Skip to content

Privacy

Last updated 21 September 2026

The short version. We hold your email, the connection to your WordPress site, and the conversations you have with your agent. We use them to do the work you ask for and to bill you correctly. We do not sell anything to anyone. You can delete a site yourself, and have your account deleted by asking.

Who this covers

This page covers SiteSelf: the website at siteself.com, the agent you talk to in Slack or Telegram, and SiteSelf Connector, the plugin that connects it to your WordPress site. Refact operates the service. If you want to reach a person about anything here, write to dev@refact.co. Every legal document is listed on the legal page.

Two kinds of data, two roles

  • Data about you. Your account, your billing and your conversations with your agent. We decide how this is used, so for this data we are the controller.
  • Data on your site. Your site may hold personal data about other people: your customers, commenters, subscribers and anyone who fills in a form. Your agent handles it only to do the work you ask for. For this data you are the controller and we process it on your behalf.

What we collect

  • Your account. An email address and a password, which is stored hashed. We cannot read it and cannot tell you what it is.
  • Your site connection. The address of your WordPress site and an application password your WordPress issues for SiteSelf when you approve the connection. Our servers hold it and your agent never receives it. You can revoke it from your WordPress admin at any time, without asking us.
  • Server access, if you connect it. A key that lets your agent sign in to your server, and, if you connect one, access to your code on GitHub limited to that one project.
  • What you ask for. The messages you exchange with your agent, and what it read or changed on your site while carrying the work out.
  • Usage. How much work each task took, so your balance is accurate and you can see what a task cost.
  • Payment. If you subscribe, Stripe processes the payment and tells us that it succeeded. Card numbers never reach our servers and we never see them.

Copies of your site

On a site connected with server access, your agent takes a backup before many kinds of change: a copy of your site's database and files, so a change can be undone. A WordPress database holds your own customers' personal data, such as comment authors, orders, form entries and subscriber lists, so your agent's backup does too. Your agent makes each one on your own server and keeps it there, in a private folder your website does not serve. Anyone with access to the server account you connected can reach it, your agent included, and nothing in it is copied to our servers. Your agent keeps the newest 5 and deletes older ones as new ones are made. Your agent's backups taken before 24 September 2026 are on our servers: up to 10 per site, and we delete any but the newest after 14 days.

If your site runs a store, reading its orders returns your buyers' names, addresses, email addresses and phone numbers. Those reads are recorded by the address they reached, as every request through our servers is, but we do not yet count how many buyers' records were read.

What we do with it, and why

  • To run the service you signed up for: doing the work you ask for, showing you what changed, keeping your balance right and reaching you about your account.
  • To meet legal obligations: keeping billing records for as long as tax and accounting rules require.
  • In our legitimate interests: finding and fixing faults, keeping the service secure, reviewing the quality of your agent's work, and understanding how visitors use this website. You can object to any of these by writing to us.

We do not sell personal data, we do not share it for advertising, and we do not use the contents of your site or your conversations to train models. Anthropic's commercial terms do not allow it to train models on our customers' content either.

We also review conversations with your agent to check the quality of its work, and we may use a conversation to test and improve the agent. The review is done by a separate model and by people at Refact, it never contacts you or changes your site, and it uses nothing a conversation does not already hold.

Your activity log

Your dashboard shows a log of what your agent did on your site, and it is the same record we hold — not a summary of one. Three things are worth knowing about it.

  • Work on your server is recorded in full, as the command that ran. A paraphrase would not be evidence of anything, which is the point of showing it.
  • Requests to your website are recorded as the address they reached, not what they contained.
  • Passwords and keys are removed before anything is written down. The stripping happens where the work runs, so a secret never reaches our database rather than being hidden after it arrives.

The log also records whether a piece of work went through SiteSelf’s own tooling or opened a plain shell session, because that is the difference between work carried out with the safeguards those tools apply and work carried out without them. Entries are kept for 365 days.

Who else processes it

These companies process data for us, only to provide their part of the service. The sub-processors page says what each one handles and on what basis, and is where we give notice of a new one.

  • Anthropic (United States): The AI model behind the agent.
  • DigitalOcean (United States (New York)): The servers the agent and its activity log run on, and where your agent's backups taken before 24 September 2026 are kept.
  • Netlify (United States): Hosts the SiteSelf website and dashboard.
  • Resend (United States): Sends account emails.
  • Stripe (United States): Payments and subscription management.
  • Google Analytics (United States): Counts visits to the SiteSelf website.

Anthropic deletes what we send it within 30 days, except content its safety systems flag, which it keeps for up to 2 years, and the safety scores it assigns, which it keeps for up to 7 years. We do not send your email, passwords, site addresses or conversation contents to Google Analytics.

If you are in the UK or the European Economic Area, using the service transfers your data to the United States. We rely on the safeguards in each provider's own data-processing terms, such as standard contractual clauses. If you are a business and your site holds other people's data, our data processing agreement covers it.

The chat app you use

  • Telegram. Runs its own service under its own privacy terms. Messages to a bot are not end-to-end encrypted, so Telegram can read them.
  • Slack. Your workspace is your own agreement with Slack, and your messages to your agent pass through it under those terms.

Keeping customers apart

Your agent runs in its own isolated workspace, with nothing belonging to another customer in it. It never holds your WordPress application password: our servers hold that and make requests to your site on its behalf, recording each one. What your agent does hold is a key to SiteSelf that works only for that site and can be withdrawn, and, if you connected them, the server key and code access described above.

How long we keep it

  • Your account, site connection and conversations: while your account is open.
  • Your activity log: 365 days.
  • Your agent's backups on your server: the newest 5, older ones deleted as new ones are made.
  • Your agent's backups taken before 24 September 2026, on our servers: up to 10 per site, any but the newest deleted after 14 days.
  • Billing records: as long as tax and accounting rules require.

Deleting your data

You can delete a site from your dashboard. That removes its connection, the keys we held for it and your agent's workspace from our servers. We keep a record that the site was connected, with its address, so it can be connected again cleanly. To delete your account, write to dev@refact.co; there is no button for it yet.

Deleting does not reach everything, and these stay:

  • On your site: SiteSelf's application password until you revoke it in WordPress, our key and your agent's backups on your server until you remove them, and the last 25 file versions SiteSelf Connector keeps in your database.
  • At Anthropic: anything already sent, until its retention period above ends.
  • With us: records the law requires us to keep, such as billing records.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, delete it, limit how we use it or hand it over in a portable form, and object to how we use it. Write to dev@refact.co. We reply within one month. You do not need to give a reason, and asking will not affect how you are treated.

If you are unhappy with our answer, you can complain to a data protection authority: the Information Commissioner's Office in the UK, or the authority where you live in the European Economic Area.

You can cut your agent's access to your site off yourself, at any moment, by revoking SiteSelf's application password in your WordPress admin and, if you connected server access, removing SiteSelf's key from your server. That takes effect immediately and does not involve us. The terms say what else to remove when you leave.

Cookies

The site uses a session cookie to keep you signed in. It is required for the site to work and it is not used to track you. Google Analytics sets its own cookies to tell one visit from another; it helps us understand which pages lead to signups and how visitors use the website. Advertising features are disabled. Password-reset and connection-approval pages are excluded.

If you would rather not be counted, a browser extension or your browser's tracking protection will block Google Analytics without affecting the service. You can contact us about deleting information already collected.

Changes

If this page changes in a way that affects you, we will tell you rather than quietly updating the date. The date at the top always reflects the current version.