SiteTuners CRO Privacy Notice

Draft of October 23, 2026, pending review by our lawyers. Until a reviewed version replaces it, this is the version that applies, and we will tell you about significant changes as described in Section 16.

Effective date: October 23, 2026 Last updated: October 26, 2026

This Privacy Notice explains how SiteTuners LLC (“SiteTuners”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you use SiteTuners CRO at https://cro.sitetuners.com. That includes the free CRO Snapshot, membership accounts, our emails and our support (together, the “Service”).

This notice covers SiteTuners CRO only. The main website at sitetuners.com and SiteTuners’ agency services have their own privacy policy.

SiteTuners CRO is a business tool. It is meant for people acting on behalf of a business, not for personal, family or household use.

1. Who we are

SiteTuners LLC, a Florida limited liability company 14502 N. Dale Mabry Hwy, Suite 200 Tampa, FL 33618, USA Phone: +1 (800) 521-6056 (toll-free) Email: contact@sitetuners.com

SiteTuners decides why and how the personal information described in this notice is used. Under some privacy laws this makes us the “controller” or the “business”. The exception is information that a member uploads about its own website visitors and customers; we handle that on the member’s behalf (see Section 9).

2. The short version

• Free CRO Snapshot: we collect your email address, the page you want analyzed, its goal and anything else you choose to tell us about it. We analyze the page right away and email you your snapshot as a PDF. The link in that email also opens your results online and confirms your email address. Free snapshot users don’t get an account.
• What we capture: desktop and mobile screenshots and the visible content of the page you submit. Our capture tool identifies itself honestly and never tries to get around anti-bot protection.
• AI: we use AI models from Anthropic to analyze the page. We don’t send them your email address or your name, and Anthropic doesn’t use this data to train its models.
• Membership: members have an account with their name, work email and password. Stripe handles payments; card details never reach our servers.
• No selling, no ad tracking: we don’t sell personal information, we don’t share it for targeted advertising, and we use only strictly necessary cookies.
• Support mode: with a stated reason, for at most one hour at a time, SiteTuners support staff can act inside a customer account. Every change they make is logged and visible to the account Owner.
• Your choices: you can ask to access, correct or delete your information, and you can tell us to stop following up with you, by writing to contact@sitetuners.com or calling +1 (800) 521-6056.

3. Information we collect

We collect information from you directly, automatically when you use the Service, from the public page you ask us to analyze, and from Stripe when you pay.

3.1 When you request a free CRO Snapshot

We block email addresses from disposable email services.

3.2 What we capture from the page you submit

When a page is submitted (by a free snapshot user or by a member), our system visits that page the way a browser does and captures:

• desktop and mobile screenshots;
• the visible text and the page’s structure (for example, where buttons, forms and headings are);
• speed and layout measurements taken by our own browser during the visit.

Our capture tool adds its own name and a link to our analyzer page to its browser user agent, and it connects from the IP addresses listed on that page. It never tries to get around anti-bot protection, CAPTCHAs or logins. If a page shows a “verify you are human” or “access denied” screen, the analysis stops before any AI processing.

We only visit the pages that are submitted. We don’t crawl whole websites. Members can ask for page suggestions, which we take from the links on their homepage and from their sitemap; nothing is analyzed until the member chooses the pages.

Public pages sometimes show personal information, such as a name in a testimonial or a staff photo. It can appear in our screenshots only because it is on the page. We don’t extract it or use it to identify anyone.

3.3 Membership accounts

• Account details: your name, your work email address and your password. Passwords are stored only as a one-way hash, never in readable form. We also record whether your email address is verified.
• Sign-in: members sign in with their email address and password. Sign in with Google is used today only by SiteTuners staff; if we offer it to members later, Google will share your name, email address and profile picture with us, and never your Google password.
• Company account: the account (company) name, your role (Owner or Member), and team invitations, including the email addresses of the people an Owner invites.
• Your work in the Service: your sites (domain, any secondary domains and the short site brief you write, such as your main conversion, audience, traffic sources, monthly visitors and notes), pages, analyses, reports, site summaries, the changes you record and what you learned from them, your credit balance and history, and your settings (such as “Email me when my reports are ready”).
• Sessions: for each signed-in session, the IP address and browser information. We use them to protect your account, and you can sign out of all your other devices from your account page.

3.4 Payments

Payments go through Stripe Checkout and the Stripe customer portal. Stripe collects your card details directly; they never reach our servers.

