Privacy Policy

This Privacy Policy explains how SiteAlytic collects, uses, stores, shares and protects personal information when individuals visit our websites, create or use an Account, communicate with us or otherwise interact with the SiteAlytic Services.

SiteAlytic is a cloud-based Software-as-a-Service platform designed to support construction businesses with project management, construction-site operations, team collaboration, materials, equipment, documents, files, reporting, analytics and related administrative workflows.

SiteAlytic is operated by:

YSP LOGISTIK 2000 EOOD

Registration No.: 207700929

VAT No.: BG207700929

Registered address: 25 Shipka St., Plovdiv, Bulgaria

Email: support.sitealytic@gmail.com

The Services are available through:

• sitealytic.com
• app.sitealytic.com

In this Privacy Policy, “SiteAlytic”, “we”, “us” and “our” refer to YSP LOGISTIK 2000 EOOD.

“Customer” means the individual or organization that subscribes to or controls a SiteAlytic organization Account.

“User” means an individual who accesses or uses the Services, including an owner, administrator, employee, contractor or invited team member.

“Customer Data” means information, files, records, documents, photographs and other content uploaded to or generated within the Platform by or on behalf of a Customer.

“Personal Data” or “Personal Information” means information relating to an identified or identifiable individual.

This Privacy Policy applies to personal information processed through:

• the SiteAlytic public website;
• the SiteAlytic web application;
• registration and onboarding;
• subscription and billing processes;
• customer support;
• service-related emails and notifications;
• analytics and security systems;
• other interactions directly connected with SiteAlytic.

This Privacy Policy does not govern independent websites, applications or services operated by third parties, even where those services are linked to or integrated with SiteAlytic.

Third parties process information under their own privacy notices and contractual terms.

SiteAlytic may process personal information in different legal roles depending on the context.

3.1 SiteAlytic as Controller

SiteAlytic generally acts as a data controller, business or equivalent responsible entity when determining the purposes and means of processing information relating to:

• website visitors;
• Account owners and Administrators;
• registration and login;
• billing contacts;
• subscriptions and invoices;
• communications with SiteAlytic;
• technical support;
• security, fraud prevention and audit logs;
• service analytics;
• legal compliance;
• SiteAlytic's own business administration.

In these situations, SiteAlytic determines why and how the relevant personal information is processed.

3.2 SiteAlytic as Processor

Where a Customer uploads or manages personal information concerning its employees, contractors, subcontractors, clients, suppliers or other individuals through the Platform, the Customer normally determines the purposes of that processing.

In those circumstances:

• the Customer generally acts as the controller, business or responsible organization;
• SiteAlytic generally acts as the processor, service provider or equivalent party;
• SiteAlytic processes the information on the Customer's instructions and in accordance with the Data Processing Agreement.

Individuals seeking to exercise rights concerning Customer Data should normally contact the relevant Customer first.

Where SiteAlytic receives such a request directly, we may refer the request to the Customer unless applicable law requires us to respond independently.

SiteAlytic is primarily intended for business and professional users, including:

• construction companies;
• property developers;
• investors;
• project managers;
• technical managers;
• administrative personnel;
• site personnel;
• contractors and subcontractors;
• other authorized business users.

The Services are not directed to children and are not intended for individuals under eighteen years of age.

We do not knowingly create Accounts for children or intentionally collect personal information directly from children through the registration process.

The personal information collected depends on how a person interacts with SiteAlytic.

5.1 Account and Identity Information

We may collect:

• first and last name;
• email address;
• telephone number;
• username;
• job title or position;
• organization;
• profile information;
• Account status;
• assigned role and permissions;
• preferred language;
• profile photograph, where provided;
• authentication and login information.

We do not require Users to provide more information than is reasonably necessary for the relevant Account or feature.

5.2 Company and Organization Information

We may collect:

• company or organization name;
• legal form;
• registration number;
• VAT, GST or other tax identifier;
• registered or business address;
• country;
• billing address;
• contact person;
• Subscription plan;
• organization settings;
• User and role information;
• plan usage and limits.

Some organization information may relate to a business rather than an individual. It may nevertheless constitute personal information where it identifies a sole trader, contact person or another individual.

