Seal Sites

Privacy Policy

Last updated 23 October 2026

Seal Sites builds and runs websites for local food businesses. This policy is what we do with your information: it explains what we keep about you and your business, who else touches it, how long we keep it, and how to get it deleted. We collect as little as we can, on purpose.

1. The short version
2. Who we are, and who else sees it
3. What we keep about you
4. What we never keep
5. The people who visit your site
6. Texting our business number
7. Where it lives, and who else touches it
8. How long we keep it
9. Getting a copy, or getting it deleted
10. If something goes wrong
11. Changes to this policy

1. The short version

• We keep what you gave us to build your site, and the messages you send us.
• We never see or keep your full card number. If you pay by card, you pay on Stripe’s page, not ours.
• We don’t track the people who visit your site. We count how many times your page was opened and when, and nothing about who opened it. Section 5 is the whole of it.
• We don’t sell your information, and we only send it to the services listed in section 7.
• Ask us to delete it and we will. Two things we can’t delete are explained in section 8: tax records, and whatever the companies in section 7 keep in their own systems.

2. Who we are, and who else sees it

Seal Sites is Elpidio “Sami” Poblano and Jerry. We are the only two people who work here, and the only two people at Seal Sites who look at your information. What goes on your site is public, because that is the point of it. Reach us at hello@sealsites.com.

We use a few outside companies to run things: email, hosting, payments, texting, the AI tools we use to help build and check your site, and the AI service that sorts the questions typed into a page’s question box. They’re all listed in section 7. Their systems hold what that list describes, and they process it to provide that service to us. We don’t give your information to any of them for any other reason.

About the AI tools, plainly: we use Anthropic’s Claude and OpenAI’s Codex to help write and check the code for your site. When we do, they see what goes into your site: your menu, your photos, your page. No AI tool sends you messages or makes decisions about you. If your page has a question box, an AI service also reads each question your customers type, only to work out what it is about; the answer is written by us (section 5).

3. What we keep about you

Most of this is information you want on the internet: it is your menu and your phone number, and the point of the site is that people can see it.

Before we meet: when we’re deciding which businesses to visit, we look at public information about a business, such as its listing, its public social posts and the reviews people have left about it. All of it is already public.

4. What we never keep

• Your full card number, your bank login, or your account numbers. If you pay by card, you type your card into Stripe’s own payment page. Stripe holds it, and we only ever see the last four digits, your name and your email. If you pay by cash or transfer, there is no card at all.
• Your customers’ personal information, unless you turn ordering on. Without ordering we keep nothing that could identify one of them. We do count when your page was opened, which section 5 sets out in full; that count holds no name, no number and nothing about the person. If your page has a question box, a question someone types passes through us to be answered and isn’t kept, and their IP address is used only for a one-minute count against floods (section 5). With ordering on, a customer’s name and number pass through us on the way to your phone, and section 5 says exactly what happens to them and for how long.
• Anything about you that we didn’t need to build or run your site.

One exception, so the list above stays true: if you pay by transfer or by an app like Zelle or Venmo, we see the name or username the money came from. That is how we know you paid. It goes in your payment record (section 3) and nowhere else.

5. The people who visit your site

We never learn who visits your site. We count how many times the page is opened and when, set out below, and nothing in that count is about the person who opened it. Two things go further, and each has its own part at the end of this section: the question box and ordering. Everything before them assumes both are off. Ordering is off today for every client.

There is no sign-up box, no cookie banner and no advertising pixel, and no contact form unless you turn ordering on. We put nothing on their device and keep no list of them.

What we count, in full. Each time your page is opened, one line is written: which site it was, that it was a page opening, and the time. No IP address, no phone or computer details, no cookie, no name, and nothing that ties one opening to another. So we can tell you “your page was opened 340 times in August, mostly on Friday evenings.” We cannot tell you, or anyone else, who any of those people were or whether two openings were the same person. That isn’t a promise we have to remember to keep; nothing we store could tell us.

