Privacy policy.
The short version: we collect what we need to run your site and bill you. We do not sell personal information for money. Analytics is on by default and can be turned off through Privacy choices. Advertising measurement stays off until you choose it. You can delete your account yourself from your dashboard and we wipe everything immediately — no waiting, no support ticket.
1. Who we are
“Hands Free Sites” is operated by Fireproof Studio LLC, a Texas limited liability company.
2. What we collect
Information you give us: name, email, password, business description, billing details (Stripe handles cards; we never see them), domain info, content you publish, support emails. Automatic data includes service logs; a cookie-free first-party landing receipt containing campaign labels, landing path, referrer origin, and a random receipt ID; and a short-lived operational funnel record showing whether an anonymous visit reached the form, passed or failed validation, or submitted successfully. The operational record uses a random session identifier, broad browser category, landing path, and campaign labels already present in the visited URL. Neither record contains form contents, email, advertising cookies, advertising click IDs, a stored IP address, or a stored user agent. If you allow analytics, we also collect usage and device data, Google click identifiers, and longer-lived first-touch campaign context.
3. How we use it
To build, host, and operate your website. To bill you. To respond to support. To detect fraud and abuse. To send transactional emails (preview ready, payment failed) — these you can't opt out of. To send marketing emails only if you opted in.
We do not use your business description, content, or customer data to train AI models. AWS Bedrock is our AI provider; data sent there is not retained per their data protection terms.
4. Who we share it with
Sub-processors: AWS (hosting and email), Stripe (payments), Cloudflare (DNS, if you opt in), and Sentry (errors). If you enable optional measurement, Google Analytics receives usage data and Google Ads, Meta Pixel, and AdSense may receive online identifiers and campaign activity. Legal requirements: if subpoenaed. Business transfer: if we sell, the buyer is bound by this policy. We do not sell personal information for money or share it with data brokers.
5. Cookies
Essential storage keeps sign-in, fraud protection, submission reliability, and the short-lived anonymous operational funnel working. Our cookie-free first-party landing receipt does not read or write browser storage and is used only to reconcile advertising charges with submitted preview requests. Hands Free Sites uses Google Analytics and longer-lived first-touch campaign measurement by default so we can account for visits and advertising performance. Optional advertising measurement includes Google Ads, Meta Pixel, and AdSense and stays off until you choose it. The persistent “Privacy choices” control lets you reject or change either category at any time; rejecting analytics removes its browser data and prevents future analytics collection on this device.
6. Your rights
GDPR / CCPA / equivalent: access, correction, deletion, export, opt-out, withdraw consent. We extend these to all customers regardless of location. Email privacy@handsfreesites.com; we respond within 30 days, usually within 48 hours. (That 30 days is our response deadline for a rights request — it is not a deletion timeline. Deletion you do yourself from your dashboard is immediate; see section 7.)
7. Data retention
Deleted accounts leave the active product immediately. Deleting your account from dashboard settings cancels your subscription, signs you out, and tears down active sites, files, and DNS zones right away (the last of the live infrastructure clears within about 15 minutes). There is no waiting period or self-service undo. We keep a minimal deletion record (your email and the date), billing records required for tax, and encrypted database recovery points as described below.
Cancelling your subscription without deleting your account is different: active hosting follows the cancellation and recovery windows shown before you confirm. Active accounts: as long as you exist. Billing records: 7 years for tax. Encrypted database disaster-recovery points: up to 365 days, after which they expire automatically; these backups are isolated from the active product and are not a customer archive or guaranteed full-site restore. Server logs and anonymous operational funnel records: 90 days. Support emails: 3 years. Cookie-free landing receipts expire after 400 days. First-touch attribution in your browser expires after 90 days without extending on repeat visits; its anonymous session identifier expires after 30 minutes of inactivity; your privacy choice expires after 180 days so we ask again. Attribution attached to a submitted site follows that site/account's active-system deletion lifecycle and may remain in encrypted recovery points until those points expire.
8. Security
TLS in transit, AES-256 at rest. Passwords hashed with bcrypt. Cards tokenized by Stripe. Employee data access logged. Data breach notification within 72 hours.
9. International transfers
We're US-based. Servers in US-East-2 and US-West-2. EU/UK data transferred under the EU-US Data Privacy Framework.
10. Kids
Not for children. We don't knowingly collect data from under-13 (under-16 in EU). If you think we have data from a child, email privacy@handsfreesites.com.
11. Changes
Material changes: 30 days' email notice. Minor changes (typos, clarifications) update with new “last updated” date.
12. Contact us
Privacy: privacy@handsfreesites.com
Everything else: hello@handsfreesites.com
Mail: Fireproof Studio LLC, Attn: Privacy, Austin, TX USA
If anything is confusing, email us — we'd rather rewrite it than have you confused.