Sitekick AI

GDPR overview

The privacy policy carries a dedicated section headed The rights of Users based on the General Data Protection Regulation (GDPR), and it is specific: withdrawal of consent, objection, access, verification and rectification, restriction, erasure, portability, and the right to complain to a supervisory authority. Requests go to the owner's contact address and are answered within one month; objection to direct marketing is unconditional and free of charge. Lawful bases are enumerated — consent, performance of a contract, legal obligation, public interest, legitimate interest — and the terms point European consumers to the European Commission's online dispute resolution platform. What is missing is equally concrete: no Article 27 representative is designated, no data protection officer is named, no DPA is offered, and no transfer safeguard is named even though the publisher operates from the United States. Last updated 26 March 2026.

Who owns the data?

Sitekick AI advertises on every plan that you own 100% of your site assets and can export them at any time. The terms are narrower than that slogan suggests. Everything Sitekick itself supplies — platform content, templates, trademarks and logos — remains the exclusive property of the Owner or its licensors. Content you upload stays yours, but you grant Sitekick a non-exclusive, fully paid-up, royalty-free licence to process it, limited to operating and maintaining the platform, and you waive your moral rights as far as the law permits. You alone are liable for what you publish: the terms state that the Owner neither filters nor moderates user content.

Reuse rights

On the commercial side the position is generous and stated on every pricing card: you own 100% of your site assets and can export them at any time, so the pages, copy and generated images you produce are yours to reuse without asking permission. The restrictions sit elsewhere. The terms forbid copying, downloading, modifying, translating, publishing, transmitting, selling or sublicensing the content Sitekick itself supplies through the platform, and they separately forbid reproducing, reselling or otherwise exploiting any part of the Service without prior written permission or a legitimate reseller programme. One silence is worth noting: neither the terms nor the privacy policy says anything about whether customer content may be used to train AI models.

Data retention & training

Hosting summary

The publisher does not say where the websites it generates for customers are hosted, nor where account data is stored. What the privacy policy does give is a place of processing for each named third party. Webflow, Inc., which builds, runs and hosts the public application, processes in the United States, as do Cloudflare, Inc. for traffic filtering and distribution, Meta Platforms, Inc. and Google LLC for analytics and advertising, and RB2B / Retention.com for visitor identification. The one exception is Crisp IM SARL, which powers the support chat and processes in France. Beyond that the policy is generic: data is processed at the owner's operating offices and wherever the parties involved are located, and transfers may move a user's data to a country other than their own. No European hosting region is offered, and no security certification such as SOC 2 or ISO 27001 is published anywhere on the site.