Legal

Privacy Policy

Last updated: May 5, 2026 · Effective: May 5, 2026

This Privacy Policy explains how RebelSites (“RebelSites,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you visit rebelsites.ai, sign up for an account, or use our AI-powered website builder and related services (collectively, the “Service”). It also describes the rights you have over your information and how to exercise them.

If you do not agree with this policy, please do not use the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Overview

RebelSites provides an online platform that lets local service businesses describe what they do in plain English and have a complete, professional website generated for them by artificial intelligence. To do that, we operate websites, applications, dashboards, sandbox preview environments, and publishing infrastructure that handle information about you, your business, and the websites you create.

This policy applies to all users of the Service, including visitors to our marketing site, registered account holders, paid subscribers, and end users of websites we host on behalf of our customers. It does not cover the practices of websites or services that we do not own or control, even if they are linked to or integrated with the Service.

2. Information we collect

We collect information in the following ways.

2.1 Information you give us directly

  • Account information. When you create an account, we collect your email address, password (stored as a salted hash), and any name or profile details you provide. If you sign in with Google, we receive your name, email address, profile picture, and Google account identifier from Google.
  • Billing information. When you subscribe to a paid plan, our payment processor (Stripe) collects and processes your name, billing address, payment card details, and tax identifiers. We do not store full card numbers on our systems; we store only billing metadata returned to us by Stripe (such as last four digits, card brand, and a Stripe customer identifier).
  • Content you submit. This includes the prompts you write, business descriptions, reference URLs and uploaded images, edits and revision instructions, and any text, images, logos, or other content you provide to be incorporated into a generated website.
  • Custom domain information. If you connect a custom domain, we collect the domain name, DNS configuration data, and any verification records needed to issue and renew certificates.
  • Communications. If you email us, fill out a form, or interact with our support tools, we keep a copy of your message and any attachments along with our responses.

2.2 Information generated by your use of the Service

  • Generated websites. The HTML, CSS, JavaScript, configuration files, and other artifacts produced by the AI on your behalf are stored under your account.
  • Sandbox and preview activity. Each generation session runs inside a sandboxed container; we record build logs, error output, and timing data needed to operate and debug the Service.
  • Usage data. Pages viewed, features used, buttons clicked, generations started and completed, and edits requested, along with timestamps and identifiers that link these events to your account.
  • Device and connection data. IP address, browser type and version, operating system, device type, language preference, referring URL, and similar technical information automatically reported by your browser.
  • Cookies and similar technologies. See Section 6.

2.3 Information from third parties

  • Single sign-on providers. If you sign in through Google, the data Google shares with us is governed by the permissions you grant during sign-in and Google’s own policies.
  • Payment processors. Stripe shares limited information about transactions and the status of your subscription so that we can grant or revoke paid access.
  • Domain and DNS providers. When you connect a custom domain through a registrar or DNS provider integration, that provider may share validation data with us.

3. How we use your information

We use the information described above to:

  • Provide, maintain, and improve the Service, including generating websites, running sandbox previews, and publishing your sites;
  • Authenticate you, secure your account, and prevent fraud and abuse;
  • Process payments, manage subscriptions, issue refunds, and send billing-related communications;
  • Communicate with you about the Service, including transactional messages, security notices, and (with your consent or as permitted by law) product updates;
  • Provide customer support and respond to your questions and requests;
  • Monitor and analyze trends, usage, and performance so we can improve features, fix bugs, and design new ones;
  • Train our internal models, heuristics, and prompt-engineering systems on aggregated, de-identified data—we do not use your prompts or generated content to train third-party AI models;
  • Enforce our Terms of Service, our Refund Policy, and other agreements;
  • Comply with legal obligations, respond to lawful requests, and protect the rights, property, or safety of RebelSites, our users, and the public.

Legal bases (EEA/UK users). Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service), legitimate interests (to secure, improve, and analyze the Service), consent (for optional cookies and certain communications), and compliance with legal obligations (for tax, accounting, and lawful requests).

4. How we share information

We do not sell your personal information. We share information only as described below.

4.1 Service providers (subprocessors)

We rely on third-party vendors to operate the Service. Each is bound by contractual obligations to use information only to provide services to us. Our current core subprocessors are:

  • Cloudflare — hosting, content delivery, DNS, edge compute, sandbox containers, object storage (R2), and database (D1).
  • Stripe — payment processing, subscription billing, and tax calculation.
  • OpenRouter and the underlying model providers it routes to (currently including Anthropic and Google) — AI inference for generation and edits.
  • Google — OAuth single sign-on for users who choose to sign in with Google.
  • PostHog — product analytics, session-level event capture, and feature-flag delivery.
  • Vercel — apex-domain bridge for certain custom-domain configurations.
  • Email delivery providers — transactional email such as verification, password reset, and billing receipts.

We may add, remove, or replace subprocessors over time. The list above is current as of the “Last updated” date at the top of this policy.

4.2 AI providers

When you submit a prompt or request an edit, the relevant content is transmitted to an AI provider (currently routed through OpenRouter to Anthropic and Google models) so the model can generate a response. We instruct providers, where contractually possible, not to use your inputs or outputs to train their models. Providers may retain inputs and outputs for a limited period for safety and abuse-prevention purposes under their own policies. Please do not include sensitive personal information, payment card numbers, government identifiers, or confidential third-party information in your prompts.

