Privacy policy

1. Who we are

Website Rebuild is provided by Sunny Coast Websites, a subsidiary of Apheta Data Solutions (collectively referred to as “Website Rebuild”, “we”, “us” or “our”). This policy applies to websiterebuild.com.au, app.websiterebuild.com.au, generated website previews and the related website administration services.

Our privacy contact is steve@apheta.com.au.

2. Information we collect

Depending on the features you use, we may collect and hold:

• Account information: your name, verified email address, sign-in provider, account identifiers, website permissions and security or audit history.
• Website project information: business name, current website URL, logo, brand notes, inspiration URLs, prompts, instructions, generated briefs, selected model preferences and approval history.
• Content and files: website text, images and other material you upload or authorise us to collect from a website, together with generated previews and versions.
• Technical information: IP address, browser and device details, timestamps, request records, diagnostics and security events received when you use the service.
• Support and business information: messages, feedback, service arrangements and information needed to answer a request, provide support or administer paid hosting and support.

We generally collect information directly from you, from a website you identify and confirm you are authorised to use, from an identity provider you choose, or automatically through the secure operation of the service.

3. Google user data

Google sign-in

If you choose “Continue with Google”, we receive basic OpenID Connect profile information: your Google account identifier, name, email address and whether Google has verified that email. We use this only to authenticate you and match your verified email to websites you own or have been invited to manage.

Optional Google business connections

Signing in with Google does not give Website Rebuild access to Analytics, Search Console or Business Profile. Those services use a separate consent process that you start from the SEO assistant. The application may request:

• Google Analytics read-only access to list the properties available to you and, after you select one, check limited reporting evidence such as recent lead or form-submission event counts.
• Google Search Console read-only access to list verified sites and, after you select one, check property access and sitemap status.
• Google Business Profile access to list the Business Profile accounts available to you and confirm access to the account you select. Although Google’s scope can support management features, Website Rebuild currently uses it only for the read and verification functions described here.

Google refresh tokens are encrypted with a dedicated encryption key and stored server-side in our AWS environment. Access tokens are used transiently to make the request you initiated. We store the selected non-secret property identifier, resource name, last-check time and limited verification result against the relevant website. OAuth tokens are never returned to the website browser or copied into the Sunny Coast Websites CRM.

No Google or paid SEO check runs merely because you open the page. Property lists are read only when you press Refresh available properties, and selected data is checked only when you press Check connected data now.

We do not sell Google user data, use it for advertising, share it with data brokers, use it to determine creditworthiness, or use it to train general-purpose artificial-intelligence models. We do not access Gmail, Google Drive, Google Contacts, Google Calendar or Google Ads through this service.

Google user data is not transferred except to infrastructure providers acting on our behalf where necessary to securely provide the user-facing feature, for security purposes, to comply with law, or as otherwise permitted by Google’s Limited Use requirements. Authorised website members may see the selected property name and verification result. Our personnel do not read raw Google user data unless you specifically ask for support and consent to that access, or access is necessary for security or legal compliance.

4. How we use information

We use information where reasonably necessary to:

• create and secure your account and determine which websites you may access;
• analyse an authorised existing website and prepare a modernised website preview;
• process your instructions, uploads and approved AI-assisted website or image changes;
• provide SEO guidance and the optional Google checks you manually request;
• maintain versions, deploy approved changes, recover from errors and provide support;
• monitor reliability, prevent misuse, investigate security events and keep audit records;
• administer hosting, support, billing and our legal obligations; and
• improve the service using feedback and de-identified operational information.

Website content, prompts and uploaded images may be processed by approved AI service providers when you request an AI-assisted rebuild or change. Google user data obtained through the optional business connections is not included in those AI prompts.

5. Service providers, disclosure and overseas processing

We disclose information only where it is reasonably required to provide and secure the service, with your direction or consent, or where required by law. Providers may include:

• Amazon Web Services for identity, encrypted storage, hosting, deployment, monitoring and backups;
• Google and Microsoft when you choose their identity or business-data services;
• GitHub and deployment infrastructure used to version and publish website code;
• AI service providers used to process a rebuild or change you request; and
• SEO data providers when you manually request a ranking check, using the approved keywords, public domain, location and device settings needed for that check—not connected Google user data; and
• specialist support, security and professional advisers subject to appropriate confidentiality obligations.

Our core control data is hosted in the AWS Sydney region where practicable. Some providers may process information in the United States or other countries in which they operate. We take reasonable steps to use reputable providers, limit the information supplied and protect it through contractual and technical controls.

We do not sell or rent personal information. We may disclose information where necessary to protect users or the service, investigate fraud or abuse, comply with a lawful request, or as part of a business transfer subject to applicable privacy obligations.

6. Security

We use measures appropriate to the nature of the information, including encrypted connections, access controls based on verified identity and website membership, server-side secret management, dedicated encryption for Google refresh tokens, protected data stores, audit logging and recoverable deployment history. No internet service can guarantee absolute security, so please contact us promptly if you believe your account or information has been compromised.

The application uses browser storage to maintain your signed-in session and remember limited interface preferences. The public marketing website does not use Google business data for tracking or advertising.

7. Retention and deletion

We retain account, project and website information for as long as needed to provide the service, maintain approved website history, meet security and record-keeping requirements, and resolve disputes. Diagnostic and audit information is retained only for a period reasonably required for those purposes.

Google refresh tokens are retained only while the connection remains active. When you disconnect a Google account through Website Rebuild, we attempt to revoke the token and remove its encrypted token, website-property links and saved verification evidence from active systems. Follow our Google connection and data-removal instructions, or revoke Website Rebuild directly from your Google Account connections. Residual encrypted copies may remain temporarily in protected backups until normal backup rotation, where they are isolated from ordinary use.

You may ask us to close your account or delete project information by emailing our privacy contact. We will delete or de-identify information unless we reasonably need to retain it for security, legal, billing, dispute-resolution or backup-integrity purposes. Deleting an account may make its previews, history and administration features unavailable.

8. Your choices and rights

You can choose passwordless email sign-in instead of Google, decline optional Google business access, disconnect a connected Google account, and decide whether to approve or publish a generated website change.

You may ask to access the personal information we hold about you, correct inaccurate information, withdraw an optional consent or request deletion. Contact steve@apheta.com.au from the email address associated with your account. We may need to verify your identity before acting and may retain information where permitted or required by law.

9. Children

Website Rebuild is a business service and is not directed to children. You must be at least 18 years old or otherwise legally authorised to enter into the relevant service arrangement.

10. Contact, complaints and policy changes

Send privacy questions, access or deletion requests, and complaints to steve@apheta.com.au. Please explain the issue and include the email address associated with your account. We will acknowledge and investigate a complaint within a reasonable time.

If you are not satisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner.

We may update this policy as the service or legal requirements change. We will publish the updated date here and provide additional notice or seek renewed consent where a material change affects how Google user data or personal information is used.