Privacy

How Roar Group Pty Ltd collects, uses, shares and protects personal information when you use Sitefinite. Privacy notice, version of 4 October 2026.

Who is responsible for your information

Sitefinite is a product of Roar Group Pty Ltd (ABN 17 702 060 419). Roar Group Pty Ltd is the organisation responsible for the personal information described here. Email:hello@sitefinite.com.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you are in another country, you also have the rights your own privacy law gives you.

If you use Sitefinite for your business

What we store

We store what is needed to build the website and operate the customer-controlled tools you choose:

• Your business name, trade, town, services and contact details.
• Your email address, if you sign in.
• Any logo or photographs you upload.
• If you adopt a Logo Studio concept, its selected vector and PNG artwork, style, colours and your recorded approval and trademark-responsibility acknowledgement. A description entered only to preview concepts is not stored unless it becomes part of another record you deliberately save.
• Private drafts, immutable published versions, domain requests and enquiry records.
• Daily website page-request counts reduced to one of five source categories: direct, search, social, referral or internal. Enquiry totals are compared with those aggregate counts in Business HQ.
• Business HQ contacts, pipeline records, tasks, bookings or jobs, commercial-document records, campaign drafts and assistant proposals entered or approved by the account owner.
• Local Opportunity Radar search terms and minimal public signals: the original source URL, a short title or excerpt, source, location label, timestamps, deterministic fit reasons, and the account owner's review decision.
• If you use the optional shop: your products, prices, availability, inventory history, delivery settings, orders, fulfilment updates, refund evidence, access entitlements and subscription state.
• Payment-provider event identifiers, checkout references, connected-account identifiers and subscription references. Card and bank details stay on the hosted payment page and are never stored by Sitefinite.
• The version of the terms, this notice and the refund policy you accepted at checkout, with a fingerprint of the exact wording and the time you accepted.

How we collect it and why

We collect most information directly from you: when you describe your business, sign in, upload media, edit your site, pay or email us. We collect enquiries from the people who use the forms on websites we host, and public business facts from public sources for our own prospecting, as described below.

We use personal information to:

• build, host, run and support your website and the tools you choose;
• sign you in and keep your account secure;
• take payments, issue receipts and keep the records the law requires;
• send the emails the service needs, such as sign-in links and enquiry notifications;
• answer your questions and complaints;
• protect the service against abuse, and meet our legal obligations; and
• contact businesses about Sitefinite, within the controls described underbusinesses we research.

If you do not give us the information a part of the service needs, such as an email address to sign in, we cannot provide that part of the service.

Local Opportunity Radar

The Radar is an account-owner review tool, not an automatic outreach system. Results are scored from the services, locations, signal types and exclusion terms that the owner supplies. Sources can include minimal public-request metadata and official public tender, permit, event or organisation-level records. A result is never treated as consent to contact, and Sitefinite does not message, follow, join, reply to or impersonate anyone. The owner chooses whether to open, dismiss or save each result, and that decision is recorded in the account audit trail.

We do not buy personal profiles or hidden contact data. When you ask the Radar to check a supported source, it uses the source's public, connected or specifically approved interface and links you to the original. It does not enter private groups, circumvent logins, or copy full posts into Sitefinite. If the original content is deleted, it should be treated as unavailable; the source remains authoritative. Radar does not infer sex, gender, ethnicity, health, age or other sensitive traits from names, images or profiles.

Local business assistant

If the owner enables a local model, the model receives aggregate operating counts and the business's vertical—not customer names, contact details, enquiry messages, notes, credentials or documents. Its output is an inert task or campaign proposal. It cannot send, publish, charge, file or delete, and the owner must approve and separately execute a safe internal draft.

Logo Studio

Logo Studio builds ten controlled vector concepts inside your signed-in workspace. It does not search trademark registers, decide whether a mark is legally available or silently publish a selection. You choose the concept, confirm that it represents the business and accept responsibility for appropriate trademark and professional clearance before the selected artwork is saved to the site.

Downloading, leaving and deleting

You own your website and everything on it. You do not have to ask for a copy: the dashboard lets you download the website, its media and a separate data export at any time, including before you leave, at no charge. Your domain stays registered in your name with your own registrar; Sitefinite only connects it and never holds it.

