Privacy Policy

1. Data we collect

• Account data: name, email address, agency name, plan, and the settings you configure. Passwords are stored as salted hashes by our authentication provider — we never see them.
• Billing data: subscription status, plan, invoices, and the last four digits and brand of your card. Full card numbers go directly to Stripe; we never receive or store them.
• Support data: tickets, chat messages, and any files you attach.
• Usage data: pages viewed, features used, logins, approximate device and browser type, IP address, referrer, and campaign parameters.
• Customer content: logos, colors, copy, videos, and configuration you upload to build your white-label portal.
• Your clients' data: if you invite your own clients into a portal we host, we process their name, email, login activity, progress, and support messages on your behalf.

We do not ask for and do not want government identifiers, financial account numbers, health data, biometric data, precise geolocation, or data about children.

2. Why we use it

• To create and operate your account and portals (performance of our contract).
• To take payment and manage subscriptions (contract).
• To answer support requests and send service notices (contract).
• To keep the service secure, prevent fraud and abuse, and meet legal and accounting obligations (legal obligation and legitimate interests).
• To measure how our own website and marketing perform, and to send product emails you can unsubscribe from (legitimate interests, or consent where required).

We do not sell personal information, and we do not share it for cross-context behavioural advertising beyond the advertising measurement described in section 4.

3. AI features

Parts of the product use AI models to draft emails, answer support questions, and summarise activity. Content you submit to those features (and the knowledge base you provide) is sent to our model providers to generate the response. We do not permit those providers to use your content to train their models, and we do not feed one customer's data into another customer's assistant.

4. Processors and third parties

We share data only with providers that help us deliver the service, under contract and limited to what they need:

• Supabase — database, authentication, file storage, and server functions.
• Stripe — payments, subscriptions, and the billing portal.
• Fanbasis — alternative checkout on certain offers.
• HighLevel / LeadConnector — transactional and marketing email, forms, booking calendars, and review widgets.
• Meta (Facebook) — advertising measurement via the Meta Pixel and matching server-side conversion events (email is transmitted hashed).
• Slack — only if you choose to connect a workspace.
• AI model providers — for the features described in section 3.
• WebinarKit and video hosts — webinar and lesson playback.

We may also disclose data if required by law, to enforce our terms, or in connection with a merger or sale of the business (you will be notified).

5. Cookies and tracking

Essential cookies keep you signed in. Analytics and advertising cookies are on by default and can be switched off at any time from our Cookie Policy, which lists every cookie and pixel we use.

6. Retention and deletion

• Account and content data is kept while your account is active.
• After cancellation, configuration such as branding, custom URLs, and portal settings may be deleted permanently and cannot be recovered.
• Analytics events are retained in aggregate; billing and tax records are kept as long as law requires (typically seven years).
• You can ask us to delete your account and data at any time by emailing us, and the app includes an account-deletion request path.

7. Your rights

Depending on where you live you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, to opt out of targeted advertising and any sale or sharing of personal information, and to withdraw consent. California residents additionally have the right not to be discriminated against for exercising these rights. EU, UK, and Swiss residents may lodge a complaint with their local data protection authority.

To exercise a right, email andrew@dna-media.net. We respond within 30 days and may need to verify your identity. Requests are free unless excessive.

8. International transfers

We operate from the United States and our providers may process data in the US and other countries. Where we transfer personal data out of the EEA, UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism offered by the provider.

9. Agencies as controllers

When you use SaaSSuite to onboard and support your own clients, you decide what data you collect from them and you are the controller of that data; we act as your processor. You are responsible for having a lawful basis and your own privacy notice for those clients, and for the accessibility and content of any customisations you publish.

10. Security

We use encryption in transit, row-level access controls in the database, scoped access tokens, and role-based admin access. No system is perfectly secure; if a breach affects your personal data we will notify you and any regulator as required by law.

11. Children

The service is for business use by adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, email us and we will delete it.