5.3 Billing and Transaction Information

We may collect or receive:

• billing contact details;
• billing address;
• Subscription plan;
• billing cycle;
• transaction identifiers;
• invoice information;
• payment status;
• payment dates;
• currency;
• tax information;
• payment-failure and chargeback information;
• limited payment-method details supplied by Stripe, such as card brand and last digits.

Payment-card numbers and card security codes are processed by Stripe and are not stored directly by SiteAlytic.

5.4 Customer Data and Project Information

Customers and Users may upload, enter or generate information including:

• project names and details;
• site addresses and locations;
• tasks and assignments;
• schedules;
• budgets and cost information;
• materials and equipment records;
• employee or contractor information;
• comments and internal communications;
• documents;
• contracts;
• reports;
• photographs;
• files;
• audit records;
• progress information;
• other construction or operational data.

The content and sensitivity of Customer Data are controlled primarily by the Customer.

Customers must ensure that they have a lawful basis and appropriate authority before uploading personal information concerning other individuals.

5.5 Communications and Support Information

When a person contacts us, we may collect:

• name;
• email address;
• organization;
• message content;
• support requests;
• screenshots;
• attachments;
• technical details;
• communication history;
• feedback;
• survey responses.

5.6 Technical, Device and Log Information

We may automatically collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• language and time-zone settings;
• login date and time;
• pages and features accessed;
• session information;
• error and diagnostic data;
• audit and security logs;
• approximate location derived from IP address;
• referral source;
• cookie and similar-technology identifiers.

5.7 Analytics Information

Where permitted by law and, where required, after consent, we may collect information through Google Analytics and similar tools, including:

• page views;
• navigation paths;
• session duration;
• interactions;
• traffic source;
• browser and device information;
• approximate geographic information;
• performance and usage events.

Analytics information is used to understand and improve the websites and Services.

5.8 Notification Information

Where notification functionality is enabled, we may process:

• notification preferences;
• device or browser notification identifiers;
• delivery status;
• notification interaction information.

Notifications may concern tasks, projects, system activity, security, billing or administrative matters.

5.9 Information Received from Other Users

An Administrator or another authorized User may provide information about an invited User, such as:

• name;
• email address;
• role;
• job title;
• organization;
• project assignment;
• access permissions.

The Customer is responsible for ensuring that the individual is appropriately informed about this processing.

We may obtain personal information:

• directly from the individual;
• from a Customer or Account Administrator;
• from other authorized Users;
• automatically from a device or browser;
• from Stripe in connection with billing;
• from technical and analytics providers;
• from support and communication providers;
• from publicly available business sources;
• from lawful referrals or business contacts;
• from integrations activated by the Customer.

Where information is received from a Customer, the Customer is responsible for ensuring that it has been collected and shared lawfully.

SiteAlytic is not designed as a specialized platform for processing highly sensitive or heavily regulated information.

Users should not upload unless strictly necessary and legally authorized:

• full payment-card data;
• bank credentials;
• passwords for external services;
• medical records;
• biometric identifiers;
• government-classified information;
• criminal-record information;
• passport or identity-document copies;
• special-category data;
• information concerning children.

Where such information is uploaded, the Customer remains responsible for the lawfulness and necessity of the processing.

SiteAlytic may restrict or request deletion of information that creates an unreasonable legal, privacy or security risk.

SiteAlytic processes personal information only where there is a legitimate and lawful purpose for doing so.

Depending on the relationship with the individual and the nature of the Services used, personal information may be processed for one or more of the following purposes:

Account Administration

We process personal information to:

• create user accounts;
• authenticate users;
• manage user profiles;
• administer organization workspaces;
• assign permissions and roles;
• provide access to authorized features;
• manage subscription entitlements;
• recover forgotten credentials;
• verify account ownership.

Providing the Services

We process information necessary to:

• operate the Platform;
• create and manage projects;
• manage construction sites;
• store and organize documentation;
• manage materials and equipment;
• assign and track tasks;
• generate reports;
• synchronize data;
• enable collaboration between authorized Users;
• provide AI-assisted features;
• maintain service functionality.

Billing and Subscription Management

We process personal information to:

• create invoices;
• calculate taxes where applicable;
• manage subscriptions;
• process payments through Stripe;
• prevent payment fraud;
• manage renewals;
• manage cancellations;
• maintain accounting records;
• comply with financial reporting obligations.