We send Stripe your account’s name and email address so it can create your customer record. From Stripe we store your Stripe customer and subscription IDs, your plan, number of extra seats, subscription status and dates, and the amounts you paid and any refunds. When an Owner opens the Billing page, we read the card brand, last four digits and expiry date, and your invoices, from Stripe to show them, without storing them.

Stripe also uses some information under its own privacy policy, for example to prevent fraud.

3.5 Files members upload

Members can upload files for a site: Google Analytics 4 (GA4) exports, Microsoft Clarity exports, customer reviews and support tickets (CSV or plain text, up to 5 MB each). From each file we keep a summary that our analysis can cite: per-page numbers from GA4 and Clarity exports, and short quotes from reviews and tickets with email addresses and phone numbers removed. We also keep the original file, for the member’s own reference. We use this data only as evidence in that member’s own reports.

Connecting GA4 or Clarity directly (instead of uploading an export) is not available yet. If we add it, we will access only the data you approve, you will be able to disconnect at any time, and our use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including its Limited Use requirements. We will update this notice before that happens.

This data is about the member’s own website visitors and customers. Section 9 explains how we handle it.

3.6 Support and communications

When you email contact@sitetuners.com, call us or reply to one of our emails, we keep your message, your contact details and our replies. When SiteTuners support staff use support mode in your account, we keep a record of it (Section 7).

3.7 Security and activity records

• Audit log: an append-only record of important actions in the Service, such as sign-ups and sign-ins, settings changes, credit changes, team changes, uploads, support mode sessions and admin actions. Each entry records who acted (and, in support mode, on whose behalf), what they did, when, in which account and from which IP address. The audit log never stores passwords, keys or other secrets.
• Server logs: request IDs, times, the pages requested (without the part of the address after “?”) and response codes. Our application logs never record passwords, cookies or other secrets. Our hosting provider’s network logs may also record IP addresses and browser information.

3.8 Information we don’t want

The Service doesn’t need sensitive information. Please don’t submit or upload health information, financial account or card numbers, government ID numbers, precise location data, or information about children.

4. How we use information

We use personal information to:

• Provide the Service: check and confirm your email, capture and analyze pages, create and deliver reports, send service emails, run accounts and teams, process payments and manage credits.
• Prevent abuse and enforce limits: apply the free-tier limits by normalized email, email domain, site and IP address; detect automated requests; block disposable email domains; and keep block lists.
• Keep the Service and your account secure: protect sign-ins, detect fraud, investigate incidents and keep the audit log.
• Support you, including through support mode when needed (Section 7).
• Follow up with you: our team may write to or call free snapshot users about their snapshot and about SiteTuners CRO. You can tell us to stop at any time (Section 6).
• Run and improve the Service: monitor quality, cost and reliability, and fix errors.
• Meet legal obligations: keep tax and accounting records, enforce our Terms of Service, and respond to lawful requests.

Reusing a recent analysis of the same public page. If someone requests a free snapshot of a page that another person had analyzed in the last 30 days, we may give them the diagnosis from that earlier analysis of the public page, rebuilt with their own inputs. We remove every finding that relied on what the first person supplied (such as their ad text or numbers), and we never share the first person’s email address or other details.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising or targeted advertising.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Our anti-abuse checks decide automatically whether a free snapshot request is accepted. If you think a request was refused by mistake, write to contact@sitetuners.com and a person will look at it.

5. How we use AI

• How the analysis works: code measures what can be measured on the page. AI models from Anthropic (Claude, used through Anthropic’s commercial API) judge the page against SiteTuners’ methodology and write the findings. Code, not the AI, calculates the scores.
• What we send to Anthropic: the page’s screenshots, visible text and structure; the page’s goal; and the optional context you gave us (traffic source, ad or email text, your numbers). For members, we may also send the site brief, page names, and the summaries from uploaded files (per-page numbers and short quotes with email addresses and phone numbers removed). We don’t send your email address, your name or your account details to Anthropic.
• No training: under Anthropic’s commercial terms, Anthropic does not use the inputs and outputs of our API use to train its models. Anthropic keeps them for a limited time and then deletes them, except where it needs them longer, for example to enforce its usage policies or to meet legal obligations. We don’t train AI models of our own on your data.
• AI can make mistakes. Reports are recommendations, not guarantees. See Section 13 of our Terms of Service.