Why it exists, and how long it lasts. It is what makes your monthly report worth reading: how many times your page was opened, when, and how that compares with last month. Each line is kept 90 days and then deleted. The monthly totals made from those lines (counts and times, nothing about a person) we keep for as long as we run your site, because they are your history. Your report starts from the day counting started on your page.

One outside company is reached when your page loads, and it does the counting. Your page fetches its “what’s on today” line from Cloudflare, so a visitor’s browser connects to Cloudflare, and Cloudflare receives their IP address the way any company serving a file to a browser does. We never receive it, and nothing we store contains it. (Asking a question in the question box reaches Cloudflare again, and so does opening the order form, for the bot check below.)

Nothing else is reached. No analytics service, no map, no advertising network, no font service. A client site is built with no other outside connections, and we check that on every client site we build.

When a customer taps call or text on your site, their own phone app opens and the message goes straight to you. It never passes through us.

This website, sealsites.com, works the same way. No cookies, no analytics, no advertising, and nothing loaded from another company. Our server keeps no log of who visits it.

If your page has a question box

A question box lets a customer type something like “do you have brisket Saturday?” and get an answer on the spot. The answers are written by us, from what you told us: your hours, your menu, what’s sold out today. An AI service does one job only, which is to work out what the question is about, like your hours, a dish or ordering. It never writes the answer.

Where the question goes. From your customer’s browser to our question service at Cloudflare, which passes it, with your menu, to OpenRouter, a company that connects us to AI models. OpenRouter sends it to Google, or to Anthropic if Google can’t take it. We only let it go to AI companies that don’t train their models on what they’re sent.

What is kept. By us, nothing: we don’t store the question or the answer, and our service writes no log that contains either. To stop one person sending hundreds of questions, Cloudflare’s rate counter counts questions per IP address in one-minute windows; we never store the address ourselves. OpenRouter doesn’t store the question. Google keeps nothing; Anthropic keeps what it is sent for up to 30 days under its own rules, and doesn’t train on it.

The box asks for no name, no number and nothing else about the person. A question goes out as it was typed, though, so if someone types their name or number into it, that goes along with the question, and is kept no longer than above.

If you turn ordering on

No Seal Sites client is taking orders through their page today. Ordering isn’t switched on for anyone, so nothing below is happening to anybody’s customers. It starts only when you and we turn it on together.

When a customer orders from your page, they type their name, their mobile number, the dishes they want and, if they like, a short note. This is everything that gets stored, and for how long:

“30 days” runs from the last time the order was touched, not from when it arrived. If you mark an order done three weeks later, its clock restarts that day, so an order you keep coming back to can stay longer than a month.

Two other things happen:

• A bot check. Before an order goes through, Cloudflare checks that the person is a person, and sees their IP address to do it.
• Getting it to you. The order reaches your phone through Telegram, so Telegram carries your customer’s name and number the way it carries any message you receive.

The alert to your phone can fail, and your customer won’t know. If Telegram is down, or your alerts aren’t set up yet, the order is still saved and your customer still sees that it was received. So every order is in your panel whether or not the alert arrived; check the panel during the hours you take orders. We won’t switch ordering on for you until your alerts are set up and tested.

What your customer is told. The order form itself says, in both languages, that you get their name and number, how long it is kept, and how to have it removed.

If a customer asks to be forgotten, tell us and we’ll delete their loyalty card the same day; there is a button for it in your panel. An individual past order has no delete button yet: it goes when its clock runs out, or Sami removes it by hand if they want it gone sooner, and we’ll confirm when it’s done. We can only delete what we hold; an order that already reached your phone is yours to clear.

