Política de privacidad

Esta política cubre a dos grupos de personas, y la distinción importa porque nuestras obligaciones son diferentes.

Tú, nuestro cliente. Nosotros decidimos qué hacer con los datos de tu cuenta, por lo que somos el responsable de su tratamiento.

Visitors to sites you publish. Procesamos sus datos siguiendo tus instrucciones: tú decides qué formularios y páginas de reserva usar, y qué hacer con los resultados. Para esos datos, tú eres el responsable y nosotros somos tu encargado del tratamiento.

A third group is covered separately in sección 10: businesses we research and contact before any account exists.

• Account details — your email address, name if you give one, and a hashed password. We never store the password itself.
• Sesiones de inicio de sesión — la dirección IP y el user-agent del navegador de cada sesión activa, para que puedas ver y revocar tus propias sesiones desde la configuración de la cuenta.
• Your content — the sites you build, including copy, images, uploaded files, and anything you import.
• Product usage — which features you open and which actions you take in the app, so we can tell what works. This is tied to your account identifier, never to your email address, and we do not record your screen or your keystrokes.
• Billing details when you subscribe. Card numbers are handled by our payment processor and never reach our servers; we keep the card brand, last four digits and expiry so you can recognise your own payment method.
• Correspondencia de soporte cuando nos escribes por correo electrónico.

El editor y el agente de blog son herramientas de chat, y guardamos la conversación para que sobreviva a una recarga de página y para que el siguiente mensaje tenga el contexto del anterior. Esa transcripción incluye lo que pediste y las partes de tu sitio que el agente leyó o modificó al responder.

It is stored with your site and deleted with it. We do not use your conversations, your content, or your site to train AI models, and neither the transcript nor your content is used to answer anyone else's request.

Los sitios publicados a través de UltraSites incluyen analítica para que veas cómo rinden. Por cada visita registramos la página, la fuente de referencia, el user-agent del navegador, el idioma, la zona horaria, un país derivado de la dirección de red, parámetros de campaña y un identificador de visitante aleatorio que distingue las visitas recurrentes.

Nuestros registros de analítica no contienen las direcciones IP de los visitantes. La dirección se usa en el momento en que llega una solicitud — para determinar el país y respetar la lista de exclusión que mantiene fuera de tus cifras las visitas de tu propio equipo — y no se guarda en el registro de analítica.

Hay una excepción, y se aplica a los envíos de formularios. When a visitor submits a form we capture the IP address, the user-agent and any advertising cookies present on that request, and hold them alongside the submission. They exist for a single purpose: if you have connected an advertising account, they are what lets us tell that platform the lead came from its click. They are never shown in your inbox, never used for anything else, and are erased 90 days after the submission — the longest window any ad platform accepts a conversion for. The lead itself stays.

Where you run a contact or lead form, we store what the visitor submits so you can read it. Where you run booking, we store the name, email address, phone number, any note the visitor adds, and the appointment itself, so the appointment can be confirmed, changed or cancelled. That content is yours; we do not use it for anything except delivering it to you and running the booking.

If you run an A/B test, visitors are assigned to a variant and that assignment is remembered for 90 days so they see a consistent site.

Los sitios que alojamos configuran un pequeño número de cookies propias. Ningún tercero configura una cookie a través de nosotros a menos que tú mismo añadas una.

• A visitor identifier and a session identifier, so repeat visits and sessions can be counted.
• A first-touch attribution cookie recording how the visitor first arrived, so a lead can be credited to the campaign that produced it.
• An A/B test assignment, where a test is running, kept for 90 days.
• An opt-out cookie, described below.
• A consent record, where consent gating is switched on.

A visitor can opt out of analytics on any site we host by visiting it with ?us_track=off appended, which sets a cookie the tracker honours from then on.

By default these cookies are set when a visitor arrives. Each site also has an opt-in mode in which nothing is stored until the visitor accepts — you will need to run a consent banner to collect that acceptance, because we do not currently ship one. Deciding whether your audience requires a banner, and putting one in place, is your responsibility as the controller of your visitors' data.

A site you publish is served to anyone who asks for it, including search engines and the crawlers that gather material for AI answer engines. Published sites are always indexable and always readable by those crawlers; there is no per-site setting to opt out. If you do not want something read, do not publish it.

Registramos qué rastreadores de IA leen qué páginas, para que puedas ver si los motores de respuesta están encontrando tu sitio. Ese registro es sobre el rastreador, no sobre una persona.

