Privacy Policy

1. Information We Collect

• Account data: name, email address, password hash, and session data.
• Task data: website URL, intake details, selected service, scope decisions, verification records, and status history.
• Credentials: WordPress admin, connector tokens, SFTP/FTP, SSH, or Cloudflare details only when submitted through the secure access flow.
• Payment data: processed by Stripe. We store payment intent, authorization, capture, release, refund, and invoice references, never card numbers.
• Files: screenshots or attachments you upload.
• Operational logs: security, audit, and delivery logs needed to run the service.

2. How We Use Your Information

• To classify, authorize, perform, verify, and close the WordPress task you requested.
• To send transactional emails and task reminders.
• To detect firewall blocks, abuse, fraud, and unsafe task routes.
• To maintain audit, payment, tax, and legal records.

We do not sell your data or use it for advertising.

3. Credentials and Sensitive Data

Credentials submitted through the secure access flow are transmitted over HTTPS, envelope-encrypted at rest, job-scoped, and deleted after the job closes or expires. Do not put credentials in the public intake description.

4. Tooling Boundaries

HealMySite may use internal systems for AI reasoning, notifications, monitoring, and task execution. Credentials are not shared with notification workflows, and website-changing actions are routed through app-controlled allowlisted tools.

5. Data Sharing

We share data only with service providers needed to operate HealMySite, including Stripe for payments, Resend for transactional email, and infrastructure providers used for hosting, storage, security, and monitoring. We may disclose data if required by law or to protect rights and safety.

6. Data Retention

• Account data: retained while your account is active unless deletion is requested.
• Task, audit, invoice, payment, refund, and tax records: retained as required for business and legal records.
• Credentials and connector tokens: deleted after job close, expiry, cancellation, or failure.
• Files: deleted according to the task retention policy or upon validated request where legally permitted.

7. Your Rights

You may request access to, correction of, or deletion of personal data by emailing privacy@healmysite.com. Some records must be retained for payment, fraud prevention, legal, or audit obligations.

8. Security

We use HTTPS, encrypted sessions, password hashing, credential encryption, rate limiting, audit logging, and access controls. No system is perfectly secure; rotate any credentials you shared after the task closes.

9. Cookies

We use HTTP-only session cookies for authentication and limited analytics for product operations. We do not use advertising cookies.

10. Contact

Privacy questions: privacy@healmysite.com