Customer Support

Personal information may be processed to:

• respond to support requests;
• investigate technical issues;
• verify account ownership;
• communicate regarding incidents;
• troubleshoot problems;
• provide guidance and assistance;
• improve customer experience.

Security and Fraud Prevention

We process personal information to:

• detect unauthorized access;
• prevent fraud;
• detect abuse;
• investigate suspicious activities;
• protect user accounts;
• maintain audit logs;
• secure infrastructure;
• respond to incidents;
• comply with security obligations.

Product Improvement

Subject to applicable law, we may process information to:

• improve existing features;
• develop new functionality;
• analyze usage patterns;
• optimize performance;
• improve user experience;
• detect usability problems;
• improve AI-assisted features;
• evaluate system reliability.

Whenever reasonably possible, we use aggregated or de-identified information for these purposes.

Communications

We process personal information to:

• send service-related emails;
• notify Users regarding security;
• send password reset emails;
• provide billing notifications;
• notify Users about maintenance;
• communicate regarding legal or contractual matters;
• send requested support communications.

Marketing communications are processed separately and, where required by law, only with the appropriate consent.

Compliance with Legal Obligations

We may process personal information where necessary to:

• comply with accounting obligations;
• comply with tax laws;
• comply with anti-fraud requirements;
• comply with court orders;
• comply with lawful governmental requests;
• comply with applicable regulations;
• establish, exercise or defend legal claims.

Where the General Data Protection Regulation ("GDPR"), the UK GDPR or similar legislation applies, SiteAlytic processes personal information on one or more lawful bases.

Depending on the circumstances, these may include:

Performance of a Contract

Processing is necessary to:

• create Accounts;
• provide the Services;
• manage subscriptions;
• deliver requested functionality;
• process payments;
• provide customer support;
• fulfill contractual obligations.

Legitimate Interests

We may process personal information where necessary for our legitimate interests, provided that such interests are not overridden by the rights and freedoms of the individual.

Legitimate interests may include:

• protecting the Platform;
• improving the Services;
• preventing fraud;
• ensuring network security;
• administering customer relationships;
• defending legal claims;
• managing business operations;
• analyzing platform usage;
• improving product performance.

Legal Obligations

Processing may be required to comply with:

• tax legislation;
• accounting requirements;
• anti-money laundering obligations;
• court orders;
• regulatory requests;
• law enforcement requests;
• mandatory record retention.

Consent

Where required by applicable law, we rely on consent for:

• non-essential cookies;
• analytics technologies;
• certain marketing communications;
• optional notification features;
• other processing where consent is legally required.

Consent may be withdrawn at any time without affecting processing carried out before the withdrawal.

SiteAlytic uses cookies and similar technologies to operate, secure and improve the Services.

Cookies are small text files stored on a User's device.

We may use:

Strictly Necessary Cookies

These cookies are essential for:

• user authentication;
• session management;
• security;
• fraud prevention;
• load balancing;
• remembering cookie preferences.

These cookies cannot generally be disabled because the Platform cannot operate correctly without them.

Analytics Cookies

Where permitted by law, analytics cookies help us understand:

• website traffic;
• user behavior;
• page performance;
• feature usage;
• technical performance;
• error rates.

Analytics information helps us improve the Services.

Functional Cookies

These cookies may remember:

• language preferences;
• interface settings;
• display options;
• user preferences;
• previously selected options.

Future Marketing Cookies

At the time this Privacy Policy was last updated, SiteAlytic does not use advertising cookies for behavioral advertising within the Platform.

Should this change in the future, this Privacy Policy and the cookie management interface will be updated accordingly.

Users can manage cookie preferences through:

• the SiteAlytic cookie banner;
• browser settings;
• applicable browser privacy controls.

SiteAlytic uses Google Analytics to better understand how visitors use our websites and Services.

Google Analytics may collect information such as:

• pages visited;
• browser type;
• operating system;
• approximate geographic location;
• referral source;
• session duration;
• interactions;
• device characteristics.

Google Analytics operates using cookies and similar technologies.

Where required by law, analytics technologies are activated only after the User has provided the required consent.

Google may process certain information on servers located in different countries in accordance with Google's own privacy practices.

More information is available in Google's Privacy Policy.

