Privacy notice
Last updated 14 October 2026
This is an interim notice. It describes what Sulucent does with personal information today, in plain English, while our full privacy policy is prepared and reviewed by a lawyer. When the full policy is ready it will replace this page.
Sulucent builds, hosts and looks after websites for small businesses. This notice explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.
Who we are
Sulucent is run by Vertrus LLC (“we”, “us”).
For anything about your personal information, email legal@sulucent.com. For anything else, hello@sulucent.com reaches the same small team.
Our two roles
For people who visit sulucent.com, take our assessment, sign up or write to us, we decide what happens to your information, and this notice covers it in full.
For people who visit our customers’ websites, the business that owns the site decides what its forms collect and what happens to it. We store and handle that information on the business’s behalf, and only to run its website. That business’s own privacy notice is the one that applies to you; this notice explains how we handle the information for them.
What we collect, and why
The free website assessment. Your name and email address, your answers to the questions, your website address if you give it, and which link brought you to us. Our host also tells us your approximate city and country, worked out from your IP address; we keep the city and country, not the IP address. If you give us a website address we measure how fast it loads with Google’s PageSpeed Insights. We use all of this to show you your score, email it to you, and follow up about your website.
Starting a new site from scratch. If you ask us to email you the style you chose, we take your email address. If you send an enquiry, we take your name, email address, the kind of business you run and what you’re looking for. We use these to send what you asked for and to reply.
Signing up and building your site. Your email address, and your name and profile picture if you sign in with Google. The business details you type in or that we read from your existing website: your business name, what you do, who your customers are, your contact details, and the text and images on your pages. What you say in the onboarding chat, and the files and photos you upload. We use these to build your site. If you start but don’t finish, we may send you up to three reminder emails.
Bespoke enquiries. Your name, email address, business name, website address and message, so that we can reply.
Running your site. The changes you ask for, the posts you write and the content our AI tools draft for you.
Your site’s visitors. When someone fills in a form on your website, we store what they submitted so you can see and export it, and we send the campaign emails you choose to send them. We hold this for you, as described under “Our two roles”.
The Site Minion demo. What you type into the demo on our Site Minion page is sent to Anthropic to generate a reply. We don’t keep it in our database. If the model declines to answer, or its reply mentions a price the demo site doesn’t list, the last few messages of the conversation go into an error report to Sentry so that we can see what happened. Email addresses are removed from that report but other details are not, so please don’t type personal details into the demo.
Writing to us. The emails you send us, and our replies.
Keeping things running. Error reports, with email addresses, form answers and credentials removed before they are sent, and the logs our host keeps of requests. To stop abuse of our forms we store a coded form of your IP address rather than the address as written.
Marketing emails
We send occasional advice emails only if you ticked the box asking for them. We record the exact wording you agreed to and when. Every one of those emails has an unsubscribe link, and you can also email us to stop them.
How we use AI
AI models read your existing website, run the onboarding chat, check page text during a migration, draft content and generate images. The providers are listed below. Anthropic’s terms and TypeSafe’s terms both say they won’t train their models on what we send them. Google’s image model receives what the image should show and the descriptions of your business and its customers that you gave us. We don’t add your business name, but those descriptions are sent as written.
AI does the drafting, but you make the decisions. Nothing goes live on your website until you’ve approved it, and we don’t make decisions about you that have legal or similarly significant effects by automated means alone.
Where your information is stored
Almost everything is stored and processed in the United States: our database is in Oregon, our build server is in San Francisco, and our other providers are US-based. If you are in Australia, this means your information is disclosed to recipients in the United States. We apply the Australian Privacy Principles voluntarily, including to that overseas disclosure. We use each provider under its commercial terms, and we are still confirming the data-protection commitments in each provider’s terms.
How long we keep it
This is how long we keep each kind of information:
- Assessment answers and enquiries are kept until you ask us to delete them.
- Your account and your site’s content are kept while you are a customer. After you leave, we delete them when you ask, apart from anything the law requires us to keep, such as billing records.
- Information collected on a customer’s website is kept until that business deletes it or asks us to.
- The setup cookie expires after 7 days, and a website speed measurement is reused for 7 days before it is taken again.
- The coded IP address records we use to stop abuse of our forms and free tools are deleted automatically by a daily job: those that count recent attempts once they are 2 or 7 days old, and those that record use of our AI, website-reading and email features once they are 30 days old.
Our service providers keep their own logs for limited periods under their terms.
Keeping it secure
Everything travels over encrypted connections. Our database only lets each account read its own data, and only our small team can see customer records. We don’t take payments yet. When we do, a payment provider will handle your card details, and we will update this notice before that starts.
Your rights
Wherever you live, you can ask us to tell you what we hold about you and give you a copy, to correct it, to delete it, or to stop using it for marketing. Email legal@sulucent.com. We’ll reply within 30 days, and we may need to confirm it’s you first.
If you’re a visitor to one of our customers’ websites, contact that business first. We’ll help them answer you.
Complaints
If you’re unhappy with how we’ve handled your information, email legal@sulucent.com and we’ll look into it and reply within 30 days. If you’re still unhappy, you can complain to your privacy regulator: in Australia, the Office of the Australian Information Commissioner; in the UK, the Information Commissioner’s Office; in the EU, your national data protection authority.
Children
Sulucent is a service for businesses. It isn’t meant for children, and we don’t knowingly collect information about them.
Changes to this notice
When what we do with personal information changes, we update this page first, and the date at the top changes with it. If a change affects customers materially, we’ll also tell them by email.