You can ask for a website, or your whole account, to be deleted from its settings. Deletion waits seven days so you can change your mind, and finishes once billing for that website has ended and any custom domain has been disconnected. When it finishes we delete the website and its records, except the records the law requires us to keep, such as tax and payment records and the minimised shop records described underhow long we keep it. We do not hold anyone's website hostage.

If you contacted or bought from a business we host

Enquiries from website visitors

If someone fills in the enquiry form on a website we host, we hold their name, the phone number or email they gave, and their message, so that we can pass it to the business named on that website and the business can reply. The form says this, and links here, next to the send button.

We take the least that makes a reply possible: a name, one way to contact them, and what they wrote. There is no tracking on the form. Our email provider may deliver the message to the site owner; if email delivery is not enabled the message remains saved in the owner’s dashboard and the thank-you page says exactly that. If the sender gave an email address, we also send them one short email in the business's name saying their message arrived and that the business will reply. It repeats nothing they typed, goes to any one address at most twice a day across every business we host, and is never sent for health or education businesses.

Website enquiries belong to the business and the people who sent them, not to us. We hold them on behalf of the business. We do not market to the people who send them, add them to any list, sell them, or share them with anyone except theservice providers that help deliver them, such as the email provider that sends the enquiry notification to the business. Enquiries are deleted automatically after the period in the retention table. The business decides how it uses an enquiry after reading it; to ask about that, or to have your enquiry corrected or deleted, contact the business or email us. We delete an enquiry when the business or the sender asks, unless the law requires us to keep it.

Shops and customer orders

A business that enables a shop is the seller responsible for its products, services, prices, tax position, delivery, cancellations and refunds. Its own connected Stripe account receives direct customer charges. Sitefinite provides the catalogue, cart, order and operational software and does not pool shop revenue in Sitefinite's subscription-billing account.

For a shop customer we hold the name, email, delivery address when needed, the selected product configuration or booking slot, and the order history the merchant needs to fulfil and support the purchase. The cart uses a random first-party cookie so the same browser can retrieve that cart and, after payment, its order status. Only a one-way hash of the token is stored. Server-side prices, stock and capacity control checkout; payment status changes only after a signed provider event. Digital and membership access records are linked to the paid order. A merchant's PDF or ZIP download is stored privately, content-detected, hash-verified and accepted only after a local malware scan; scan metadata and the file remain in the merchant's private file storage and protected backups after a download is retired, until the site-deletion and backup-retention processes remove them. No shop order data is used for advertising or model training.

When a merchant site is deleted, customer names, emails, addresses, line items and operational order history are removed. For paid or otherwise financially material orders, a separate minimised record keeps only amounts, currency, dates, payment-provider name and hashed references, for the period in the retention table.

Customer Hub

If a business enables a Customer Hub, it may issue an expiring, revocable private link to a named contact. The invitation and session are stored only as hashes. A contact sees only records linked to that contact, can download those commercial records, decide a sent quote, and submit a change or repeat-work request. The request enters the business owner's queue; it does not confirm a booking, price or automated action. Customer Hub records belong to the business and the contact, and we hold them for the business. Link and session metadata are not used for advertising or model training.

If we researched your business

What we collect for our own prospecting

For Sitefinite's own prospecting we keep public business facts, exact source and terms-evidence URLs, retrieval time, website-fit classification, jurisdiction/channel eligibility, suppression state and funnel events. A public contact endpoint is encrypted at rest and its suppression key is stored as a keyed hash. Where the reviewed market policy permits this collection, automated website checks retain only business addresses explicitly published on the audited business's own pages. Values are checked for mail-domain capability and encrypted immediately. Exact or tightly matched brand domains and an explicitly published free-mail address may be selected; unrelated cross-domain values remain quarantined for source-page review. Search snippets and guessed addresses are excluded. A licensed open-data source may also supply a published business-email observation. That value is encrypted immediately and retained in a separate signal-only register; only its non-personal domain may assist website discovery. It is not a delivery endpoint unless the same address is independently verified on the business's own site.