4.3 Other websites you publish

When you publish a generated website, that site is publicly accessible to anyone who visits its URL. Any information you choose to include in published content—business name, address, phone number, photographs, customer testimonials—will be visible to the public.

4.4 Legal and safety

We may disclose information if we believe in good faith that disclosure is necessary to:

  • Comply with a legal obligation, court order, subpoena, or other lawful request from a government authority;
  • Enforce our agreements or investigate potential violations;
  • Detect, prevent, or address fraud, security, or technical issues;
  • Protect against harm to the rights, property, or safety of RebelSites, our users, or the public.

4.5 Business transfers

If RebelSites is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you (for example, by email and/or a prominent notice on the Service) of any change in ownership or use of your information, and any choices you may have.

4.6 With your consent

We may share your information for any other purpose with your consent.

5. AI processing of your prompts and content

Because RebelSites is an AI website builder, prompts and reference content are an essential part of the Service. We want to be specific about how this works.

  • Your prompts, reference URLs, uploaded images, and edit instructions are sent to AI providers (see Section 4.1) to generate or modify your website.
  • Generated output is returned to us, written to your account, and rendered in a sandbox preview environment that only you can access until you choose to publish.
  • We may store prompts, model responses, and intermediate generation artifacts to operate the Service, improve quality, debug failures, enforce our terms, and comply with legal obligations.
  • We use only aggregated, de-identified information to improve our own internal systems. We do not sell prompts or generated content, and we do not authorize third parties to use them to train general-purpose AI models.
  • AI-generated content can be inaccurate, incomplete, or unintentionally similar to existing material. You are responsible for reviewing, fact-checking, and approving any content before publishing it.

6. Cookies and similar technologies

We use cookies, local storage, and similar technologies to operate the Service, remember your preferences, secure your session, and understand how the Service is used. The categories we use are:

  • Strictly necessary. Required for the Service to function (for example, authentication, session management, CSRF protection, load balancing). These cannot be disabled.
  • Functional. Remember preferences such as theme (light/dark) and language. Disabling these may degrade the experience.
  • Analytics. Help us understand which features are used and how to improve them. We use first-party analytics through PostHog and do not sell analytics data.

We do not use cross-site advertising or behavioral-targeting cookies. You can manage cookies through your browser settings; many browsers also offer “Do Not Track” signals, which we honor by not enabling optional analytics where applicable.

7. Data retention

We retain your information for as long as your account is active and for as long as needed to provide the Service. After your account is closed, we generally delete or de-identify personal information within 90 days, except where we must retain it longer for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes. Aggregated and de-identified information may be retained indefinitely.

Generated websites you have published remain hosted until you delete them or until your subscription lapses, after which we may take down or archive them as described in our Terms of Service.

8. Security

We use a combination of administrative, technical, and physical safeguards designed to protect information from unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS), encryption at rest for databases and object storage, scoped access controls, audit logging, sandboxed code execution, and least-privilege engineering practices.

No method of transmission or storage is perfectly secure. If we become aware of a security incident that affects your information, we will notify you and the relevant authorities as required by law.

9. International data transfers

RebelSites is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States and other jurisdictions where our subprocessors operate. These countries may have data-protection laws that differ from those in your jurisdiction. Where required by law, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses to legitimize cross-border transfers of personal data from the EEA, the UK, and Switzerland.

10. Your rights and choices

Depending on where you live, you may have the following rights:

  • Access. Request a copy of the personal information we hold about you.
  • Correction. Ask us to correct information that is inaccurate or incomplete.
  • Deletion. Ask us to delete your personal information, subject to legal exceptions.
  • Portability. Receive a structured, commonly used, machine-readable copy of certain information you provided to us.
  • Restriction and objection. Ask us to restrict or object to certain processing, including processing based on legitimate interests.
  • Withdraw consent. Where we rely on your consent, withdraw it at any time without affecting the lawfulness of prior processing.
  • Lodge a complaint. Contact your local data-protection authority. We would appreciate the chance to address your concerns first.

California residents have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to request deletion or correction, the right to opt out of the “sale” or “sharing” of personal information (we do not sell or share personal information for cross-context behavioral advertising), and the right not to receive discriminatory treatment for exercising these rights.

To exercise any of these rights, email hello@rebelsites.ai. We will verify your request and respond within the time frame required by applicable law (generally 30 days, with one extension where permitted). You may also designate an authorized agent to make a request on your behalf.

11. Children’s privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us at hello@rebelsites.ai and we will take appropriate steps to delete it.

The Service and websites generated through it may contain links to, or integrations with, third-party services. We are not responsible for the privacy practices of those services. We encourage you to read the privacy policies of any third party before you provide them with information.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, the Service, or legal requirements. When we make material changes, we will notify you by email or by a prominent notice on the Service before the changes become effective. The “Last updated” date at the top of this policy reflects the date of the most recent revision.

14. Contact us

If you have questions or concerns about this policy or our privacy practices, contact us: