Privacy notice
Last updated: 27 October 2026
This page explains which data we process, why, for how long and what choices you have. It covers the yoursimple.site website, the app.yoursimple.site app and the sites customers publish with the service.
Data controller
The controller is Alessio Bussolari, Via del Prete 121, 47841 Cattolica (RN), Italy, Italian VAT number 02037590383. For any privacy request write to hello@bussolarialessio.me.
Account
When you sign up we process your name, email, password (stored only in hashed form), the date you accepted the terms and the data processing agreement and, for each login, your IP address and browser. We need them to provide the service and to protect your account. Legal basis: the contract. We keep this data while the account exists. From the Account page you can download your data or delete the account with all its sites.
Payments
Payments go through Stripe. Only Stripe handles your card details: we never see them. We keep the Stripe customer ID, the subscription status and the amounts paid. Legal basis: the contract and tax obligations. Invoices and accounting records are kept for 10 years, as the law requires, even after the account is deleted.
Site content
We process the texts, photos and documents you upload to prepare your site, and the content you publish. They are used only to build and show your site. Legal basis: the contract. They stay until you remove them or delete the site or the account. Upload only materials you hold the rights to and, if they contain other people's data, make sure you may use it.
AI generation
To write the site draft and the SEO texts we send your notes, the text of your documents and your uploaded photos to OpenRouter, Inc. (United States), which passes them to the Mistral Small model. The model is run by one of these providers, all based in the United States: DeepInfra, Parasail or Venice. We only use providers that do not keep the data to train models. If you use the business search, we read the public listing data from Google Places: name, address, category, opening hours and ratings. Legal basis: the contract. Do not put personal data the site does not need into your materials.
Custom domains
If you connect your own domain, we store the domain name and check its DNS records to verify it. To enable HTTPS the domain name is sent to a certificate authority and appears in public certificate logs. Legal basis: the contract. We keep the domain while it stays connected to the site.
Sites published by customers
For the data of visitors to a published site, the controller is the customer who runs it; we process that data on the customer's behalf, under the data processing agreement the customer accepts. Contact form requests (name, email, phone, message) are deleted after 24 months. Visits are counted only if the visitor consents, without cookies: IP and browser are not stored, the country is estimated on our servers and visit data is deleted after 90 days. Site icons are loaded from Font Awesome (Fonticons, Inc., United States), which receives the usual technical request data. Each site has its own privacy notice.
Emails
Service emails (address verification, password reset, access after purchase, account deletion confirmation, requests received through the site contact form) are sent through Resend. We may also send you reminders about your site: you can turn them off from the link in every email. Legal basis: the contract and, for reminders, our legitimate interest.
Businesses we contact
Sometimes we prepare a site proposal for a business, starting from its public data, and contact it at its work email address. Legal basis: our legitimate interest. Every email has a link to stop receiving them: from then on we keep the address only so as not to write to you again.
Where data is stored and who helps us
Servers and databases are at Hetzner Online GmbH, in its Falkenstein and Nuremberg data centres in Germany. Files, images and database backups are stored on Amazon Web Services; files and images in its Frankfurt data centre in Germany. The other providers are: Stripe Payments Europe Ltd (Ireland) for payments; OpenRouter, Inc. (United States) with DeepInfra, Parasail and Venice (United States) for AI; Google LLC (United States) for business data and for the fonts of the account area; Resend (Plus Five Five, Inc., United States) for emails; Fonticons, Inc. (United States) for the Font Awesome icons of the sites; CloseYourIt, our monitoring service, running on our Hetzner servers in Germany, for errors, statistics and replays. Each one receives only the data it needs.
Transfers outside the European Union
Some providers are based in the United States. For Amazon Web Services, Stripe, Google, Resend and Fonticons the transfer relies on their certification under the EU-US Data Privacy Framework. For OpenRouter it relies on the European Commission's standard contractual clauses; OpenRouter contractually requires DeepInfra, Parasail and Venice, which run the model in the United States, to comply with data protection law. You can ask us for a copy of the safeguards by writing to hello@bussolarialessio.me.
Site statistics
With your consent the site measures visits and page speed through CloseYourIt, without cookies: the IP address and browser details are discarded on arrival and replaced by an anonymous daily identifier that cannot be traced back to you.
Session replay
With your separate consent, CloseYourIt records how pages are used to diagnose usability problems. All visible text and everything you type are masked before leaving your browser. Recordings are deleted after 30 days.
Error reports
If a page breaks, a technical report is sent to CloseYourIt so the problem can be fixed. It contains no cookies and no data that identifies you, and it is deleted after 30 days.
Cookies and local storage
Without consent the site stores only technical preferences: your language, your light or dark theme and your privacy choice. If you allow replay, a session identifier is added, deleted when you close the browser or withdraw consent. No advertising or profiling cookies are used. Details on the cookie page.
How long we keep data
Account and content: while the account exists. Database backups: 7 days, then overwritten. Invoices and tax records: 10 years. Site contact form requests: 24 months. Visit data of customer sites: 90 days. Statistics of this site: 365 days. Session replay recordings: 30 days. Error reports: 30 days. Cookie choice: 6 months.
Your rights
You can ask to access your data, correct it, delete it, restrict its use, receive it in a readable format or object to processing based on legitimate interest. You can withdraw consent at any time from this page. Write to hello@bussolarialessio.me. If you think your data is mishandled, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).