1. Who we are and what this covers
The Suite Site is operated by Aaron Bivens, doing business as Abivens Tech, 900 N Allen Ave, Richmond, Virginia 23330. Questions about this policy or your data go to [email protected].
This policy covers our customers (businesses using The Suite Site), the people who use their accounts, and visitors to thesuitesite.com. Section 7 explains how we handle data about visitors to our customers' websites, where our customer is in charge of it.
2. What we collect
Information you give us
- Account details: your name, email address, password (stored only as a secure hash), your business and websites, and the people you invite.
- Billing: your plan, invoices and payment status. Card details go straight to Stripe; we never see or store your full card number.
- What you create and upload: photos and videos in your media library, posts and drafts, brand voice settings, and anything else you enter into the dashboard.
- Support messages: what you send us when you ask for help.
Information we collect automatically
- Login and security: a login cookie, and short-lived server logs including IP address, browser and the pages requested, used to keep you signed in, protect your account and fix problems.
- Your website's public pages: to write posts for you, we read the public pages of the websites on your account.
Information from other services
- Connected social accounts: the profile details and access permission the network gives us when you connect it (section 3).
- Stripe: confirmation of payments, card type and last four digits, and billing address.
3. Connected social accounts
When you connect Facebook, Instagram, X, Bluesky or TikTok, you sign in with that network and choose what to allow. We receive and store:
- The account's name and profile picture, so you can see which account is connected.
- The account's id on that network, so we post to the right place.
- Access tokens, which let us act for your account. They are encrypted and never shown to anyone, including you.
- Comments and messages people send your account (for networks where you use the Inbox): the text, when it was sent, and the sender's public name and id on that network, so you can read and answer them in one place.
We ask each network only for what these features need:
- Facebook: the list of Pages you manage; permission to post to the Page you choose; to read the comments on that Page's posts and the messages sent to it, and to reply to them as the Page; and to subscribe the Page to updates so new comments and messages reach your Inbox quickly. If your Page belongs to a business portfolio, access to that portfolio only so the Page can be listed and connected.
- Instagram: basic profile information (username, name and picture); permission to publish to your professional account; and to read and reply to comments on your posts and messages sent to your account.
- X: your profile and permission to post and upload media, and, if you use the Inbox, to read and reply to mentions and replies.
- Bluesky: an app password you create, used to post and, if you use the Inbox, to read and reply to mentions and replies.
- TikTok: basic profile information (name and picture) and permission to publish videos and photos.
How we use it. To publish the posts you have approved, at the times you scheduled; to show you the connection and the result of each post; and to show you the comments and messages people send your business and send the replies you choose. Nothing is posted or sent without your approval, except automatic replies you have switched on yourself for simple messages such as thank-yous or opening hours; you can turn those off at any time. We do not read your followers or your personal feed, we do not contact people who have not contacted your business first, and we do not share this data with anyone except the providers in section 5.
How long we keep it. Until you disconnect the account, delete your Suite Site account, or ask us to delete it. Disconnecting deletes the tokens immediately. You can also remove our access from the network's own settings at any time. See Deleting your data.
Posts already published stay on the network. Deleting a post or your account here does not remove what is already on Facebook, Instagram, X, Bluesky or TikTok; remove it there. Each network's own privacy policy covers what it does with your posts.
4. How we use your information, and why we are allowed to
| What we do | Legal basis (for EU and UK users) |
|---|---|
| Run your account, host your site, write and publish your posts, store your media | Performing our contract with you |
| Bill you and keep tax records | Contract, and legal obligation |
| Send account emails: receipts, payment reminders, alerts you set up | Contract |
| Answer support requests | Contract, and legitimate interest in helping you |
| Keep the service secure, prevent fraud and abuse, fix problems | Legitimate interest in a safe, working service |
| Tell you about new features (only if you agree) | Consent, which you can withdraw at any time |
| Respond to lawful requests from authorities | Legal obligation |
We do not use your information for advertising, we do not sell it, and we do not use it to train AI models. We do not make decisions about you with legal or similarly significant effects by automated means alone.
5. Who we share it with
Only these providers, and only what each one needs to do its job. Each is bound to protect it and use it only for us.
- Our hosting providers, which run the servers your data is stored on.
- Stripe, which processes payments.
- Mailjet, which delivers our emails.
- Anthropic, which provides the AI that writes your draft posts and can suggest replies in your Inbox. It receives your website text, brand settings and post instructions, and, for a suggested reply, the comment or message being answered. It does not use any of it to train its models.