El editor, el generador de sitios, el redactor de blog, el corrector de SEO y el traductor funcionan enviando el contenido de tu sitio a Anthropic, que devuelve los cambios. Esto significa que tu texto y la estructura de tus páginas salen de nuestra infraestructura y son procesados por ellos en nuestro nombre para responder a tu solicitud. Lo mismo aplica a la revisión automatizada descrita en el Términos de Servicio, which reads published content to check it against our acceptable-use rules.

Where we research your market to brief the AI on your business, that research runs as web searches about your business and your competitors. It does not include your customers' data.

Where you dictate instead of typing, the recording is sent to OpenAI to be turned into text and is not retained afterwards. Where you generate an image, the prompt is sent to our image provider.

Where you enable the AI-visibility feature, we send prompts about your business to answer engines to check whether your site is being cited. Those prompts describe your business; they do not include your customers' data.

No vendemos datos personales. Los compartimos con los proveedores que hacen funcionar el servicio:

• Amazon Web Services — hosting, file storage, and transactional email.
• Anthropic — the AI behind the editor, the generator, the blog writer, the SEO fixer, translation, market research and content screening.
• OpenAI — speech-to-text for dictation, and one of the answer engines used for AI visibility.
• Our image-generation provider, where you generate an image.
• Stax — nuestro procesador de pagos. Los datos de la tarjeta van de tu navegador directamente a Stax.
• DataForSEO — keyword, ranking and AI-mention data about your site and your market.
• Google: PageSpeed y, si lo conectas, datos de rendimiento de Search Console.
• Perplexity, for the AI-visibility feature when enabled.
• PostHog — product usage analytics for the app itself.
• Desque — where you connect it, leads from your site are forwarded to it as support tickets.

Advertising platforms. Where you connect an advertising account — Google Ads, Meta, Microsoft, TikTok, LinkedIn, Reddit or OpenAI — we send that platform the conversions from your site so it can measure and optimise your campaigns. That upload includes the identity-match material described in section 4. Nothing is sent to any advertising platform until you connect one, and connecting one is your decision as the controller of that data.

También podemos revelar datos cuando la ley lo exija, o cuando sea necesario para investigar una infracción de los Términos de Servicio.

• Analítica del sitio: 400 días, luego se elimina automáticamente mediante un barrido diario.
• AI-citation records: 400 days. AI-crawler hits: 400 days. Page-speed samples: 120 days.
• El material de verificación de identidad adjunto a un envío de formulario: 90 días, luego se borra mientras se conserva el envío en sí.
• Detalle de consultas y páginas de Search Console: 90 días. Estudio de mercado sobre tu negocio: 90 días, luego se actualiza.
• Envíos de formularios y reservas: hasta que los elimines, o hasta que cierres tu cuenta.
• Your sites, files and content: for as long as your account is open.
• Account and billing records: for as long as needed to meet tax and accounting obligations after you close the account.

When you close your account we give you a reasonable window to export before deleting.

Aparte del servicio, investigamos pequeños negocios a partir de fuentes públicas — el propio sitio web de la empresa, sus listados públicos y sus datos de contacto publicados — para comprobar el rendimiento del sitio y preparar un informe sobre él. Conservamos el nombre del negocio, su sitio web, sus datos de contacto publicados y los resultados de esa comprobación, y podemos usarlos para contactar al negocio sobre lo que encontramos.

Este es nuestro interés legítimo en ofrecer un servicio relevante a un negocio al que podemos ayudar de forma demostrable. Si prefieres que no conservemos ni usemos tus datos, dínoslo y los eliminaremos, registrando la dirección para no volver a contactarla. Cada mensaje que enviamos indica cómo darse de baja.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, object to how we use it, or receive it in a portable form. Email hello@ultrasites.ai and we will respond.

If your request concerns data collected by a site one of our customers publishes, that customer controls it — we will pass your request to them.

Passwords are stored hashed. Access to production data is limited to the people who need it to run the service. Files are stored privately and served through short-lived signed links rather than public buckets. Credentials for the accounts you connect are stored encrypted.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant regulator as the law requires.

Our infrastructure and several of the providers above operate in the United States. If you are outside it, your data will be transferred and processed there.

Actualizaremos esta política a medida que el servicio evolucione, y notificaremos los cambios importantes por correo electrónico o en la aplicación antes de que entren en vigor.

Privacy questions: hello@ultrasites.ai.