Privacy Policy

1. Who we are

Borg Sites is a website-building platform and a visual-design studio, and a TSYBORG company. You can open an account and build, customize, publish and run your own website yourself, and you can also ask us to design, build, host and handle it for you. When this policy says "we", "us" or "Borg Sites", that is who we mean, and this policy covers borgsites.com, the Borg Sites account, builder, editor and Studio, and the sites and services we run for our clients. If you have never signed up for anything and we wrote to your business, section 10 is the part written for you.

2. What we collect

We collect only what we need to help you:

• Information you give us. When you use our quote, contact or estimate forms, we collect the details you choose to share, typically your name, email, phone number, business or brand name, and a description of your project. If you email us, we keep that message.
• Payment information. When you buy a plan, a build or an add-on, your payment is handled by our payment provider on their own secure page. Your card details go straight to them. We do not see or store your full card number.
• Usage information. Our hosting provider records basic technical data such as your IP address, browser type and the pages you view, to keep the site fast, secure and protected from abuse.
• Cookies. We use only strictly functional cookies and browser storage, for example to remember a saved estimate, a design you were working on in Borg Studio, or the items in your cart. We do not use advertising or cross-site tracking cookies.

If you open a Borg Sites account, that account holds more than this. Sections 3 to 8 say exactly what it holds, and why.

3. Your account and signing in

Creating a Borg Sites account stores your email address, a one-way scrambled version of your password, the date you signed up and the plan you are on. We never store the password itself and we cannot read it: it is put through 100,000 rounds of PBKDF2-SHA256 with its own random salt, and only the result of that is kept. If you answer the one-tap "how did you find us" question in your dashboard, we store that answer too. It is optional, and the first answer is the only one we keep.

Signing in sets one cookie, named borg_sess. It is signed by us so it cannot be altered, it is HttpOnly so no script on the page can read it, it is Secure so it travels only over HTTPS, it is SameSite=Lax, and it lasts 30 days. It carries your account number, its own expiry and a password version number, and nothing else: no name and no email address. Signing out clears it.

If you forget your password, we email you a single-use link that works for 30 minutes. Asking for one always gives the same answer whether or not that address has an account, so the form can never be used to find out who has an account here. Resetting or changing your password signs every other device out and leaves the device you changed it on signed in, and when it is changed we email the address on the account to say it happened, so an account can never change hands in silence.

4. The AI builder and what it generates

When you use the AI builder, your message, the last few turns of that conversation and the draft it is working on are sent through our AI gateway (named in section 11) to the model that writes the next version. Your email address, your account details and your payment details are not sent with them.

We store the draft itself in your account: its title, the document and the rolling conversation, so you can come back to it. A draft is not a web page: nothing in the builder publishes anything, and nobody but you and us can see it. We also store a count of the builder credits you have used this month, because that count is how your plan's allowance is measured. It is a number, not a second copy of what you asked for.

When you have a picture generated, the words you type are sent to our hosting provider's own AI service. We do not store those words. The picture is stored in your media library exactly like a picture you uploaded, and it counts against your plan's monthly allowance.

What these tools make for you is your content. A generated draft, a generated picture and a page you wrote yourself are all treated the same way, under the section below.

5. Your content, your images and your published site

What you write, the colours, fonts and settings you pick, the pictures you use and the template you started from are stored as your site's configuration in our database, against your account. Pictures you upload, and pictures generated for you, are stored as files under a key that belongs to your account. The same bytes are written to a second, backup store in the same moment, so a copy exists from the first second.

A published site is a public web page. It is served at borgsites.com/s/yourname, or at your own domain, to anyone who has the address, search engines included, and it is live from the moment you create it: there is no separate publishing step holding it back. Please treat everything you put on a site as public, because it is.

Every save is kept as a version, so you can go back. How long we keep them depends on the plan the site is on: 14 days on the free Launch plan, 90 days on Spark and Orbit, and a year on Galaxy and every plan above it. Your five newest saves are always kept whatever the plan and whatever their age, and one site never keeps more than 500 versions.

Deleting a site from your dashboard deletes the site and its whole version history. Deleting a picture from the editor deletes our record of it and the copy we serve; a picture still in use on one of your pages is left alone until you swap it out. The backup copy of a picture is kept on purpose, because a backup that forgets everything you delete cannot undo a mistake. Ask us and we will remove that too.

