• No marketing, no tracking pixels, no remote images.
• Legal basis: as in 4.1 and 4.3.

4.10 Usage, cost and audit records

• Data: records of each paid provider call without content (provider, operation, units, cost, project, time), and audit events with identifiers and codes (for example an activation or a manual override, with the staff member who made it).
• Why: cost control and usage limits, billing, fault finding, and accountability for staff actions.
• Legal basis: our legitimate interest (article 6(1)(f)); for billing records, our legal obligations under accounting and tax law (article 6(1)(c)).

4.11 Payments (not active today)

Memory is free during the beta and no payment provider is switched on. When paid activation starts:

• Data: first and last name, card details typed into the payment provider's fields, purchase and invoice status. Card details go directly from your browser to the payment provider (Recurly) and never reach our servers.
• Legal basis: contract (article 6(1)(b)) and legal obligations for accounting and tax (article 6(1)(c)).

4.12 Support and privacy requests

• Data: your messages and the details needed to answer them.
• Legal basis: our legitimate interest in answering you (article 6(1)(f)); for privacy requests, our legal obligation (article 6(1)(c)).

4.13 Quality evaluation

To test and improve answer quality, we may copy selected project data (website pages, profiles, SEO data) into a protected test environment. Review texts are replaced in these copies. Copies can also contain the memory's chat conversations. Copies are deleted after 90 days [to approve; not automatic yet]. Legal basis: our legitimate interest in a reliable service (article 6(1)(f)).

5. If your name appears on a website or in a Google review that Memory reads

This section is for people who are not Memory users: staff and contact people named on a business website, people quoted in testimonials, and people who wrote or are mentioned in a Google review of a business.

• What we process: the text of the public page or review in which you appear, as part of that page or review. We do not look for you, we do not build a profile of you, and we do not contact you. Memory describes the business, not the people.
• Sources: the business's public website, and Google Maps reviews of the business collected through our provider Apify. We do not request reviewer names or profile data.
• Why: to describe the business and summarise what its customers say about it (sections 4.4 and 4.5).
• Who is responsible: the customer that added the website, or SiteManager for its own memories (section 3).
• Legal basis: legitimate interests (article 6(1)(f)): understanding a business's own public presence and reputation. We limit the impact on you: the information is already public, it is used in a business context, reviewer names are not requested, names are kept out of generated texts, and review texts are not shown in Memory. Health details: see 4.5.
• Recipients and transfers: as in sections 7 and 8.
• How long: as long as the memory of that business exists (section 9).
• Your rights: you can ask for access, correction or erasure, and you can object at any time. Send the address of the web page, or the name of the business whose review it is, to privacy@sitemanager.io. If you object, we remove the passage or review and exclude it from later scans, unless the customer shows compelling legitimate grounds.
• Why we do not inform you individually: we usually do not know who you are or how to reach you, and finding out would mean collecting more data about you. We therefore publish this notice instead (GDPR article 14(5)(b)). You can ask us for a summary of our balancing of interests. [to approve: the balancing note still has to be written]

6. How Memory uses AI

• Memory uses AI models from OpenAI to extract facts from website pages, write the business profile, review themes, SEO strategy, reports and website copy drafts, and to answer chat questions. It also creates search indexes ("embeddings") of page text with OpenAI. Language detection runs on our own servers.
• What OpenAI receives: page text, review text (for themes), your chat questions with the passages found for them, and the profile and SEO data needed for a task.
• We ask OpenAI not to store requests as application state (store=false). OpenAI keeps requests for abuse monitoring for up to 30 days by default. Under OpenAI's API terms, API data is not used to train OpenAI's models unless the customer opts in. [verify: the production OpenAI organisation has not opted in to data sharing]
• The chat says it is an AI. AI-written downloads start with the line "Contains AI-generated text. Check it before use." (see Cookies and browser storage).
• Memory makes no decisions about people, and no decision with legal or similarly significant effects on you (GDPR article 22).

7. Who receives your data

• Within Memory: members of the workspace that holds a memory (the agency managers and the client who holds it) see that memory. Clients of one agency do not see each other's memories. Conversations are personal (4.8).
• SiteManager staff: staff signed in with their SiteManager Google account can open customer workspaces read-only to support and operate the service. They cannot see your conversations in the staff apps. [to approve: limit this to a named support group]
• Service providers (sub-processors): Google Cloud (hosting, database, logs, staff sign-in), OpenAI (AI), Apify (website reading, Google reviews), SE Ranking (SEO data), Google Workspace (email sending), and Recurly once payments start. The full list with purpose, data and location is published at Sub-processors.
• Authorities or others when the law requires it, or to protect rights and safety, as in SiteManager's general privacy policy (section 4).
• We do not sell personal data.

8. Transfers outside the European Economic Area

Our application and database run in Google Cloud's region in Belgium (europe-west1). Some providers process data outside the EEA:

The safeguards used are the EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795) for certified US recipients, and otherwise the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). You can ask privacy@sitemanager.io for a copy of the relevant safeguards.

9. How long we keep data

10. Your rights

You can ask us for:

• access to your personal data and a copy;
• correction of inaccurate data;
• erasure;
• restriction of use while a question is checked;
• portability of data you gave us, in a common machine-readable format, where the legal conditions are met;
• and you can object at any time to use based on legitimate interests (sections 4.2, 4.4 to 4.7, 4.10, 4.12, 4.13, 5).

How to ask:

• E-mail privacy@sitemanager.io. Say what you want and give your account e-mail address, or, if you are not a Memory user, the web page or business concerned.
• We may ask for proportionate proof of identity. We never ask for your password.
• We answer within one month. For complex requests we may extend this by two months; we tell you within the first month.
• It is free, unless a request is manifestly unfounded or excessive.
• If we act as processor (section 3), we pass your request to the agency or business customer within 5 working days and help them answer it. [to approve]
• You can delete your own conversations in the chat at any time.

You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, +32 2 274 48 00, www.dataprotectionauthority.be [check before publishing], or to the authority where you live or work.

11. What you must provide

An e-mail address and a password are needed for an account. A website address is needed for a memory. Without them we cannot provide Memory. Everything else is optional.

12. Security

Our main measures: hosting in the EU region in Belgium; encrypted connections; passwords stored with Argon2id; session tokens stored only as digests; protection against forged form posts; limits on sign-in and mail attempts; staff apps behind Google sign-in with an allow-list; automated tests on every code change that check one agency cannot reach another agency's data; daily backups with point-in-time recovery.

13. Age

Memory is for businesses and is not meant for people under 18.

14. Changes

We will publish changes here with a new date. If a change affects how we use your account data, we will tell you by e-mail or in the app before it applies.

15. Law and courts

This notice is governed by Belgian law. The courts of Ghent, Belgium have exclusive jurisdiction, without affecting your right to complain to a data protection authority or to go to court where you live.