Privacy Policy

Liite is run by [Company legal name], [Registered address]. For your account data we are the controller. For data your visitors give you through your site (form messages, subscriber emails, reviews), you are the controller and we process it for you, as described in section 5.

• Account: your name, email address and password (stored only as a salted scrypt hash). If you sign in with Google or GitHub, the name, email and avatar they share.
• What you create: pages, uploaded files, media, short links, collections and their items, pastes, print drops, lists, review pages, audits and your agency profile.
• Billing: your plan, trial dates and the customer and subscription IDs Polar gives us. Polar collects your card and billing address directly; we never see full card numbers.
• Keys: an Anthropic key saved on an agency profile is encrypted (AES-256-GCM) and never sent back to the browser; we show its last four characters.
• Security and limits: sign-in attempts and request counts used for rate limits, keyed by a hashed IP address that changes every day, and the hosting provider's request logs.

Liite's own analytics (for pages, uploaded sites and short links) use no cookies and store no personal data. For each view or click we add one to daily totals: the page, the referring site, the country, the device type, the operating system, the browser, UTM tags and whether it came from a QR code.

To count unique visitors we combine the IP address and browser string with a secret that changes every day and hash them. The hash is kept for up to 36 hours so the same visitor isn't counted twice that day, then deleted. It is never stored with the totals and can't be turned back into an IP address.

Your analytics history is kept for 7 days on Free, 90 days on Pro, 2 years on Business.

Liite sets only cookies needed for things you ask it to do. None are for advertising or tracking.

• Sign-in: a session cookie on liite.co only (HttpOnly, Secure), never on liite.site.
• Password-protected pages and links: after a visitor enters the right password, a cookie for that one page or site keeps it unlocked for 30 days.
• Print drops: after someone enters a drop code, a cookie lets them open its files for 30 minutes.

Some choices are kept in your browser's local storage instead, and never sent to us: your own AI key (if you add one), the name you tick a shared list with, a visitor's answer to a site's consent banner, and drafts in our free tools.

Site owners can add their own tracking pixels (for example Google Analytics or Meta) to their pages. Those set cookies under the owner's control, and Liite offers them a consent banner. HTML uploaded to liite.site is the owner's own code and may set its own cookies.

When visitors use features on a site built with Liite, we store what they send for the site owner:

• Forms: the fields the visitor fills in, plus a daily-salted hash of their IP address for spam limits. Kept for 30 days on Free, 1 year on Pro, 5 years on Business, then deleted automatically.
• Email sign-ups: the email address, when it was confirmed and a private unsubscribe link. Each sign-up is confirmed by email before it gets broadcasts, and every broadcast includes a one-click unsubscribe.
• Reviews: name, role, rating, text and the visitor's consent to show it. The owner chooses what is shown.
• Audit reports: which sections a reader viewed and for how long, under a daily-salted hash, and anything they send through the report's “Accept” form.
• Reports: if you report a site, your reason, details and (optionally) your email address.

The site owner decides what to collect and why. If you gave your details through someone's Liite site, contact them first; if you can't reach them, email hi@liite.co and we'll help.

When you use an AI feature on Liite credits, we send your prompt and the content the task needs (for example a page's text, a photo of a menu for Snap, or the pages captured for an audit) to Anthropic, which returns the result. When AI creates a site, we keep the prompt with it, for support and abuse review; it is deleted with the site.

If you use your own key from Anthropic, OpenAI, Google Gemini or OpenRouter, the key stays in your browser and requests go straight from your browser to that provider. We receive only the result, to check it and save it to your site.

When you audit a website, we visit its public pages the way a browser would (following robots.txt), take screenshots and read the text, and ask Google PageSpeed Insights for speed scores. Captures are cached for 24 hours so a second run doesn't visit the site again; the finished report lives in your account until you delete it. Public pages can contain names or contact details; they are used only to write that report.

• To run Liite: publish and serve your sites, links and files, and show you your analytics.
• To keep it safe: scan uploads and links, handle reports, prevent spam and enforce plan limits.
• To bill you through Polar and apply your plan.
• To email you about your account and the features you use: a new form message, a site about to expire, a link that stopped working, a report that was opened.

Where data protection law such as the GDPR applies, we rely on: contract to provide the service you signed up for; legitimate interests to keep Liite secure, prevent abuse and improve it, in ways you'd expect; legal obligation for records we must keep; and consent where we ask for it, which you can withdraw at any time.

We use these services to run Liite. Each gets only what it needs for its job.

Vercel

Hosting, content delivery, serverless functions, custom domains and certificates.

Every request to liite.co, liite.site and connected domains (IP address, headers), and the app's logs. Used for every request.

Vercel Blob

File storage.

Published pages, uploaded files, media, print-drop files, audit screenshots and PDFs. Used for every request.

MongoDB Atlas

Database (hosted on AWS in the United States).

Accounts, sites, links, collections, form submissions, subscribers, reviews and aggregated analytics. Used for every request.

Resend

Email delivery.

Recipient address and the email's content (account email, notifications, broadcasts to subscribers). When we send an email.

Polar

Payments, as merchant of record (handles tax, invoices and refunds).

Name, email, billing address and payment details, which Polar collects directly. When you start a trial or buy a plan.

Anthropic

AI features on Liite credits, and website audits.

Your prompt and the content needed for the task (page text, photos for Snap, captured pages for an audit). When you use an AI feature or run an audit.

Google PageSpeed Insights

Speed measurements in website audits.

The public web address being audited. When you run an audit.

Cloudflare

Browser Rendering for website audits.

The public pages of the website being audited. When you run an audit.

Google Safe Browsing

Checking links for phishing and malware.

Web addresses in uploads, pages and short links. When you publish or save a link.

VirusTotal

Malware checks on paid-plan uploads.

A fingerprint (SHA-256 hash) of uploaded files, never the files themselves. When a paid plan uploads files.

If you sign in with Google or GitHub, they process your sign-in under their own policies. We don't sell personal data and we don't use it for advertising.

Our database runs in the United States and our hosting is global, so your data may be processed outside your country. Where the law requires it, we rely on [Transfer safeguard, e.g. the EU Standard Contractual Clauses] for these transfers.

• Account data: while your account is open.
• Visitor hashes for analytics: up to 36 hours.
• Analytics totals and form messages: as listed above for your plan.
• Print-drop files: deleted within an hour of the drop ending. Expired pastes are deleted the same way.
• Audit captures: 24 hours (the report itself stays until you delete it).
• When you delete your account, your sites, files and the data collected through them are deleted straight away. Copies in backups expire within [backup retention period, e.g. 30 days]. Polar keeps payment records as tax law requires.

Everything is served over HTTPS. Passwords and secret edit links are stored as hashes; stored AI keys are encrypted. Uploaded HTML runs on liite.site, a separate domain from the dashboard, so code on someone's site can't reach your Liite account. No system is perfectly secure; if we learn of a breach that affects you, we'll tell you and the relevant authority as the law requires.

Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent. Most of this you can do yourself:

• Export: Account settings → Your data downloads a JSON file with your account, sites, links, collections, form messages, subscribers, lists and pastes.
• Delete: Account settings → Delete account removes your account and everything in it. Cancel a renewing subscription in Billing first.
• Correct: edit your name and everything you publish in the dashboard.

For anything else, email hi@liite.co. We'll answer within the time the law sets. You can also complain to your local data protection authority.

Liite isn't meant for children. You must be at least 16 to have an account.

We'll update this page when what we collect or who processes it changes, and change the date at the top. If a change matters, we'll email you before it applies. The full list of the services we use is always in section 10.