- Shopify, if you connect your Shopify store: we read your paid orders' totals, refunds and dates to show which visits and sources brought sales. We do not receive your buyers' names, emails or addresses.
- The social networks you connect, which receive the posts and media you approve, when they are published.
- Your own Stripe and EasyPost accounts, if you use the store and shipping features, which receive the order and shipping details needed to complete each sale.
We may also disclose information if the law requires it, to protect the rights or safety of our customers, the public or us, or to a company that acquires our business, which would be bound by this policy.
We do not sell or share personal information for money or for cross-context behavioural advertising, as those terms are used in US state privacy laws, and we have not done so in the past 12 months.
6. Where your data is stored
Our servers are in the United States, and our providers may process data in the United States and other countries. If you are outside the US, your data is transferred there. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses or our providers' certifications under the EU-US Data Privacy Framework.
7. Visitors to our customers' websites
Our customers add our tracking code to their websites. For that data the customer is the controller and we are their processor: we use it only to provide reports to that customer, on their instructions. If you visited one of their sites and have a question or request, contact that business first; we will help them answer it. Customers can ask us for a data processing agreement.
The tracking code records pages viewed, referrers, device and browser, approximate location derived from the IP address, on-page behaviour such as scrolling and clicks, and any contact details a visitor chooses to submit in a form. IP addresses are hashed and never stored in raw form, and the hash changes every day, so it cannot follow anyone across days. We do not buy third-party data, combine it across customers, or try to identify visitors who have not identified themselves.
If a customer runs a store with us, we also store the buyer's name, email and shipping address for each order so the customer can fulfil it.
8. Cookies and similar storage
- On thesuitesite.com: one login cookie that keeps you signed in, and your light or dark theme choice saved in your browser. Both are strictly necessary or set by your own choice. We use no advertising, analytics or third-party tracking cookies on our own site.
- On our customers' websites: the tracking code uses the browser's local and session storage, not cookies, to recognise a returning visitor and group page views into visits. Each customer decides whether to ask its visitors for consent.
9. How long we keep it
- Account information: while your account is open, and 30 days after it closes.
- Analytics data: for the period your plan states (12 to 36 months), then deleted automatically.
- Media and posts: until you delete them, or 30 days after your account closes.
- Connected social accounts: until you disconnect them.
- Server logs: a short time, for security and troubleshooting.
- Invoices: our payment processor keeps invoice records for as long as tax law requires, even after the account is deleted.
10. Your rights and choices
Wherever you live, you can ask us to:
- See the personal information we hold about you, and get a copy in a portable format.
- Correct information that is wrong.
- Delete your information.
- Restrict or object to how we use it, or withdraw consent you have given.
Most of this you can do yourself: change details in the dashboard, export reports as CSV, and disconnect social accounts with one click. For anything else, email [email protected] from your account's address. We will verify the request comes from you, may accept requests from an agent you have authorised, and will respond within 30 days, or sooner where the law requires. We will not treat you differently for exercising these rights.
A copy of your website, then deletion. You can email support and ask for a zipped file of your website's code and files. Once you have it, or if you skip it, ask us to delete your account and we will delete all of your data from our systems within 30 days and keep no copy. Copies in our backups are overwritten as those backups are replaced. The only exception is invoice records, which our payment processor must keep for tax law (section 9).
Emails. Account emails such as receipts and payment reminders are part of the service. If we ever send product news, every email will include a way to unsubscribe.
Complaints. If you are in the EU or UK and unhappy with our answer, you can complain to your local data protection authority.
11. US state privacy rights
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas and other states with privacy laws have the rights in section 10. In the past 12 months we have collected these categories of personal information, for the purposes in section 4: identifiers (name, email, account ids), commercial information (plan and invoices), internet activity (logs and, for our customers, their visitors' activity), approximate location, and the content you upload. We disclose them only to the providers in section 5, and we do not sell or share them. We do not use sensitive personal information for anything beyond providing the service.
12. Security
Passwords are hashed, access tokens and API keys are encrypted, and connections to the service are encrypted in transit. Access to our systems is limited to the people who run the service. No system is perfectly secure, but if a breach affects your data we will tell you within 72 hours of becoming aware of it.
13. Children
The Suite Site is a service for businesses and is not meant for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
14. Changes to this policy
If we change this policy in a way that matters, we will email account owners before it takes effect and update the date at the top of this page.
15. Contact
[email protected], or by post to Abivens Tech, 900 N Allen Ave, Richmond, Virginia 23330.