6. Texting our business number

Until October 19, 2026, clients could text our business number about their site. The number was registered with the phone carriers in Elpidio “Sami” Poblano’s name. This is what happened to those texts, and what we still keep from them:

• Who carried it: Twilio, the company that ran our number. A text went from your phone to Twilio, and from there to both of us at once, on our own phones.
• Who sees it: Sami and Jerry, both of us, every text. When one of us replied, the other got a copy.
• What we keep: your mobile number, what you wrote, when, which of us replied, and a short name we give you in our list so we know who is who. If you sent a photo, we kept Twilio’s link to it, and the photo itself stayed with Twilio. If the photo was for your site, we saved a copy with your other site photos (section 3).
• Where: in our message store at Cloudflare.
• How long: each message in our message store is deleted automatically after one year. Ask us and we delete your whole history from it within two days. The copies that reached our own phones stay there until we clear them by hand, which we do when you ask. Twilio keeps its own records under its own rules.
• If you replied STOP: we kept a note that you did. If you ask us to delete your history, that note goes with it.

7. Where your information lives, and who else touches it

That’s the entire list. Apart from what goes on your site for everyone to see, your information isn’t sent anywhere else, to anyone else, for any reason. We don’t sell it, we don’t share it for advertising, and no other company gets a copy.

8. How long we keep it

• While you’re a client: what we need to run your site (your site files, menu, photos, design drafts and our emails with you) for as long as we run it. The shorter limits below still apply while you’re a client.
• After you leave: your site files, design drafts, our emails with you and the material you gave us for 12 months, in case you come back. Then we delete them.
• Business records (your name, what we built, your signed agreement, and what you paid and when) for up to seven years, so our accounts and tax returns add up. Not your photos or your messages.
• Before you sign: your answers to our questions and the plan and price we set up for you are deleted 90 days after the last change, or the same day if you tell us no. Once you sign, the agreement is a business record (above).
• Page openings: each line for 90 days, then deleted for good. The monthly totals for as long as we run your site.
• Questions typed into a question box: not kept by us at all. Cloudflare’s rate counter counts them per IP address in one-minute windows (section 5).
• Texts to our business number: one year per message in our message store, then deleted automatically. The copies on our phones until we clear them (section 6).
• Businesses we looked at that didn’t become clients: our notes about them go within 12 months of the last time we spoke, or of when we first wrote them if we never spoke.
• Your customers’ orders, if you turn ordering on: 30 days for the order, 90 days for the record that it happened (last four digits of a number only), and a loyalty card until it is deleted (section 5). The order and its record are kept short on purpose: it isn’t our information, and we keep it as briefly as the feature allows.
• Ask us to delete sooner and we will, apart from the business records above, which we have to keep.

The companies in section 7. We can delete what we hold. We can’t reach inside another company’s systems, so their records and their own backups follow their rules, not ours. We will ask them to delete on your behalf and tell you what they say.

9. Getting a copy, or getting it deleted

Email hello@sealsites.com and ask. You can ask us to:

• Send you everything we hold about you, including your site files
• Correct anything that’s wrong
• Delete what we hold (except the business records in section 8)

Sami handles these personally. We reply within 30 days, and usually much sooner. You don’t need to give a reason.

If one of your customers asks you, forward it to us and we’ll delete it within two days. You can also delete a loyalty card yourself with the button in your panel (section 5).

Asking never counts against you. We won’t cancel you, charge you or treat you differently for asking. One practical thing: some of what we hold is your site, so deleting your menu or photos while your site is running takes them off the page too. We’ll tell you exactly what would disappear and check with you first.

10. If something goes wrong

If your information is ever exposed (a break-in, a mistake, anything, including at one of the companies in section 7), we will tell you directly, and tell you what actually happened. We’ll contact you as soon as we understand it, and no later than 72 hours after we know there’s a real problem, and we’ll tell you what we’ve done about it.

11. Changes to this policy

If we change how any of this works, we update this page and the date at the top, and if you’re a client we send you the new version and tell you what changed. We won’t start collecting something new without telling you first.

Questions about any of this: hello@sealsites.com