6. Emails

• Service emails: your snapshot (or a message saying we couldn’t reach or finish your page, or why we can’t run a new free snapshot for you); for members, email verification codes and password resets, team invitations, “your report is ready”, low credits, failed payment notices and reminders, and notices when a membership is canceled or has ended. Stripe sends payment receipts and invoices.
• No tracking: our emails don’t use open or click tracking.
• Bounces and complaints: if an email bounces or is marked as spam, our email provider tells us and we stop sending to that address.
• Notification settings: each member can turn off “Email me when my reports are ready” in their account. Security, billing and account emails can’t be turned off while you have an account.
• Follow-up from our team: after a free snapshot, someone from SiteTuners may write to you personally about your snapshot and SiteTuners CRO. Every follow-up email includes our postal address and a way to opt out. To stop, reply “unsubscribe” or write to contact@sitetuners.com, and we will stop within 10 business days. Opting out of follow-up doesn’t stop the service emails you ask for (for example, a snapshot you request later).
• Marketing (later): we don’t send newsletters or automated marketing emails today. If we start, we will update this notice first. Those emails will come from a separate email address and include a one-click unsubscribe link, as the US CAN-SPAM Act requires.

7. Support mode and staff access

Support mode. To help a customer, fix a problem, or investigate a security, abuse or billing issue, a SiteTuners administrator can enter a customer account in “support mode” and act inside it with the same capabilities as the account’s Owner. This means the administrator can see and do what an Owner can, including viewing reports and data in the account. Support mode has these safeguards:

• The administrator must state a reason before starting, and the start and end of every session are logged.
• A banner shows that support mode is active for the whole session.
• Each session ends automatically after one hour.
• Destructive actions ask for confirmation.
• Every change made in support mode is logged with both identities (the administrator’s and the account’s) and appears in the account’s Activity page as “SiteTuners Support – [administrator’s email address]”.

We use support mode only when a customer asks us to, except when we need it to investigate or deal with a security, abuse, billing or legal issue.

Staff access. Only a small number of SiteTuners administrators can use our admin tools. They sign in with company Google accounts protected by two-step verification, or with a password plus an authenticator app. To run the Service, they can see free snapshot requests, accounts, analyses, reports and costs, for example to answer support questions, check report quality, follow up with leads and prevent abuse. Changes they make are recorded in the audit log; simply viewing information is not.

8. How we share information

We share personal information only as described here.

Service providers. We use these companies to run the Service. They may use the information only to provide their services to us, except where the table notes that they also act under their own privacy policy.

Inside your company account. The Owner and Members of an account can see that account’s sites and reports. The Owner can also see the account’s Activity page, including what Members and SiteTuners Support did.

Other cases. We may also share information:

• when the law requires it, for example in response to a valid court order;
• to protect the rights, safety and security of our users, the public or SiteTuners, and to prevent fraud and abuse;
• with a buyer or successor if SiteTuners is involved in a merger, acquisition or sale of assets, in which case this notice keeps applying to your information;
• with your consent or at your direction.

We never share one customer’s reports with another customer, except the reuse of a recent analysis of the same public page described in Section 4, which never includes the first requester’s details or inputs. We don’t publish your reports or use them as case studies without your permission.

9. Data our members give us about their own visitors

When a member uploads data about its own website visitors or customers (for example, GA4 or Clarity exports, reviews or support tickets), we process that data on the member’s behalf, as its service provider or processor, and only to provide the Service to that member. If you are a visitor or customer of one of our members and you want to exercise your privacy rights, please contact that business. We will help it respond. Members can ask us for a data processing addendum by writing to contact@sitetuners.com.

10. Cookies, browser storage and tracking

We use only strictly necessary cookies, to keep you signed in, to protect sign-in against forgery and to run support mode. We don’t use advertising or analytics cookies, and the public pages and the free snapshot form set no cookies at all. Our Cookie Notice lists each cookie and how long it lasts. Our app also keeps a few short-lived values in your browser’s session storage (for example, the plan you chose while you sign up), which are deleted when you close the tab.

Our pages load their scripts, styles, fonts and images only from our own domain, so loading them sends nothing to third parties. No third party collects information about your online activities over time and across websites through our Service. When you go to Stripe’s payment pages, Stripe sets its own cookies there under its own policies.

Before we ever use a non-essential cookie, we will update this notice and our Cookie Notice, and ask for your consent where the law requires it.

