Skip to content

Privacy

Last updated 15 September 2026

The short version. We hold your email, a key your own WordPress issued to your agent, and the conversations you have with it. We use them to do the work you ask for and to bill you correctly. We do not sell anything to anyone, and you can have all of it deleted by asking.

Who this covers

This page covers SiteSelf — the website at siteself.com, the agent you talk to in Slack or Telegram, and the plugin that connects it to your WordPress site. Refact operates the service. If you want to reach a human about anything here, write to dev@refact.co.

What we collect

  • Your account. An email address and a password, which is stored hashed — we cannot read it and cannot tell you what it is.
  • Your site connection. The address of your WordPress site and an application password that your own WordPress issues to your agent when you approve the connection. It is scoped to the agent and you can revoke it from your WordPress at any time, without asking us.
  • What you ask for. The messages you exchange with your agent, and what it read or changed on your site while carrying the work out.
  • Usage. How much work each task took, so your balance is accurate and you can see what a task cost.
  • Payment. If you subscribe, Stripe processes the payment and tells us that it succeeded. Card numbers never reach our servers and we never see them.

What we do with it

We use it to run the service: to do the work you ask for, to show you what changed, to keep your balance right, to reach you about your account, and to find and fix faults. We do not sell personal data, we do not share it for advertising, and we do not use the contents of your site or your conversations to train models.

Your activity log

Your dashboard shows a log of what your agent did on your site, and it is the same record we hold — not a summary of one. Three things are worth knowing about it.

  • Work on your server is recorded in full, as the command that ran. A paraphrase would not be evidence of anything, which is the point of showing it.
  • Requests to your website are recorded as the address they reached,not what they contained.
  • Passwords and keys are removed before anything is written down.The stripping happens where the work runs, so a secret never reaches our database rather than being hidden after it arrives.

The log also records whether a piece of work went through SiteSelf’s own tooling or opened a plain shell session, because that is the difference between work carried out with the safeguards those tools apply and work carried out without them. Entries are kept for a year.

Who else processes it

Doing this work means handing some of it to other companies. The ones that matter:

  • Anthropic — the AI model behind your agent. The task you ask for, and the parts of your site needed to carry it out, are sent to Anthropic to be processed.
  • Slack and Telegram — whichever you choose to talk to your agent in. Your messages pass through that platform under its own privacy terms, not ours.
  • Stripe — payments and subscription management.
  • DigitalOcean — the servers the service runs on.

Keeping customers apart

Your agent runs in its own isolated container, with your credentials and nobody else's. It holds the key your WordPress issued it and nothing further — there is no shared login, and it cannot reach another customer's site.

How long we keep it

Your account, site connection and conversation history are kept while your account is open, because your agent needs the history to stay useful between conversations. Billing records are kept for as long as tax and accounting rules require. When you close your account we delete your data, except records we are obliged to keep.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to dev@refact.co and we will action it. You do not need to give a reason, and asking will not affect how you are treated.

You can cut your agent's access to your site off yourself, at any moment, by revoking its application password in your WordPress admin. That takes effect immediately and does not involve us.

Cookies

The site uses a session cookie to keep you signed in. It is required for the site to work and it is not used to track you. We use Google Analytics cookies to understand which pages people visit and how they use the website. Analytics is disabled on password-reset pages.

Changes

If this page changes in a way that affects you, we will tell you rather than quietly updating the date. The date at the top always reflects the current version.