We collect information to create, manage, improve and securely publish your website. Connecting Google is optional and separate from signing in. Google business data is read only when you ask us to refresh or check it. We do not sell personal information or Google user data. Google user data is not used for advertising or sent to generative-AI models. Our own limited page and service measurement is described below; we do not send new individual visitor events to advertising platforms.
1. Who we are
Website Rebuild is provided by Apheta Data Solutions (referred to as “Website Rebuild”, “we”, “us” or “our”). This policy applies to websiterebuild.com.au, websiterebuild.ai, app.websiterebuild.com.au, generated website previews and the related website administration services.
Our privacy contact is steve@apheta.com.au.
2. Information we collect
Depending on the features you use, we may collect and hold:
- Account information: your name, verified email address, sign-in provider, account identifiers, website permissions and security or audit history.
- Website project information: business name, current website URL, logo, brand notes, inspiration URLs, prompts, instructions, generated briefs and approval history.
- Content and files: website text, images and other material you upload or authorise us to collect from a website, together with generated previews and versions.
- Technical information: IP address, browser and device details, timestamps, request records, diagnostics and security events received when you use the service.
- Website and campaign measurement: bounded campaign labels, landing-page variant, experiment, coarse device/browser categories, classified referral source, page activity and server-confirmed request, sign-in, preview, enquiry and first-paid-invoice milestones. New Google Analytics and advertising pixels are not loaded. We do not collect new advertising click references for matching visitors with Google, Meta or OpenAI.
- Support and business information: messages, feedback, service arrangements and information needed to answer a request, provide support or administer paid hosting and support.
You may start a free rebuild before creating an account. In that case, the service stores a random browser session token locally on your device and keeps a one-way token hash with the project so only that browser can follow and claim the unclaimed rebuild. The generated preview remains locked until a verified account claims it. We also use pseudonymous, time-limited device and network counters and Google reCAPTCHA Enterprise risk signals to prevent automated abuse. reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.
We generally collect information directly from you, from a website you identify and confirm you are authorised to use, from an identity provider you choose, or automatically through the secure operation of the service.
Apheta staff can manually import aggregated Google Ads, Meta and ChatGPT advertising statistics alongside our internal demand funnel and historical Analytics reports. Reports do not refresh in the background. This reporting does not send project content, prompts, customer contact details or uploaded files to advertising platforms.
First-party measurement and your choice
We use our own AWS-hosted measurement to understand whether the service is useful and where the journey needs improvement. On recognised marketing pages we record page views, button/form starts, comparison-demo interactions, scroll milestones, bounded active time and coarse page-load performance. We do not record keystrokes, form text, session replays or screen recordings. Complete URLs, referrer query strings, email addresses, phone numbers, source-website content, briefs and uploaded files are excluded from the measurement store.
A random page identifier lives only in that loaded page, not in a tracking cookie or browser storage. If you submit a rebuild request, we can link that page privately to its service milestones. Those linked records are pseudonymous, not guaranteed anonymous. Aggregate staff reports do not expose page or project identifiers. Reloads count as new page instances, not new people; blocked collection and missing links are disclosed in reports.
Optional browser measurement is enabled without a popup, but respects previous rejection choices and recognised Global Privacy Control or Do Not Track signals. The control below stores only an opt-out preference, not a tracking identifier. Our Australian public site and application share that preference; the international .ai domain has a separate preference. Security logs and anti-abuse counters remain separate and may include network information, as described above.
Your browser measurement setting will appear here when JavaScript is available. You may also contact our privacy email.
Turning page measurement off does not prevent website checks, sign-in, previews or enquiries. Essential service records still count accepted requests and later outcomes. No new individual conversion events are sent to Google, Meta or OpenAI. Earlier consented matching references expire normally; we do not replay them. Contact our privacy email to remove an earlier reference, or sign in to the application and use its saved-reference withdrawal control. Withdrawal cannot recall events previously transmitted.
3. Google user data
Google sign-in
If you choose “Continue with Google”, we receive basic OpenID Connect profile information: your Google account identifier, name, email address and whether Google has verified that email. We use this only to authenticate you and match your verified email to websites you own or have been invited to manage.
Optional Google business connections
Signing in with Google does not give Website Rebuild access to Analytics, Search Console or Business Profile. Those services use a separate consent process that you start from the SEO assistant. The application may request:
- Google Analytics configuration access to list the properties available to you, check limited reporting evidence such as recent lead or form-submission event counts and, only when you explicitly request it, create or configure the selected website's GA4 property and web data stream.
- Google Search Console access to list verified sites and, after you select one, check property access and sitemap status. Ordinary reports remain read-only. If a property is missing, you may separately authorise a one-time setup permission that creates the registered production Domain property.
- Google Site Verification access, requested only with that one-time Search Console setup, to generate and confirm a dedicated ownership token for the production domain. Website Rebuild adds that token as a TXT value only when the exact domain is hosted in the configured AWS Route 53 account; existing TXT values, including email records, are preserved.
- Google Business Profile access to list the Business Profile accounts available to you and confirm access to the account you select. Although Google’s scope can support management features, Website Rebuild currently uses it only for the read and verification functions described here.
Google refresh tokens are encrypted with a dedicated encryption key and stored server-side in our AWS environment. Access tokens are used transiently to make a permitted request. We store the selected non-secret property identifier, resource name, connected-account identity, last-check time, limited verification result and a bounded replacement history against the relevant website. OAuth tokens are never returned to the website browser or exposed outside the Website Rebuild service.
