NG Sites

Legal

Back to NG Sites

01Legal

NG Sites Privacy Policy

This Privacy Policy explains how NG Technology LLC ("NG Technology," "we," "us") handles personal information in NG Sites: the hosted websites we run for our customers, their Admin, My Website, the start, sign-in, and setup pages, and the emails we send (together, the "Service"). It covers two kinds of information:

  • information about our customers, the businesses that subscribe to the Service and the people who act for them ("Customers"), which we handle as a business;
  • information about the visitors of a Customer's website, which we process on the Customer's behalf, as its service provider (Section 4).

Each Customer's website has its own privacy policy, which the Customer is responsible for. Our company website, ng-technology.org, has its own privacy policy.

1. Information we collect about Customers

  • Account and billing. Your email address, and the Stripe identifiers of your customer record and subscription. Stripe collects your payment details on its checkout page; we never receive your card number. We record your subscription's status, its Free Trial, and its dates.
  • Setup details. What you enter when you set up your website: your name, the professional details your plan asks for (such as a license number and the business you work under), your phone number, contact email, address if you give one, and your photo. These details are published on your website, which is their purpose.
  • Your website's content. What you and the people and AI assistants you authorize put in your website and its Admin.
  • Terms acceptance. The versions of the Terms of Service and Industry Addendum you accepted, the time, and the Stripe Checkout Session in which you accepted them.
  • Signing in to My Website. A sign-in to My Website uses a single-use link sent to your address and a session cookie that keeps you signed in for up to 12 hours. Links and sessions are stored only as one-way hashes. To limit sign-in requests, we keep a keyed hash of the requesting IP address for about an hour.
  • Signing in to the Admin. Your website's Admin has its own accounts: yours, those of the people you add, and our team's (Terms, Section 3). Each holds an email address, a name, and, if one is set, a password stored only as a one-way hash. An Admin session keeps a User signed in until 7 days pass without use, or until they sign out, and records the IP address and browser it was started from.
  • Your preferences. The language you read My Website in, which your browser also stores locally, and your website's address for up to an hour while you sign in. The Admin keeps its language in a cookie for one year, and your browser stores the preview device you last chose in it.
  • Bot protection. Cloudflare Turnstile checks that a person, not a bot, uses the start and sign-in pages. It receives your IP address, your browser's details, such as its user agent, and other technical signals from your browser and device. Cloudflare uses them to run the check, and, under its own privacy policy, to improve its bot detection.
  • Technical information. Our servers' logs of requests, which include IP addresses and browser details, are kept for 7 days for security and to fix problems. If a page of My Website, the start, sign-in, or setup pages, or the Admin hits an error, the browser may send an error report (Section 5).
  • Messages. What you send to our support address, and the feedback you send us from the Service (from My Website or your Admin, or by an AI assistant you work with, with your agreement), with your email address or the assistant's name, and what the Service attaches to it: the page you were on, your website, the language, your browser, and the version of the Service. We use it to answer you and to improve the Service. If we copy feedback into the tools we use to track our work, we remove personal information from it first.

2. How we use Customer information

We use it to provide the Service: to open, run, and support your website; to sign you in; to send the emails the Service needs, such as sign-in links, your website's welcome, a reminder before your Free Trial ends, and notices about your subscription and your domain; to bill you through Stripe; to keep the Service secure and fix problems; to enforce our Terms; and to meet legal obligations. We send no marketing email through the Service.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. The start, sign-in, setup, and My Website pages contain no advertising and do no tracking across other websites. They use two third-party services: Cloudflare Turnstile against bots on the start and sign-in pages (Section 1), and Sentry for error reports (Section 5).

3. How long we keep Customer information

  • Sign-in links expire after 15 minutes; a My Website session ends after 12 hours or when you sign out. The hashes kept to limit sign-in requests are deleted after about an hour.
  • Our servers' request logs are kept for 7 days.
  • A website draft, with the setup details in it, is kept until you delete it, or deleted once 30 days pass without a change to it. Your setup details are erased from our records once your website has been set up with them, or when its order is cancelled before the website opens.
  • Your website's content, its Admin accounts, and their sessions are kept while you subscribe and during the 30-day suspension after a subscription ends. They are then deleted, with every remaining copy, including our internal export, within 90 days of the website's removal. A Website Data Export you create stays available for 7 days.
  • Your email address and language, including your address on the feedback you sent us, are kept while you have a website or a website draft with us. Once you have neither, they are erased 89 days after your last website was removed, you last signed in, or you last ordered a website, whichever is latest.
  • After that, we keep only records that hold no name or email address: identifiers, Stripe identifiers, the codes and times of events in your account's history, and the terms acceptance record, as evidence of our dealings with you, and the text of your feedback, without your address, to improve the Service. Stripe keeps its own records of payments under its own policy.

4. Visitors of Customers' websites

When someone visits a Customer's website, we process the following on the Customer's behalf, under the Customer's instructions and for no other purpose. Section 21 of our Terms of Service sets out our promises to the Customer about it.

