Privacy Policy

1. Scope and operator

This Privacy Policy explains how B2BSiteKit, an independent individual-operated business based in Suzhou, China and serving customers primarily in English-speaking markets, handles personal data when you visit our website, create an account, request information, use a customer workspace, purchase a service, or communicate with support. The operator identified in the applicable checkout, order confirmation, or invoice is responsible for the relevant customer relationship.

2. Data we collect

We collect account and contact details such as name, email address, company, role, and authentication status. We also process service activity, security events, device and browser information, approximate network location, support messages, implementation materials, inquiry records, and billing administration details. Payment card information is handled by the selected payment provider rather than stored directly in the platform.

3. How we use data

We use personal data to provide and secure accounts, deliver managed website services, send authentication and operational messages, respond to support, manage subscriptions, improve reliability, prevent abuse, comply with legal obligations, and communicate about requested services. Marketing messages are sent only where permitted and can be unsubscribed from.

4. Customer website data

When we process inquiries, contacts, analytics, or other personal data on a customer's website, the customer generally determines why that data is collected and acts as controller. B2BSiteKit processes that data to provide the contracted platform and managed services. Customers remain responsible for their own notices, consent choices, and lawful use of inquiry data.

5. Sharing and service providers

We share data only as needed with infrastructure, email, identity and authentication, monitoring, analytics, support, billing, and professional service providers operating under appropriate obligations. When Creem checkout is used, Creem acts as Merchant of Record and processes identity, billing, payment, tax, fraud-prevention, refund, and chargeback information under its own buyer and privacy terms. When you choose Google or Microsoft sign-in, that provider processes the authentication request under its own terms and sends us the account details needed to identify and secure your B2BSiteKit account. We may also disclose data when required by law, to protect rights and security, during a business transaction, or with your direction. We do not sell personal data.

6. International processing

Our customers and service providers may operate in different countries. Where personal data is transferred internationally, we use contractual and technical safeguards appropriate to the service and applicable requirements.

7. Retention

Account and service data is retained while needed to provide the service, meet contractual and legal obligations, resolve disputes, and maintain security records. Authentication links expire after a short period and can be used only once. Session and security records are periodically removed or anonymized when no longer needed.

8. Security

We use measures designed to protect personal data, including encrypted transport, access controls, isolated customer deployments, hashed passwords and authentication tokens, and secure session cookies. Backup, external monitoring, and update arrangements apply where configured under the relevant service order. No internet service can guarantee absolute security.

9. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export personal data, or object to certain processing. You can update account information through support and may unsubscribe from non-essential messages. Authentication and service notices are necessary for account operation.

10. Contact

Privacy requests and questions can be sent to [email protected]. We may request information needed to verify the requester and protect account data before completing a request.