A design saved from Borg Studio without an account is different. It holds the template you picked and your colour and font choices, nothing about you, it is reached only through the link we hand you, and it is deleted after 30 days.

If you use the domain checker, the name you type is sent to that ending's own registry to ask whether it is taken. We do not store the name or the answer. If you set up mail forwarding on your own domain, the address on your domain and the inbox you forward it to are held by the provider that runs your domain's mail routing, not in our database.

6. Using the dashboard and the editor, and asking us for help

Working in the dashboard and the editor leaves the ordinary marks any editor leaves: when each site was last saved, and which tool made each saved version, the editor, Borg Studio, the AI builder or a restore. We do not record your screen, follow your mouse, or build a profile of how you work.

When you send us a request from your dashboard, we store it as a support ticket: its type, its subject, your message, which site it is about if you said, its status and its dates. We email it to our team at info@borgsites.com with your address as the reply address, so a real person can answer you straight from their own inbox. Support conversations happen by email, not inside the app.

We also email you about your own account: a link to confirm your email address when you sign up, a reset link when you ask for one, a note to the account's own address when its password is changed, a confirmation when a purchase goes through, a note when a plan is cancelled, and a note if a plan ends because a payment did not clear. Those emails come back to support@borgsites.com or info@borgsites.com when you reply to them.

To stop a script hammering our forms, we count recent requests against the network address they came from. Those counters are short lived, and the rows are deleted once their window has passed.

7. Payments and paid plans

We never see or store your card number. Paying happens on our payment provider's own secure checkout page. Your card details go to them and never reach us.

What we keep is the money record, and only what a money record needs: the provider's own reference for the payment, what was bought, the amount, the currency, whether it went through, the email address on the order, and the date. That is what lets us tell you what you paid for and when, and honor the 5-day money back on hosting.

We record a cancellation the same way: which subscription ended, whether money went back or the plan ran to the end of the period you had already paid for, how much, who asked for it, and when. If we ever put money back, or a credit on an account, without ending anything, we record that too, with the reason. These are financial records, so we keep them for as long as our legal, tax and accounting obligations require, even after an account is closed.

8. How we count page views

We count visits to our own pages with our own counter, not a third party's. Each page load sends three things: the path you are on, the host that linked you, never the full address and never the query, and whether the screen is phone, tablet or desktop sized.

It sets no cookie and it stores nothing that identifies you. To count one person once a day, the server makes a one-way token out of the date, a blurred version of the network address with its last part dropped, and the browser string. Neither the address nor the browser string is ever written to a column, and the token cannot be turned back into either. Nothing this counter records is shared with anyone, and no third-party analytics service is involved in it.

Once a day is complete it is folded into a single row of totals and that day's individual rows are deleted. The counter skips the admin pages, our own API and the customer sites we host.

9. How we use your information

We use the information above to:

• respond to your inquiries and prepare your quote,
• run your account, your builder, your editor and your published site,
• provide, maintain and bill for the services you request,
• send you service messages about your project, account or site, and
• with your interest, send occasional marketing email about Borg Sites.

Every marketing email we send includes a one-click unsubscribe link, and we honor every opt-out promptly. We never sell your information, and we do not use it for automated decisions that produce legal effects for you.

10. If we emailed your business

Sometimes we write to a business that has no website yet and offer to show it one, free and with nothing to sign. If that is how you found this page, nothing above is about you, because you have never given us anything. Here is what we hold instead, and how to make it stop.

It is the business's own public listing, and only that: the business name, what it does, its street address and city, its public phone number and email address, a note of which public record we read them from and the checks we ran before writing, plus whether we have written, whether you answered, and whether you asked us to stop. It comes from public business directories, the official listings a business appears in when it is licensed or certified to trade. If you asked to see the preview, we also hold the picture of the site we made for you.

You get one message, and one follow-up thirty days later if you never answered. That is all of it: no sequence, no third message, and nothing that quietly starts again later.

Every message carries a one-press way out. There is an unsubscribe link at the bottom of it, pointing at tryborgsites.com, our own preview site, and the same instruction rides in the message's headers (List-Unsubscribe), so your mail app can draw its own Unsubscribe button and one press is enough. Replying "no", "stop" or "unsubscribe" works exactly as well, and nobody has to be at their desk for it to count.

Opting out is permanent. The address goes on our do-not-contact list, that list covers every list we have rather than the one message you got, and the only thing that ever takes an address off it again is that person writing to us and asking to hear from us. We never sell, rent or trade any of it, and you can have the whole record deleted whenever you like: email info@borgsites.com and it is gone.

