Privacy Policy

Its My Site (“we”, “us”, “our”) operates the website builder and hosting platform at https://its-my-site.com and related subdomains (for example yourname.its-my-site.com).

Contact: hello@its-my-site.com

This policy covers practitioners who create an account and publish a site, and visitors who use those sites (for example to book an appointment or send an enquiry). Practitioners are responsible for their own client-facing notices where their practice requires them.

Depending on how you use the service, we may process:

• Account data — email address and authentication data needed to sign you in (magic-link / OTP via our auth provider).
• Profile and site content — name, professional title, bio, about copy, credentials, location fields you choose to show, photos, theme choices, services/packages, testimonials, section headings, and similar content you enter to build your site.
• Domain settings — subdomain and optional custom domain configuration for your public site.
• Availability and bookings — weekly hours, timezone, and appointment records (including client name, email, and booking details submitted on your public site).
• Calendar connection data — see the Calendar section below when you connect Google Calendar or Microsoft Outlook / Microsoft 365.
• Usage and technical data — basic server and security logs (for example IP address, timestamps, error diagnostics) needed to operate and protect the service.
• Payment-related data — when platform billing or client payments are enabled, payment processors handle card details; we receive limited billing metadata (see Payments below).

Practitioners may optionally connect Google Calendar or Microsoft Outlook / Microsoft 365 so visitors can book against real availability. Connecting a calendar is not required to publish a site. Google user data obtained through Google APIs is used only to provide scheduling and booking features — not for advertising, resale, or unrelated product analytics.

When you connect Google Calendar via OAuth, we request these Google permissions (scopes) and use them only as follows:

• https://www.googleapis.com/auth/calendar.freebusy — call Google’s FreeBusy API to read busy/free intervals so we can show bookable slots and avoid double-booking. We do not store your full calendar event titles, descriptions, or attendee lists from FreeBusy responses.
• https://www.googleapis.com/auth/calendar.events — create calendar events on your connected calendar when a client books (including a Google Meet link where supported). We do not use this scope to read, rewrite, or delete unrelated existing events.
• openid and email — identify the Google account you connected (email shown in the dashboard) so you can confirm which calendar is linked.

When you connect Microsoft Outlook / Microsoft 365, we use equivalent Graph calendar permissions to read free/busy information and create booking events (including Microsoft Teams where supported), on the same scheduling-and-booking-only basis.

We treat OAuth connection data separately from calendar/event/booking records:

• OAuth / connection data — encrypted refresh tokens, calendar id, connected account email, and connection timestamp. Tokens are stored encrypted and used only to call the calendar APIs above for availability and booking. They are cleared when you disconnect the calendar or delete your account.
• Calendar / event / booking data — appointment records you (or your clients) create in Its My Site (for example client name, email, time, service, and a provider event id / join link when a booking is written to the connected calendar). We do not keep a mirror of your entire Google or Microsoft calendar. Booking records remain until you delete them or delete your account (see Retention and Your rights below).

We do not sell calendar data. We do not use Google or Microsoft user data for advertising, including retargeting, personalised ads, or ad-related tracking. We do not transfer Google user data to third parties except as needed to operate the Service (for example our hosting/database provider under data-processing terms), or as required by law. We do not request access to unrelated Google or Microsoft account data beyond what is needed for availability and booking.

You can revoke calendar access at any time: disconnect in Dashboard → Availability (or the Availability step during onboarding), which deletes the OAuth tokens we store and stops further calendar API access for new bookings; and/or remove Its My Site from your Google Account permissions at https://myaccount.google.com/permissions (Microsoft account permissions for Outlook / Microsoft 365). Revoking access does not automatically erase existing Its My Site appointment records; those remain until you delete them or delete your account.

Google and Microsoft each have their own privacy policies for data processed on their platforms. Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements, for the scopes we request.

• Provide, secure, and improve the Its My Site platform.
• Host and display your public site content as you configure it.
• Authenticate accounts and prevent abuse.
• Enable bookings and optional calendar sync as described above.
• Process platform subscriptions and (when enabled) client payments via Stripe.
• Respond to support requests you send to us.
• Comply with law and enforce our Terms of Service.
• Send service and product emails to practitioners (see Communications below).

If you create a practitioner account, we may email you at the address on your account about operating Its My Site (for example security notices, billing, and product updates).

We may also occasionally email you about related or complementary products and businesses that we operate or offer alongside Its My Site (for example tools or services that may help independent practitioners). These messages come from us — we do not sell or rent your email address to unrelated third parties for their own marketing.

Where the law treats a message as marketing, you can opt out using the unsubscribe link in the email (when provided) or by contacting hello@its-my-site.com. Service and billing messages may still be sent when needed to run your account.

When platform billing is enabled, subscription payments for Its My Site Pro are processed by Stripe. When practitioners enable client payments (Stripe Connect), client charges are processed by Stripe and paid out according to that connection. We do not store full card numbers on our servers. Stripe provides us with limited account and transaction metadata needed for billing, receipts, and support.

Stripe’s privacy practices are described in Stripe’s own privacy policy. Card data is handled under Stripe’s PCI-compliant systems.

We use cookies and similar technologies that are necessary for authentication and to keep you signed in to the dashboard. As of the effective date, we do not run a separate third-party marketing or product-analytics cookie suite on the marketing site. If we add analytics later, we will update this policy and, where required, provide additional notice or controls.

We share data only as needed to run the service, including with:

• Infrastructure and auth providers (for example hosting and Supabase) under their data processing terms.
• Email delivery for authentication messages (for example magic links).
• Google / Microsoft when you choose to connect a calendar.
• Stripe when payments features are used.
• Authorities when required by law, or professional advisors under confidentiality where needed to protect our rights.

We do not sell personal data.

We keep account, site, and booking data for as long as your account is active and as needed to provide the service. Calendar OAuth tokens and connection metadata are kept only while a calendar remains connected (or until account deletion). Practitioners can permanently delete their account from Dashboard → Delete account. That erases your public site content, bookings, client list, calendar connection data we store (including encrypted OAuth tokens), profile photos, and authentication record, and cancels any platform subscription. Limited billing metadata may remain with Stripe (or in our records) where required for legal, security, or accounting reasons. Server logs are retained for a limited operational period. You can also email hello@its-my-site.com for help with deletion.

Unfinished onboarding setups (started but never published) are kept for up to 8 days from last activity. We may send a short series of transactional “finish your site” emails during that window; each message includes an unsubscribe link. After 8 days of inactivity we erase the unfinished account and related data so abandoned personal information is not kept indefinitely.

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing (including marketing emails about related products or businesses). Practitioners can delete their own account and associated site data in-product via Dashboard → Delete account. For other requests (or if you cannot use the in-app control), email hello@its-my-site.com. We may need to verify your request. Practitioners who collect client data on their sites remain responsible for responding to client requests that relate to their own practice records, with our reasonable cooperation where the data sits in our systems.

We use industry-standard measures appropriate to a small SaaS product (encrypted transport, access controls, and encrypted storage of calendar refresh tokens). No method of transmission or storage is perfectly secure; if you believe there has been a vulnerability or incident, contact us promptly.

We may process data in countries other than your own through our hosting and subprocessors. Where required, we rely on appropriate safeguards offered by those providers.

Its My Site is aimed at adult professionals. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us and we will take appropriate steps.

We may update this policy from time to time. We will post the updated version on this page and revise the effective date. Material changes may also be communicated by email or in-product notice where appropriate.

Questions about privacy: hello@its-my-site.com

Related: Terms of Service.