Terms

Last updated 21 September 2026

What the service is

SiteSelf connects to a WordPress site you already run and carries out work you request in chat — changing code, content, plugins and settings. Refact provides it. Using it means accepting these terms, the privacy notice, the data processing agreement and the plan described on the pricing page. Every legal document is listed on the legal page.

The service is still changing

The service is young and changing. Features will appear, change and occasionally be removed. It is provided as it is, and not as a finished product. If something you rely on is going away, we will tell you before it does.

Your account

Keep your password to yourself and tell us if you think someone else has it. You are responsible for what happens under your account, including what anyone you invite into your chat asks the agent to do.

Your site stays yours

You own your website, your content and your code. Nothing here transfers any of that to us. You must have the right to change every site you connect.

What you authorise the agent to do

By connecting a site and asking for work in chat, you authorise the agent to act on that site on your behalf to carry out what was asked. What it does in carrying out a request is done with your authority, whether you or someone you let into the chat made the request. You can withdraw that authority at any time by revoking SiteSelf's application password in your WordPress admin and, if you connected server access, removing SiteSelf's key from your server. Both take effect immediately and do not involve us.

Some things are never authorised. The agent writes to your WordPress site and its hosting and nowhere else: analytics, search consoles, CRMs, email platforms and ad accounts are read only, and nothing is written back to them. It must not act on a site you do not control.

The agent is instructed to tell you in the chat what is about to change, and whether it can be undone, before it changes your live site, and to work from your answer. That is how it is instructed to behave, not something the system enforces. Treat it as you would any assistant with access to your site, not as a guarantee.

Two levels of access

What you connect decides what the agent can reach, and how much of it passes through us.

• Connected through WordPress. Your WordPress issues an application password for SiteSelf. Our servers hold it, not the agent, and every request the agent makes with it goes through our servers and is recorded.
• Connected with server access. If you also connect SSH, the agent runs commands on your server with that account's permissions. SiteSelf's own tools add safeguards to those commands, such as taking a backup first, but a plain command runs without them and nothing constrains it beyond being recorded. This level can do more, and the protection around it is weaker.

What is recorded

Every change the agent makes to your site, and every request it makes through our servers, is recorded in the activity log on your dashboard. Commands on your server are recorded as the command that ran; requests to your website are recorded as the address they reached. Entries are kept for 365 days. The privacy notice says what the log holds.

Your agent's backups and undoing a change

On a site connected with server access, your agent's tools take a backup of your database and files before many kinds of change, but not all of them, and if taking one fails the work can continue with a warning. Each one is made on your own server and stays there, in a private folder your website does not serve, not in a separate location. The newest 5 are kept and older ones are deleted as new ones are made. Your agent's backups taken before 24 September 2026 are on the servers that run the service: we keep up to 10 per site, any but the newest is deleted after 14 days, and together they are capped at 4 GB per site.

Your agent's backups are a convenience, not an archive, and not a substitute for a backup of your own. You are responsible for having one.

If the agent breaks something on your site, tell us. We will help put it right, restoring from your agent's backup where one exists. What we do if your agent breaks something explains it on one page.

What we may do without being asked

We change your site without a request from you only to respond to a security incident or to investigate abuse. When we do, we tell you what we did.

We review conversations with your agent to check the quality of its work, and we may use a conversation to test and improve the agent. That review changes nothing on your site and contacts nobody. The privacy notice says what we hold and for how long.

Acceptable use

Do not use the agent to break the law, to infringe someone else's rights, to attack or probe systems you do not control, to publish spam, fake reviews or malware, or to publish content you would not stand behind. The acceptable use policy is part of these terms and lists the rest. We can suspend an account being used against it, and close it if it continues.

Credits and billing

• Work is paid for in credits, and a credit is a unit of what the work costs to run. Credits are consumed as the agent works, measured by the volume of processing it does — not per job, and not per message.
• The plan, its price, the credits it includes and the credits a new account starts with are on the pricing page, which is part of these terms.
• If your balance runs out, the agent stops taking new work and tells you. Your site is left exactly as it was.
• Prices can change. If they do, we will tell you before it affects you, and you can cancel rather than accept.

Cancelling, and what stays

Cancel whenever you like from the billing portal in your account. We do not renew after the period you have already paid for, and we will not ask you to sit through a retention conversation.

Cancelling stops the charges. It does not disconnect your site. To end the agent's access, delete the site from your dashboard, revoke SiteSelf's application password in your WordPress admin, and, if you connected server access, remove SiteSelf's key from your server. Deleting the site removes it from our systems; the application password and the server key stay on your side until you remove them there.

SiteSelf Connector keeps the last 25 versions of the files it replaced, in your site's own database. They stay after you cancel and after you delete the plugin, so a change can still be undone once we are gone.

What we do not promise

We work hard to make the agent careful and correct, but it is software acting on a live website and it can be wrong. We do not warrant that it will be uninterrupted, error-free, or fit for a particular purpose.

Services we depend on

The service depends on other providers: the AI model provider behind the agent, the company that hosts our servers, our payment processor, and the messaging app you chat in. We choose them carefully and name them in the privacy notice, but we do not control them, and we are not responsible for their outages or their changes.

Events outside anyone's control

Neither of us is responsible for failing to do something because of an event beyond reasonable control, such as a natural disaster, war, a widespread internet or power failure, or an outage at one of the providers above, for as long as that event lasts.

Liability

To the extent the law allows, we are not liable for indirect or consequential loss — lost profit, lost revenue, lost data or lost goodwill. Where we are liable, that liability is limited to what you paid us in the 12 months before the claim.

Nothing in these terms limits liability that the law does not allow to be limited, such as for death or personal injury caused by negligence, or for fraud. If you are a consumer, you keep the rights the law gives you.

Ending it

You can stop using the service and close your account at any time. We can suspend or close an account that breaks these terms, does not pay, or puts the service or other customers at risk. If we close your account without cause, we will refund the unused part of anything you have paid in advance.

General

• These terms, the privacy notice, the data processing agreement, the acceptable use policy and the pricing page are the whole agreement between us about the service.
• If a court finds part of these terms unenforceable, the rest still applies.
• You cannot transfer your account to someone else without our agreement. We can transfer these terms to whoever takes over running the service, and we will tell you if we do.
• We send notices to your account's email address. You send them to the address below.
• Not enforcing a term straight away does not mean giving it up.
• Do not use the service where doing so would break export or sanctions law.

Changes to these terms

If we change these terms materially, we will tell you before the change takes effect rather than relying on you noticing the date at the top.

Contact

Questions about any of this go to dev@refact.co and reach a person.