All online Subscription payments are processed by Stripe.

SiteAlytic does not store:

• complete payment card numbers;
• CVV security codes;
• sensitive authentication information.

Stripe may process:

• payment information;
• billing information;
• transaction identifiers;
• payment method information;
• fraud prevention information;
• tax information.

Stripe processes such information in accordance with its own Privacy Policy and contractual terms.

To operate the Services, SiteAlytic uses carefully selected third-party providers.

These providers may process limited personal information on our behalf.

Current providers include:

Base44

Application infrastructure, backend services and hosting functionality.

Cloudflare

Security, CDN, DNS, network protection, performance optimization and cloud infrastructure.

Cloudflare R2 may be used for secure storage of files uploaded by Customers.

Brevo

Transactional emails, account notifications, password resets and service communications.

Stripe

Subscription billing and payment processing.

Google

Analytics services and other technical services where applicable.

We require our providers to maintain appropriate contractual, organizational and technical safeguards consistent with applicable data protection legislation.

SiteAlytic provides Services to Customers around the world.

Accordingly, personal information may be processed in countries other than the country in which the individual is located.

Where personal information is transferred internationally, we implement appropriate safeguards where required by applicable law.

Such safeguards may include:

• Standard Contractual Clauses;
• contractual commitments;
• technical and organizational measures;
• encryption;
• access controls;
• provider compliance mechanisms;
• other legally recognized transfer mechanisms.

International transfers are carried out only where an appropriate legal basis exists.

SiteAlytic does not sell personal information.

We may share personal information only where necessary with:

• authorized Users within the Customer's organization;
• payment providers;
• cloud infrastructure providers;
• analytics providers;
• communication providers;
• legal advisors;
• accountants;
• auditors;
• regulatory authorities;
• law enforcement where legally required;
• courts;
• successors in the event of a merger, acquisition or sale of assets.

All sharing is limited to what is reasonably necessary for the relevant purpose.

SiteAlytic retains personal information only for as long as it is reasonably necessary to fulfill the purposes described in this Privacy Policy, comply with applicable legal obligations, resolve disputes, enforce agreements, maintain security, or protect the legitimate interests of SiteAlytic and its Customers.

The applicable retention period depends on the type of information involved.

Account Information

Information relating to user accounts, organization accounts and subscriptions is generally retained for the duration of the active relationship and for a reasonable period thereafter to enable account recovery, dispute resolution, auditing and legal compliance.

Customer Data

Customer Data remains available while the Customer maintains an active Subscription, unless deleted earlier by the Customer or its authorized Administrator.

Following termination or deletion of an Account, Customer Data may remain temporarily available for export during a limited post-termination period, where such functionality is provided.

After the applicable retention period expires, Customer Data will be securely deleted or irreversibly anonymized, unless continued retention is required by law.

Billing and Accounting Records

Invoices, payment records, tax documentation and related accounting information may be retained for the period required by applicable accounting, tax and financial reporting laws.

Security Logs

Authentication records, audit logs, security events and related technical information may be retained for longer periods where reasonably necessary to:

• investigate incidents;
• detect fraud;
• protect the Platform;
• defend legal claims;
• comply with regulatory obligations.

Backup Copies

Deleted information may temporarily remain within encrypted backup systems until the applicable backup retention cycle expires.

Backup copies are not actively used except where necessary for disaster recovery, business continuity or legal compliance.

Depending on your country of residence and applicable law, you may have certain rights regarding your personal information.

These rights may include:

Right of Access

You may request confirmation as to whether SiteAlytic processes your personal information and request access to such information.

Right to Rectification

You may request correction of inaccurate or incomplete personal information.

Right to Erasure

You may request deletion of personal information where applicable legal requirements are met.

Certain information may continue to be retained where required by law or necessary for legitimate legal purposes.

Right to Restriction

You may request restriction of processing in circumstances recognized by applicable law.

Right to Object

Where processing is based on legitimate interests, you may object to such processing where applicable law grants that right.

Right to Data Portability

Where legally applicable, you may request that personal information be provided in a structured, commonly used and machine-readable format.

Right to Withdraw Consent

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal does not affect processing carried out before consent was withdrawn.

Right to Lodge a Complaint

Individuals located in jurisdictions providing supervisory authorities may lodge complaints with the competent authority.

