1. Google sign-in, email sign-in and account information
You can sign in with Google or with a sign-in link sent to your email address. With Google, Lodesta receives your name, email address, profile image when available, and Google account identifier. Supabase processes the authentication flow. Lodesta uses this information to create and secure your account, provide account access, and send you notices about your own websites, such as new inquiries and finished website changes. These notices go only to the email address on your Lodesta account. Lodesta does not receive your Google password or use Google account information for advertising.
2. Business and website information
Lodesta may collect business details, source website URLs and public website content, business profile information, uploaded assets, authoring instructions, generated website content, domain settings, and support communications. We use this information to create, customize, host, publish, and maintain websites and local-presence services requested by account owners.
3. Inquiries and visitor information
Lodesta-hosted websites may collect inquiry form submissions, including names, email addresses, phone numbers, messages, and other fields selected by the site owner. First-party website analytics records page views, clicks, form activity, limited performance measurements, page paths, referrer hosts, campaign fields, and broad device categories. A random identifier held in page memory connects activity only within that page load; it does not identify returning visitors or connect activity across pages. Inquiry handling and platform security may separately process user agents and IP-derived hashes for abuse prevention. Each inquiry is stored in the site owner's Lodesta inbox and a copy is emailed to the email address on the site owner's Lodesta account. The site owner and Lodesta staff who operate and support the service can see inquiries; they are kept while the site owner's account exists unless the site owner or the visitor asks us to delete them. When someone requests a Website Health Report, we use the email address they enter to send the report link.
4. Cookies and local storage
Lodesta uses authentication cookies required to keep account users signed in, and product interfaces may use local storage for preferences. The default analytics on Lodesta-hosted websites does not set analytics cookies, use local or session storage, or create persistent visitor identifiers. Account authentication, protected-preview access, interface preferences, and security controls are separate from anonymous website analytics. Lodesta does not use these technologies for third-party behavioral advertising.
5. How we use information
We use information to authenticate users; provide website creation, hosting, editing, publishing, analytics, inquiry, and local-presence features; operate and secure the platform; diagnose failures; prevent abuse; communicate service information; respond to support requests; and improve Lodesta. Public source website content, business information, and authoring instructions may be processed by AI systems to generate and maintain requested website content.
6. Service providers
Lodesta uses service providers to operate the platform. These currently include Supabase for authentication and database services, Railway for application hosting, Cloudflare and R2 for networking and artifact storage, OpenAI for website research and generation, OpenRouter when its optional model-routing capability is enabled, and Resend for account notices, inquiry notifications and report emails. These providers may process information only as needed to perform their respective services.
7. Sharing and sale of information
Lodesta does not sell personal information or use it for third-party behavioral advertising. We may share information with service providers described above, when directed by an account owner, to comply with law or valid legal process, to protect rights and safety, or as part of a business transaction subject to appropriate safeguards. Site owners control the forms and content published on their websites and are responsible for notices and consent required for their businesses.
8. Retention
Our retention policy for raw first-party website analytics events uses a 14-month cutoff so site owners can make year-over-year comparisons. Analytics identifiers are not saved in the visitor’s browser between page loads. We retain other information for as long as needed to provide the service, keep owned websites and retained published versions functional, meet security, audit, legal, and dispute-resolution obligations, and maintain reliable records. When information is no longer required, we delete or de-identify it where reasonably practical.
9. Security
Lodesta uses reasonable technical and organizational safeguards designed to protect information, including access controls, encrypted network connections, restricted server-side repositories, and secret-management practices. No storage or transmission system can be guaranteed completely secure.
10. Choices, requests, and account deletion
You may request access to, correction of, export of, or deletion of certain personal information by contacting Lodesta. An account that owns Lodesta sites cannot be deleted until those sites are transferred or explicitly disposed of, so that retained websites and public artifacts are not unintentionally broken. We will respond to verified requests as required by applicable law.
11. Changes to this policy
Lodesta may update this policy as the service changes. We will post the updated policy at this URL, revise the effective date, and provide additional notice when required by law.