Do Not Track and Global Privacy Control. Because we don’t track you across websites and don’t sell or share personal information, there is nothing for a “Do Not Track” signal or a Global Privacy Control signal to switch off today. If we ever start an activity those signals apply to, we will honor them.

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this notice. The periods below are our defaults.

12. How we protect information

We use reasonable technical and organizational measures designed to protect personal information. They include:

• encryption in transit (HTTPS with HSTS) for every page and connection to the Service;
• passwords stored only as one-way hashes, and payment keys kept in sealed hosting settings, never in our database or admin screens;
• restricted admin access, limited to SiteTuners company accounts with two-step verification;
• an append-only audit log of important actions, including every change made in support mode;
• rate limits, anti-abuse controls and protections that stop our capture tool from being used to reach private or internal addresses;
• separate test and production environments, and daily backups.

No system is perfectly secure, so we can’t guarantee absolute security. If we learn of a security breach that affects your personal information, we will notify you, and the authorities where required, as the law requires (for example, under Florida law, within 30 days of determining that a breach occurred).

13. Where your information is processed

SiteTuners is based in the United States, and the Service is hosted in the United States. If you use the Service from outside the US, your information is transferred to, stored in and processed in the US and in the other countries where our service providers operate. Privacy laws there may differ from those where you live.

14. Your choices and rights

14.1 For everyone

Whatever the law where you live, you can ask us to:

• access the personal information we have about you, or get a copy of it;
• correct information that is wrong;
• delete your information;
• stop follow-up and marketing emails, at any time.

Members can also update their name, password and email notification setting in their account. To close an account or delete its data, the Owner can write to us.

How to ask: email contact@sitetuners.com, or call +1 (800) 521-6056 (toll-free). We will confirm your request comes from you, usually by writing to the email address we have on file. You can use an authorized agent; we may ask for proof that the agent is authorized. We aim to respond within 30 days, and never later than the law where you live allows (for example, 45 days under California law, which can be extended once by another 45 days when we tell you why). We won’t treat you differently for using your privacy rights.

What we may keep after a deletion request: information we must keep by law (such as billing records), the audit log, an email suppression entry so we don’t contact you again, the minimum needed to enforce free-tier limits, and copies in backups until the backups expire. Audit log entries can include your email address and IP address.

If you are a Member of a company account, some information (such as reports you created) belongs to that account. We may refer requests about that information to the account Owner.

14.2 California and other US state privacy rights

Depending on where you live, and if a state privacy law applies to us, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale of personal information, of sharing for cross-context behavioral advertising or targeted advertising, and of profiling that produces legal or similarly significant effects. We don’t do any of these, including for anyone under 16;
• limit the use of sensitive personal information. We use sensitive information (your account login and password) only to provide the Service and keep it secure, so this right doesn’t change anything we do;
• appeal our decision if we decline your request. To appeal, reply to our decision or write to contact@sitetuners.com with the subject “Privacy appeal”. If we deny your appeal, you may contact your state attorney general.

Notice at collection. For residents of states that ask for this list, here are the categories of personal information we collect (described in Section 3):

We collect these categories from the sources described in Section 3, for the purposes described in Section 4, and keep them for the periods in Section 11. In the last 12 months we have not sold personal information or shared it for cross-context behavioral advertising. We don’t disclose personal information to third parties for their own direct marketing.

14.3 If you are in the EEA, the UK or Switzerland

If the GDPR or a similar law applies, you also have the right to restrict or object to our processing, to data portability, and to withdraw consent at any time where we rely on consent. You can also complain to your local data protection authority.

We rely on these legal bases:

15. Children

The Service is for businesses and for adults. It is not directed to children, and we don’t knowingly collect personal information from children under 13, or from anyone under 16 where the law sets that age. If you believe a child has given us personal information, write to contact@sitetuners.com and we will delete it.

16. Changes to this notice

We may update this notice when the Service or the law changes, for example before we start marketing emails or use any non-essential cookie. We will post the new version here with a new “Last updated” date. If a change is significant, we will also tell members by email or in the app at least 30 days before it takes effect.

17. Contact us

For privacy questions and requests, or to reach us about anything in this notice:

SiteTuners LLC 14502 N. Dale Mabry Hwy, Suite 200 Tampa, FL 33618, USA Email: contact@sitetuners.com Phone: +1 (800) 521-6056 (toll-free)