Private prospect demonstrations

We may create a private, expiring and clearly unofficial website concept for a business using public business details from an evidenced source. Discovery does not authorise outreach, and a public address is not treated as consent in every market. The acquisition register separately records source permission, applicable business/entity type, market, channel, legal or consent basis, evidence date, recheck date and suppression state. A draft cannot pass its gate if any of those controls is absent or expired.

The target business is the reviewer of its website content. It can correct the public facts, remove anything, accept or reject drafted wording and decide whether to adopt the concept. The preview is not published as its official site merely because it exists. Opt-outs and do-not-contact requests are retained as keyed hashes so that deletion of a sales record does not accidentally permit later contact.

Where email outreach has been separately enabled, a named operator must approve the exact draft before the configured email provider receives the encrypted-at-rest recipient address, message content and delivery headers needed to send it. Each message identifies the sender, includes a signed one-click opt-out, and records only the provider reference and delivery state after sending. The recipient address is not displayed in the operator console or written to application logs.

For everyone

What we do not do

• Private first-party measurement only. No Google Analytics, advertising pixels, visitor profiles, fingerprinting or unique-person tracking. We count eligible page requests by day and reduce the incoming referrer to a broad source category before storage. We do not store the visitor's IP address, user agent, full referrer, path history or an analytics cookie, and we honour Do Not Track and Global Privacy Control. Public generation abuse limits use a monthly rotating keyed identifier derived from a trusted network address; the address is not stored and expired daily quota rows are deleted.
• No advertising. Your details are never sold, shared for advertising or used to target anything at you.
• No third-party requests on generated websites. They load nothing from any other company's servers — no fonts, no scripts, no images. This is enforced automatically: a generated site that references an outside origin fails our build and is never shown to anyone.

Cookies

Every cookie we set is first-party and essential to the feature that sets it. None is used for tracking, analytics or advertising, and no other company sets cookies on pages we serve. Sign-in links and session tokens are stored only as one-way hashes, so a copy of our database could not be used to sign in as you.

Service providers and overseas disclosure

Our application server and primary database are in Australia. We use the providers below to run parts of the service. Each receives only what it needs for its task, and some store or process that information outside Australia, mainly in the United States. We choose established providers that publish their own privacy and security commitments, but the privacy law of those countries may not protect your information in the same way as Australian law.

The Local Opportunity Radar and our own prospect research also query public sources, such as government tender registers and public social search. They receive only search words or public identifiers from us, never your contact details or your customers’ details.

We do not sell personal information. We may also disclose it where the law requires it, for example to a court or regulator, or to protect someone’s safety.

How long we keep it

Each kind of record has its own period, applied by a daily automatic sweep. A paid site is never deleted merely because its old preview expires. Authenticated support messages are encrypted at rest, and identity-unverified external email has its own shorter period. Records placed on a legal hold are kept until the hold ends.

How we protect it

Sign-in tokens are stored only as one-way hashes, contact details for prospecting and support messages are encrypted at rest, and off-site backups are encrypted before they leave our server. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner as the law requires.

Seeing, correcting or deleting your information

If you have an account, you can download your website and data export, and delete a site or your account, yourself at any time (see downloading, leaving and deleting). For anything else, write to hello@sitefinite.com to see what we hold about you, correct it, or have it deleted. We may ask you to confirm your identity first. We will respond within 30 days and there is no charge. If we cannot do what you ask, for example because the law requires us to keep a record, we will tell you why in writing.

Complaints

If you think we have mishandled your personal information, emailhello@sitefinite.com with the details. We will acknowledge your complaint within five business days and aim to give you a full written response within 30 days. If we need longer, we will tell you why and when to expect it.

If you are not satisfied with our response, or we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC) atoaic.gov.au. If you live outside Australia, you can also contact the privacy regulator in your country.

Changes to this notice

When we change what we collect or who we share it with, we update this notice in the same change and give it a new version. We email account holders before a significant change takes effect. Earlier versions stay available at their own permanent links.

Privacy notice, version of 4 October 2026. Last updated 4 October 2026.Permanent link to this version.