Site Rep Privacy and Data Handling

Last updated: 2026-10-15.

These notes describe the current Site Rep product behavior and should not be read as a compliance certification.

What Site Rep collects

• Website URLs and approved source text used to train a customer bot.
• Visitor questions, cited answers, feedback, and unknown-question repair items.
• Lead details that a visitor chooses to submit, such as name, email, and buying need.
• Basic install, usage, quota, and source-health events needed to run the service.
• Scrubbed error reports when the service hits an error, sent to Sentry (see Sub-processors).

How Site Rep uses this data

• To answer only from approved sources and ask for follow-up when source backing is missing.
• To show the customer leads, conversations, source gaps, install health, and exports.
• To improve that customer's bot and repair missing source coverage.

Customer controls

• Customers can export bot backup data, leads, conversations, and answer reports from the dashboard.
• Source edits create rollback snapshots where the source set is small enough to restore safely.
• Customers can delete a visitor's lead from the dashboard lead inbox or the authenticated owner API. Deletion runs immediately on live data: it removes the lead, the conversations tied to that visitor's email or lead, related follow-up tickets, notifications, queued webhook payloads, and activity entries from the live store and the record ledger, and scrubs them from Site Rep's KV recovery mirror and daily backups. Anonymous questions from the same browser session are removed too, unless that session also holds another visitor's email or lead. An audit entry records that a deletion happened, without the visitor's details.
• Questions that other visitors also asked stay in the shared unanswered-question and escalation lists as a count. The entry is unlinked from the deleted visitor, and their exact wording is replaced with another visitor's wording or a lowercase form of the question.
• Cloudflare's point-in-time recovery for the record database (D1 Time Travel) and the live store (Durable Object point-in-time recovery) can still restore an earlier state for up to 30 days, so deleted data stays in those recovery copies until that window passes. A KV backup that cannot be scrubbed expires within 30 days, and the deletion result says when that happened.
• Lead and visitor deletion requests are completed through the same self-serve path. A completed request keeps the lead id and a salted one-way hash of the visitor's email, never the address itself. Whole-account deletion requests can still be opened from the customer dashboard and are tracked for review. Export requests can use the dashboard exports or hello@siterep.net.
• Deletion cannot recall copies already delivered outside Site Rep, such as lead emails already sent to the team or payloads already sent to a configured webhook.

Visitor-facing behavior

Site Rep should make the data boundary visible in the answer flow. If a visitor asks a question that the approved sources do not prove, the assistant should ask for follow-up instead of inventing a policy, price, timeline, or support answer. If the visitor asks for human follow-up, the lead form collects only the details needed for the customer team to reply.

Operational data

The service keeps setup state, install checks, source health, answer feedback, and team follow-up items so a customer can see what worked and what needs repair. Those records are product operations data, not public search content.

Sub-processors

Site Rep relies on these providers to run the service. They process customer and visitor data only to deliver Site Rep:

• Cloudflare — hosting, Workers AI (answer generation), and storage (D1, R2, KV, Durable Objects). Cloudflare's Workers AI terms say customer content is not made available to other customers and is not used to train or improve services unless explicit consent is given; Site Rep storage services still keep the app data disclosed here.
• Dodo Payments — checkout, subscription, and billing as merchant of record.
• Sentry (Functional Software, Inc., USA) — error monitoring. When the Worker hits an error, a scrubbed error report is sent: the error type and stack trace, error messages only in fixed shapes from Site Rep's own code or the Cloudflare platform, with any names or values in them replaced, the request method and path with ids replaced, and technical details such as the release and runtime. Request bodies, query strings, cookies, headers, visitor text, and email addresses are removed first.
• The configured email provider — customer notifications and transactional email.

What the widget stores on a visitor's device

The chat widget sets no cookies and no persistent local storage. It uses session-only storage for a random session id, which the browser clears when the tab closes. Visitor IP addresses are used only transiently in memory for rate limiting and abuse prevention; they are not stored with conversations or leads.

Current limits

Site Rep does not currently include SOC 2, GDPR, HIPAA, zero-retention, or no-training-on-data certification. Customers who need those commitments should request a written review before buying.