Privacy Policy
Effective 17 October 2026
Site Supply (sitesupply.dev) is operated by a sole proprietorship registered in Switzerland (UID CHE-265.283.258) ("Site Supply", "we", "us").
This policy explains what personal data we collect when you use the sitesupply.dev website, our MCP server, our API, our agent skills and related services (together, the "Service"), why we collect it, who we share it with, and what rights you have.
We process personal data under the Swiss Federal Act on Data Protection (FADP). Where it applies to you, we also comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who is responsible for your data
The controller is Site Supply, a sole proprietorship registered in Switzerland (UID CHE-265.283.258).
Email: contact@sitesupply.dev
For any question about this policy or your data, write to contact@sitesupply.dev.
2. What we collect
2.1 Account data
You sign in with Google, or with a one-time code we email to you. With Google, we receive your name, email address, profile picture and your Google account identifier; we never receive or store your Google password. With an email code, we store your email address, and the code itself only until it is used or expires.
If you connect an AI agent to your account (through our MCP server's sign-in), we store that connection: which client it is, what it may access, and the tokens it uses, until you or the client disconnect it.
2.2 Subscription and payment data
Payments are processed by Stripe. Stripe collects your card details and billing address directly on its own secure pages; we never see or store your full card number.
We store your Stripe customer ID, your subscription plan and status, and your invoice history (amount, date, currency, card brand and the last four digits of the card, as provided by Stripe).
2.3 Usage data
We record which textures you view, copy, download or install, and when.
When you save a texture while signed in, we store the list of textures you saved with your account, so it is the same on every device. When you save while signed out, the list stays in your browser (see section 4) and never reaches us; if you then sign in, it is moved to your account.
If you create an API key for MCP or agent access, we store the key in hashed form and log each request made with it: timestamp, key identifier, endpoint, the texture requested, IP address and user agent.
2.4 Technical data
Our hosting provider records standard server logs: IP address, browser and device information, pages requested, timestamps and error reports.
We measure how fast our pages load and respond with Vercel Speed Insights. It records page-performance measurements together with the page address, the browser and device type, and the country the connection comes from. It sets no cookies, does not store your IP address and does not identify you.
2.5 Communications
If you email us, we keep the email, your address and our reply.
We do not collect special categories of personal data, and we do not need any.
3. Why we use your data and on what basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Running your account, delivering textures, granting licences | Account data, usage data | Performance of a contract (Art. 6(1)(b)) |
| Billing, invoices, tax and accounting records | Subscription and payment data | Performance of a contract; legal obligation (Art. 6(1)(c)) |
| Keeping your saved textures with your account | Usage data (your saved list) | Performance of a contract |
| Operating MCP and API access, rate limiting, preventing abuse and fraud, keeping the Service secure | Usage data, technical data | Legitimate interests (Art. 6(1)(f)) |
| Measuring and improving how fast the Service loads | Technical data (performance measurements) | Legitimate interests |
| Service emails: sign-in codes, receipts, renewal reminders for yearly plans, security notices, changes to the Service or these terms | Account data | Performance of a contract |
| Product news and updates | Email address | Consent (Art. 6(1)(a)); only if you opt in, and you can unsubscribe at any time |
| Answering support requests | Communications | Performance of a contract; legitimate interests |
| Establishing, exercising or defending legal claims | Any of the above | Legitimate interests |
Under the FADP, this processing is justified by the performance of our contract with you, our overriding private interests in running a secure service, your consent where we ask for it, and our legal obligations.
4. Cookies
We use only cookies that are necessary for the Service to work:
- a session cookie that keeps you signed in,
- a security cookie that protects forms against cross-site request forgery,
- a first-party visitor cookie (`tx_v`) holding a random identifier, so we can tell which channel brought a visitor who later signs up or receives code. It carries no personal data. The identifier is included in the link you copy with "Copy to Agent", so that your agent's request counts as yours; if we use an analytics service, it receives only a keyed digest of the identifier, never the identifier itself,
- cookies set by Stripe on the checkout page for payment processing and fraud prevention.
