Who is responsible?
This policy covers the ORYSITE platform, website requests, customer accounts and service communications. ORYSITE’s management acts as the person responsible for the protection of personal information. For questions, access requests or complaints, email [email protected] with the subject “Privacy”.
What we collect and why
You provide contact details, information about your business, services and pages, and any files you choose to share. These details help us assess your request, prepare the website, obtain approvals and provide support.
Your account uses your email address and sign-in codes. Tickets, attachments and website form messages help us handle your requests and those of your visitors. Do not submit medical information, card numbers or identity documents through these forms.
For subscriptions, we store payment references and statuses needed to operate the service. Stripe processes card details; we do not store full card numbers or security codes. For domains, registrant details and extension-specific eligibility information are used for registration. Saving a profile for future domains is optional.
Technical information such as IP addresses, timestamps, sign-in events and errors supports security, abuse prevention and service operation.
Who receives information?
The person creating and managing your website accesses information needed for that work. Providers process information for their respective services: Supabase for the database and authentication; Railway and Cloudflare for infrastructure, storage and spam protection; Resend for sending and receiving email; Stripe for payments; OpenSRS/Tucows and the relevant registry for domains.
AI and design tools used during creation, including Codex/OpenAI and Superdesign, may receive the brief and content needed for the website. Payment information, sign-in codes and a domain registrant’s private details are not part of the creative brief.
Some providers may process or store information outside Québec and Canada. We do not sell your personal information, and requesting a website does not subscribe you to a marketing list.
Information made public
Your preview remains private. Information intended for your website becomes public only after approval and publication. You choose the business contact details to display. Domain registrant details may be shared with the registrar or registry under their rules; registration-data privacy depends on the extension.
When a visitor uses a client website’s form, the receiving business gets the information and is responsible for its own follow-up. ORYSITE hosts and forwards it as part of the service. That business’s policy applies to its own use.
Cookies and preferences
Session cookies and security mechanisms support sign-in, private previews and abuse prevention. Your browser may store language preferences and draft information needed for the journey. You can remove these in your browser settings; doing so may sign you out or remove an unsent draft.
The current platform does not install a Meta advertising pixel or Google Analytics. If this changes, we will update this information and the required choices before activation.
Email replies
When direct replies are offered, your message and permitted attachments are linked to your project. ORYSITE may record information and explicit agreements with their source message. Linked messages follow project retention; unidentified or unverified messages are deleted after 30 days. Backups expire within the following 30 days.
Retention and protection
Project content remains available during the service. An unaccepted preview is subject to retention for 30 days after its latest sharing. After cancellation, the announced export period is 30 days from the end of the paid period. Content is then removed from the service and deletion begins. Separately stored files may require manual cleanup verified by ORYSITE, so removal does not guarantee immediate erasure of every copy. Backups expire on their 30-day cycle. You may request confirmation of how your deletion request was handled.
Deleting a project does not automatically close your account. Payment records, records needed to manage a domain and some security logs may be retained for applicable obligations, disputes or abuse prevention. Requests that never receive a preview are reviewed to limit retention to information still needed.
We use HTTPS, authenticated access, limited technical permissions and private storage for non-public information. Previews are not indexable. Backups support recovery after incidents; no safeguard eliminates all risk.
Your choices and rights
You may decline optional items such as photos or a Google Business Profile. Without information needed for sign-in, the project or a domain registration, we may be unable to provide the relevant service.
You can request access, corrections, an export, deletion where possible or withdrawal of consent. Email [email protected] or use your customer portal. We may verify your identity and explain which records must be retained. Withdrawal may prevent some operations from continuing.
For a complaint, describe what happened and your desired outcome using the same contact. The person responsible for personal information reviews the request and responds. You may also contact Québec’s Commission d’accès à l’information.
Updates
The date on this page identifies its latest revision. We will communicate significant changes through an appropriate channel, including the portal or email.