11. Who we share it with

We share your information only with the trusted service providers who help us run Borg Sites, and only as far as they need it to do their job:

• Cloudflare, for hosting, security, content delivery, and the AI service that generates pictures.
• Stripe, for payment processing.
• Resend, for delivering our email.
• Zoho Mail, for hosting our incoming mail at borgsites.com addresses.
• Anthropic, for the model behind the AI builder, which receives what you type into it, the last few turns of that conversation and the draft it is working on, and nothing else about you.
• AI/ML API, the gateway that passes each AI builder request to that model: your message, the last few turns of that conversation and the current draft, and nothing else about you.

These providers are bound by their own privacy and security commitments. We do not sell, rent or trade your personal information to anyone, ever. We may disclose information only if the law requires it, or where it is genuinely needed to protect our rights, our clients or the public.

12. Keeping it, and deleting it

We keep your information for as long as we need it to answer your request, provide your services, and meet our legal, tax and accounting obligations. When we no longer need it, we delete it or make it anonymous. You can ask us to delete your details sooner, as described in "Your rights" below.

For an account, the rule is simple: we keep what the account holds for as long as the account is open, and then on request. Some of it you can remove yourself at any time, from inside the product. Deleting a site deletes the site and its version history. Deleting a picture deletes our record of it and the copy we serve. Saved versions age out on their own, on the schedule in section 5.

There is no delete-my-account button yet. Email support@borgsites.com from the address on the account and we will close it. We first stop the account from signing in anywhere, then remove what it holds: your email address and the scrambled password, your sites and their configurations and version history, your uploaded and generated pictures and their backup copies, your builder drafts and conversations, the monthly counts of your builder credits and AI photos, your support tickets, your own cancel requests, any plan granted to your address, your answer to "how did you find us", and anything you sent us through our quote, estimate or contact forms. Here is what stays behind, and we would rather say so than surprise you: the payment records described in section 7, which we have to keep; a one-line record that the account was deleted, which includes its email address; the page-view totals in section 8, which have never held anything that points at you; and, if you are one of our hosted clients, your entry on our client list, unlinked from the account. The short-lived counters we use to stop abuse expire on their own within two days.

13. How we protect it

Here is what we actually do, so you can hold us to it:

• Everything travels over HTTPS, and our pages are served with HSTS, so a browser will not fall back to an unencrypted connection.
• Passwords are stored only as a salted PBKDF2-SHA256 hash. There is nowhere in our systems that a password can be read.
• Session cookies are signed, HttpOnly, Secure and SameSite=Lax. Changing your password invalidates every session but the one that changed it, and resetting it invalidates them all.
• Every page ships with a strict Content Security Policy that allows scripts, styles, fonts, images and connections from borgsites.com itself and nowhere else. No third-party script runs on the site.
• Every read and every write inside an account is checked against the account behind your session, so one customer's request cannot reach another customer's site, pictures or tickets.
• Every picture you store is copied to a second store the moment it is saved, and a daily job checks the two against each other and copies anything the first pass missed.

No system on the internet is perfectly secure, and we will not pretend ours is. What we can tell you is exactly what we do, which is the list above.

14. Your rights

You can ask us at any time to:

• see the personal information we hold about you,
• get a copy of what your account holds, in a form you can keep,
• correct anything that is wrong or out of date,
• delete your information, or
• opt out of marketing email.

Just email info@borgsites.com and we will take care of it. For anything about an account, please write from the address on that account, so we know we are handing your information to you and not to somebody else. Depending on where you live, you may have additional rights under your local law, and we will always do our best to honor them.

15. Children

Borg Sites is a business service and is not directed at children. We do not knowingly collect personal information from anyone under 13, or under 16 where that is the local minimum age. If you believe a child has given us their information, email us and we will remove it.

16. Links to other sites

Our pages, and the sites we build for clients, may link to services we do not control. This policy covers only Borg Sites. When you follow a link to another site, please read that site's own privacy policy.

17. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date shown at the top of this page, and we will highlight significant changes here. Continuing to use Borg Sites after an update means you accept the revised policy.

18. Contact us

Questions about your privacy or this policy? We are happy to help. Email info@borgsites.com, or write to us at 1223 E 233rd St, Suite 1075, Bronx, NY 10466, USA.

Effective September 28, 2026.