We also keep a few small items in your browser's local storage so features you use keep working: the textures you save while signed out, and whether we have already shown you the tip about signing up to keep your saves. They stay in your browser and are not sent to us.
We do not use advertising or tracking cookies. Our only analytics is the page-performance measurement described in section 2.4, which uses no cookies and does not identify you. If this changes, we will update this policy and ask for your consent where the law requires it.
5. Who we share data with
We share personal data only with the service providers we need to run the Service. They process data on our behalf and under contract:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of the website, API and MCP server; server logs | United States, with infrastructure in the United States and the European Union |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Payment processing, subscriptions, invoices | United States and Ireland |
| Neon, Inc. | Hosting of our database (account, subscription, saved-texture and usage records) | The region chosen for our database |
| Resend, Inc. | Sending transactional emails (sign-in codes, receipts, renewal reminders, service notices) | United States |
| Google LLC | Sign-in with Google | United States |
When you sign in through Google, Google also processes your data under its own privacy policy. Vercel Speed Insights is part of our hosting with Vercel.
We may also disclose personal data when the law requires it, to protect our rights or the rights of others, or to a successor if the business is sold or transferred. In that case we will inform you.
We do not sell personal data, and we do not share it with advertisers.
6. International transfers
We are based in Switzerland, and the providers listed above process data in the United States and the European Union.
For transfers from Switzerland and the EU to the United States, we rely on the Swiss-U.S. and EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses, supplemented for Swiss law. Transfers between Switzerland and the EU are covered by the mutual adequacy recognised by both.
7. How long we keep data
| Data | Retention |
|---|---|
| Account data | For as long as your account exists, then deleted within 30 days of account deletion. Backups are purged within 90 days. |
| Subscription and payment records | 10 years after the end of the year they relate to, as required by Swiss accounting law (Art. 958f of the Code of Obligations). |
| Usage data (views, copies, installs) | For as long as your account exists, then deleted with the account. |
| Saved textures | Until you remove them or delete your account. |
| Sign-in codes | Until used, and at most until they expire (minutes). |
| Page-performance measurements | Kept by Vercel in aggregate, without anything that identifies you. |
| MCP and API request logs | 30 days. |
| Server logs | Up to 30 days. |
| Support emails | 2 years after the last message in the thread. |
8. Security
All traffic to the Service is encrypted with HTTPS. API keys are stored only in hashed form. Payment data is handled by Stripe under PCI DSS. Access to personal data is limited to what is needed to operate the Service.
No system is completely secure. If a breach affects your personal data, we will inform you and the relevant authorities as the law requires.
9. Your rights
You have the right to:
- access the personal data we hold about you and receive a copy,
- correct data that is inaccurate or incomplete,
- delete your data,
- restrict processing in certain cases,
- receive the data you gave us in a portable, machine-readable format,
- object to processing based on our legitimate interests,
- withdraw consent at any time where processing is based on consent, without affecting processing that took place before.
We do not make decisions about you based solely on automated processing.
To exercise any of these rights, email contact@sitesupply.dev. We may ask you to confirm your identity. We answer within 30 days.
You can also delete your account yourself in your account settings. This removes your account and usage data; we keep only what we are legally required to keep, such as invoices.
If you believe we have not handled your data correctly, you can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, if you are in the EU or the UK, with your local data protection authority.
10. Age
The Service is for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe we have, email contact@sitesupply.dev and we will delete it.
11. AI agents and automated access
If you give an AI agent or tool your API key, every request that agent makes is attributed to your account and logged as described in section 2.3. The provider of your agent processes data under its own terms and privacy policy, which we do not control.
12. Changes to this policy
We may update this policy as the Service changes. The effective date at the top always shows the current version. If a change materially affects your rights, we will email the address on your account before it takes effect.