  • Inquiries. What a visitor sends through the website's forms: their name, email address, and phone number; the kind of request and their message; for a home valuation, the property's address and type; for a buyer consultation, their budget, the areas they are looking in, and their timeline; the listing or community they asked about; whether they agreed to be contacted, and the consent text they were shown; and the page and language they sent it from. It is stored in the website's own database for the Customer to read in the Admin, where the Customer may add a status and notes. The Customer may also be emailed about each inquiry. Customers may handle inquiries with other service providers, including AI tools they connect to their website.
  • Statistics. Page views counted with Umami, an analytics tool we run on our own server. Umami receives the visitor's IP address and browser details, through the website's own address, to estimate their approximate location and to count unique visitors; it does not store the IP address, and it sets no cookie. When a visitor sends a form, the website also counts that with Umami, with the same details. The Customer sees totals such as views, sources, devices, and countries.
  • Bot protection. On the website's platform address, its forms are protected by Cloudflare Turnstile, which receives the visitor's IP address, browser details, and other technical signals, as in Section 1; it loads only on a page with a form. A website reached at its own domain (a Personal Domain) does not use Turnstile.
  • Advertising tags. A Customer may add a Meta Pixel or a Google tag to their website. Those tags load only after a visitor accepts them in the website's consent banner, and never after a rejection or with a Global Privacy Control signal. Meta and Google then handle that data under their own policies.
  • Server logs, as in Section 1.

A visitor who wants to access, correct, or delete their information should contact the Customer whose website they used. If a visitor contacts us, we pass the request on to that Customer. A Customer's website data is deleted when the website is deleted, as in Section 3.

5. Service providers

We use these service providers to run the Service, each only for the purpose listed, and each bound by contract to protect the information it receives:

  • Cloudflare, Inc. Purpose: hosts the Service and the websites, stores their databases, files, and logs, processes images and videos, sends our emails and the websites' emails, receives email sent to our support address, and runs Turnstile. Data: everything the Service stores, including Customer and visitor information, and the request details in Sections 1 and 4. Location: the United States, and Cloudflare's network around the world, which serves the websites.
  • Stripe, Inc. Purpose: payments, checkout, the page where you update your card, invoices, and receipts. Data: your email address, payment details, and billing history. Stripe also handles payment data under its own privacy policy. Location: the United States.
  • Functional Software, Inc. (Sentry). Purpose: error reports from My Website, the start, sign-in, and setup pages, and the Admin. Data: the error, the page, and the browser. Reports leave out typed text, cookies, and request bodies; email addresses are replaced; and Sentry is set not to store IP addresses. A recording of the page around an error may be kept, with all text and inputs masked and images blocked. Location: the United States.
  • Google LLC (Google Workspace). Purpose: our business mailbox, where we read and answer email sent to our support address. Data: what you send us. Location: the United States, and other countries where Google operates.
  • Our Umami server. Purpose: the websites' statistics, as in Section 4. We run Umami ourselves on a server we rent. Data: page views, with the details in Section 4. Location: the United States.
  • AI services that help our staff support you. Purpose: help our staff answer you and work on your website when you ask, through our team's AI identity (Terms, Section 3). Data: what our staff work on with them, which may include your website's content, settings, and inquiries, and the messages you send us. Location: the United States.

Before a new service provider processes visitors' information, we add it to this list and email Customers. Services a Customer adds to their website, such as a Meta Pixel, a Google tag, or the AI assistant they connect, are the Customer's own, not our service providers.

We may also disclose information when the law requires it, to protect our rights or someone's safety, or to a buyer of the business, which must keep this Policy's commitments.

6. Security

We protect information with encryption in transit, access limited to the staff who need it, single-use sign-in links, and hashed tokens and passwords. No service is perfectly secure; tell us at once at the address below if you believe your account is at risk.

If we learn that your personal information was accessed or acquired without authorization, we tell you without undue delay. If it is visitors' information we process for a Customer, we tell the Customer immediately after we discover it, as Section 21 of our Terms of Service says.

7. Your rights

Whether or not a law requires it, you may ask us to tell you what personal information we hold about you, to give you a copy, to correct it, or to delete it, and we will not treat you differently for asking. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you.

To make a request, email us at the address below. We verify a request by confirming it from the email address on your account, and you may use an authorized agent. We answer within 45 days. Some information may be kept where the law allows, such as billing records and the terms acceptance record.

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing.

Do Not Track. Our pages do not respond to browser Do Not Track signals, because they do no tracking across other websites. No other party collects personal information about your activity over time and across websites through our pages, except that Cloudflare, through Turnstile, may use what it receives on the start and sign-in pages to improve its bot detection across the websites that use Turnstile (Section 1).

Global Privacy Control. Customers' websites honor a Global Privacy Control signal as in Section 4.

8. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18.

9. Where information is processed

The Service is offered only to businesses in the United States. It is not directed to people in the European Union or the United Kingdom. We are based in the United States, and our service providers process information in the United States and in the other countries listed in Section 5.

10. Changes to this Policy

We email Customers about a material change at least 30 days before it takes effect. A change that is not material takes effect when we post it. Each version carries its version and effective date, and earlier versions stay available from this page.

Contact

NG Technology LLC, [[PENDING: street address]]. Privacy questions and requests: help@support.ng-technology.org.