No Google or paid SEO check runs merely because you open the page. Property lists are read only when the person who connected an account presses Refresh available properties. Search Console creation and DNS verification run only after the connected user separately grants the setup scopes and confirms the action. Once a property has been deliberately saved as a website’s canonical connection, any authorised administrator of that same website may press Check connected data now to run the bounded read-only verification for that selected property. They cannot use this to browse other properties, view the token or disconnect the connector’s account. Replacing the canonical account requires an explicit comparison and confirmation. No Analytics configuration is changed unless the connected user explicitly requests that setup.
The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell Google user data, use it for advertising, share it with data brokers, use it to determine creditworthiness, or use it to train general-purpose artificial-intelligence models. We do not access Gmail, Google Drive, Google Contacts, Google Calendar or Google Ads through this service.
Google user data is not transferred except to infrastructure providers acting on our behalf where necessary to securely provide the user-facing feature, for security purposes, to comply with law, or as otherwise permitted by Google’s Limited Use requirements. Authorised website members may see the selected property name, connected-account identity and bounded verification result, and may manually rerun that same read-only check. Our personnel do not read raw Google user data unless you specifically ask for support and consent to that access, the personnel member is already an authorised administrator of the relevant website and initiates the disclosed bounded check, or access is necessary for security or legal compliance.
4. How we use information
We use information where reasonably necessary to:
- create and secure your account and determine which websites you may access;
- analyse an authorised existing website and prepare a modernised website preview;
- process your instructions, uploads and approved AI-assisted website or image changes;
- provide SEO guidance and the optional Google checks you manually request;
- maintain versions, deploy approved changes, recover from errors and provide support;
- monitor reliability, prevent misuse, investigate security events and keep audit records;
- administer hosting, support, billing and our legal obligations; and
- improve the service using feedback and de-identified operational information.
When you use the signed-in AI support guide, OpenAI processes your question, a bounded recent conversation, reviewed help instructions and the relevant website launch status. We do not include Google business-connection data, your account email, payment identifiers or support attachments in that context. Text you type can contain personal information, so avoid passwords, sign-in codes and unnecessary sensitive details. The AI explains the available steps; you remain responsible for approving any website or domain change.
When you submit a support request, we send your verified email, website context, problem, optional phone, attachments and any conversation you choose to include to Steve through our email service. Replies continue by ordinary email. Support messages and files are not sent to advertising services.
Website content, prompts and uploaded images may be processed by approved AI service providers when you request an AI-assisted rebuild or change. Google user data obtained through the optional business connections is not included in those AI prompts.
6. Security
We use measures appropriate to the nature of the information, including encrypted connections, access controls based on verified identity and website membership, server-side secret management, dedicated encryption for Google refresh tokens, protected data stores, audit logging and recoverable deployment history. No internet service can guarantee absolute security, so please contact us promptly if you believe your account or information has been compromised.
The application uses browser storage to maintain your signed-in session and remember limited interface preferences. The public marketing website does not use Google business data for tracking or advertising.
7. Retention and deletion
We retain account, project and website information for as long as needed to provide the service, maintain approved website history, meet security and record-keeping requirements, and resolve disputes. Diagnostic and audit information is retained only for a period reasonably required for those purposes.
An anonymous rebuild can be claimed while it is being created or for five days after it reaches a completed or stopped state. If it remains unclaimed, its managed preview, private repository and uploads are automatically queued for removal. A short-lived encrypted recovery bundle may be retained for operational recovery before it expires through normal backup rotation.
AI support conversations expire from active application storage after 30 days. Submitted request records and aggregate AI usage records expire after 90 days. Staged support files expire after seven days and are included as attachments in the support email. Email copies follow our ordinary business-mail retention, and protected backups may remain until their normal rotation.
Private acquisition and page-measurement records expire after 90 days, including earlier consented matching references. The opt-out preference lasts up to six months. Internal operational milestones still count when optional page measurement is off. Linked page-to-request measurement and advertising campaign labels have limited coverage and do not identify unique people across devices.
Google refresh tokens are retained only while the connection remains active. When you disconnect a Google account through Website Rebuild, we attempt to revoke the token and remove its encrypted token, website-property links and saved verification evidence from active systems. Follow our Google connection and data-removal instructions, or revoke Website Rebuild directly from your Google Account connections. Residual encrypted copies may remain temporarily in protected backups until normal backup rotation, where they are isolated from ordinary use.
You may ask us to close your account or delete project information by emailing our privacy contact. We will delete or de-identify information unless we reasonably need to retain it for security, legal, billing, dispute-resolution or backup-integrity purposes. Deleting an account may make its previews, history and administration features unavailable.
8. Your choices and rights
You can choose passwordless email sign-in instead of Google, decline optional Google business access, disconnect a connected Google account, and decide whether to approve or publish a generated website change.
You may ask to access the personal information we hold about you, correct inaccurate information, withdraw an optional consent or request deletion. Contact steve@apheta.com.au from the email address associated with your account. We may need to verify your identity before acting and may retain information where permitted or required by law.
9. Children
Website Rebuild is a business service and is not directed to children. You must be at least 18 years old or otherwise legally authorised to enter into the relevant service arrangement.
10. Contact, complaints and policy changes
Send privacy questions, access or deletion requests, and complaints to steve@apheta.com.au. Please explain the issue and include the email address associated with your account. We will acknowledge and investigate a complaint within a reasonable time.
If you are not satisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner.
We may update this policy as the service or legal requirements change. We will publish the updated date here and provide additional notice or seek renewed consent where a material change affects how Google user data or personal information is used.