1. What we collect
- Account data: email address, password hash (if you set a password), plan, activation date and expiry date. Passwords are stored only as a salted scrypt hash and cannot be recovered in plain text.
- Content you create: site names, page files, uploaded templates, AI chat messages and generated output.
- Media-library assets: images, videos and PDF files you upload to the platform media library, plus metadata such as file name, size, type, site, category (folder) and upload time.
- Third-party credentials you provide: Cloudflare Account ID and API Token, plus your AI provider's API key, base URL and model name.
- Payment data: order number, plan, amount, payment status and the identifier returned by Alipay. We never see or store your payment password.
- Technical data: session state, access times, request paths and necessary error logs used to keep you signed in and diagnose failures.
2. How we use it
We do not sell personal information and we do not use your site content to train our own models.
- Create and maintain your account and check whether your membership is active.
- Call the Cloudflare API to create Pages projects, upload files, connect domains and read status.
- Call the AI provider you configure to generate or edit page content.
- Create orders, confirm payment and activate membership automatically.
- Store media-library assets and serve them through the platform proxy, and meter storage use and traffic consumption to check whether your quota is sufficient.
- Answer your questions, diagnose failures and prevent abuse or unauthorized access.
3. Where and how long we keep it
Accounts, orders, site files and settings are stored in the CloudSite server data directory. Each account has its own directory, so site files, settings and job history are isolated.
Files in the media library are stored in the private Alibaba Cloud OSS bucket configured for the platform. Metadata such as file name, size, type, site, category and upload time is stored on CloudSite servers.
Data is kept while the account exists. You can ask us to delete your account and related data using the contact details below. Order records that we are legally required to keep remain for the necessary period.
4. Media library and asset data
The media library holds images, videos and PDF files used on your websites. Files are organized by site and an optional category (folder), and asset URLs can be embedded in your site pages.
Public asset URLs do not require sign-in and use random identifiers, but they may still be indexed by search engines or cached by browsers and CDNs. Do not upload confidential files such as identity documents, contracts or keys.
We keep asset access logs and record storage use and traffic consumption to show usage, enforce quotas and investigate unusual access. If storage or traffic is exhausted, new uploads and asset serving pause until you buy more quota or delete files.
- You can delete any asset from the media library; the corresponding OSS object and platform metadata are then removed.
- When you delete or terminate your account, we remove asset metadata and stored objects, though backup copies and records we must keep by law may remain for the necessary period.
- To bulk-delete assets, report unusual access or ask about usage, contact us at the email below.
5. Who we share it with
These providers have their own privacy policies and process data under their own terms. We share only what is required for the relevant feature.
- Cloudflare: to deploy sites, create Pages projects and connect domains. Your site files are uploaded to your own Cloudflare account.
- Alibaba Cloud OSS: to store files you upload to the media library. Files sit in the platform's private bucket and are served publicly through the platform proxy.
- Alipay: to create orders, complete payment and receive payment results.
- The AI provider you configure: prompts and existing content needed to generate or edit pages.
6. Cookies and local storage
CloudSite uses a single session cookie (cloudsite_session), set with HttpOnly and SameSite=Lax, and Secure when served over HTTPS. It keeps you signed in for up to seven days by default.
We do not use advertising cookies and we do not load third-party ad or behavioral analytics scripts. Small local-storage values are used only for temporary interface state such as language or preview settings.
7. How we protect data
Production traffic is served over HTTPS, the data directory is readable only by the service process, and third-party API keys and tokens are shown in the interface only as a configured/not-configured state. The media library uses a private OSS bucket, and storage credentials are kept only on the server.
No internet service can promise absolute security. Keep your password, Cloudflare API token and AI API key private.
8. Your rights
Contact us at the email below to exercise these rights. We may need to verify your identity first to protect the account.
- Ask what account and order information we hold.
- Correct inaccurate account information.
- Request deletion of your account and related site data.
- Delete assets from your media library, or request deletion of all assets under your account.
- Ask about storage and traffic usage, or raise a quota or billing question.
- Withdraw authorization for Cloudflare or your AI provider and stop using those features.
9. Children
CloudSite is intended for businesses and individual operators, not for children. Users under 14 should use the service with the consent and guidance of a guardian.
10. Changes to this policy
We may update this policy as features or legal requirements change. For material changes we will post a clear notice on the site or email the address on your account. The updated version takes effect on the date shown on the page.
11. Contact
For questions about this policy or the handling of personal data, email us at the address below. We will respond within a reasonable period.