For individuals located within Bulgaria, complaints may generally be submitted to the Bulgarian Commission for Personal Data Protection.

Individuals located in other jurisdictions may contact the supervisory authority responsible for their country or region.

Where applicable under California law, eligible California residents may have rights regarding personal information, including the right to:

• know what categories of personal information are collected;
• request access to personal information;
• request deletion;
• request correction;
• receive information regarding categories of disclosures;
• exercise rights without unlawful discrimination.

SiteAlytic does not sell personal information and does not knowingly share personal information for cross-context behavioral advertising as those terms are defined under applicable California privacy legislation.

Where applicable, individuals located in the United Kingdom, Canada or Australia may exercise rights available under their respective privacy legislation.

SiteAlytic will respond to privacy requests in accordance with the applicable legal requirements of the relevant jurisdiction.

SiteAlytic does not use personal information to make decisions that produce solely automated legal or similarly significant effects on individuals without appropriate human involvement.

Certain Platform features may provide automated recommendations, analytics, AI-generated summaries or similar assistance.

Such functionality is intended solely to assist Users and does not replace human judgment.

Users remain responsible for reviewing all recommendations before relying upon them.

SiteAlytic may offer AI-powered functionality.

AI-generated content may include:

• summaries;
• recommendations;
• classifications;
• reports;
• document analysis;
• workflow suggestions;
• forecasting;
• other informational outputs.

AI-generated outputs may occasionally contain inaccuracies.

Users remain responsible for verifying all information before relying upon it.

SiteAlytic does not use Customer Data to train general-purpose third-party artificial intelligence models unless:

• this is expressly disclosed;
• an appropriate legal basis exists;
• applicable law permits such processing.

SiteAlytic implements reasonable technical, organizational and administrative measures designed to protect personal information.

Such measures may include:

• HTTPS encryption;
• encrypted communications;
• role-based access controls;
• authentication controls;
• audit logging;
• security monitoring;
• infrastructure protection;
• backup systems;
• vulnerability management;
• incident response procedures;
• employee confidentiality obligations.

Despite these measures, no internet-based service can guarantee absolute security.

Users are responsible for maintaining the confidentiality of their credentials and for implementing appropriate security measures within their own organizations.

Where required by applicable law, SiteAlytic will notify affected Customers or individuals of confirmed personal-data breaches without undue delay.

Notifications may include:

• the nature of the incident;
• categories of affected information;
• likely consequences;
• actions already taken;
• recommended actions;
• contact details for further information.

SiteAlytic is intended for business use.

The Services are not directed toward children under the age of eighteen (18).

We do not knowingly collect personal information directly from children.

If we become aware that personal information relating to a child has been collected contrary to applicable law, we will take reasonable steps to delete such information.

Users may request deletion of their Account by:

• using the Account settings, where available;
• contacting their organization Administrator;
• contacting SiteAlytic at:

support.sitealytic@gmail.com

Deletion requests are processed in accordance with:

• this Privacy Policy;
• the Account Deletion Policy;
• the Data Processing Agreement;
• applicable legal obligations.

Deletion of an individual User Account does not necessarily delete an organization's Customer Data.

Organization-wide deletion requests must be initiated by an authorized Administrator.

SiteAlytic may update this Privacy Policy from time to time.

Changes may be made to reflect:

• changes in applicable law;
• changes to the Services;
• introduction of new functionality;
• changes to infrastructure providers;
• security improvements;
• operational changes;
• clarification of existing provisions.

The updated Privacy Policy will indicate the date of the latest revision.

Where required by applicable law, SiteAlytic will provide appropriate notice before material changes become effective.

Continued use of the Services after the effective date constitutes acceptance of the revised Privacy Policy, where permitted by applicable law.

If you have any questions regarding this Privacy Policy or wish to exercise your privacy rights, please contact:

SiteAlytic

Operated by:

YSP LOGISTIK 2000 EOOD

Registration No.: 207700929

VAT No.: BG207700929

25 Shipka St.

Plovdiv

Bulgaria

Email:

support.sitealytic@gmail.com

Websites:

https://sitealytic.com

https://app.sitealytic.com

Effective Date: 01.08.2026

Last Updated: 01.08.2026

End of Privacy Policy