Privacy
Privacy policy
SkyHive Pty Ltd operates BeyondSite. This policy describes the personal information the product collects today. It is written for the Australian Privacy Principles in the Privacy Act 1988 (Cth), and it is also meant to be readable if you visit from the UK or the EEA.
Who to contact
Email info@skyhive.com.au for access, correction, or deletion, or to complain. If you are in Australia and you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner. If you are in the UK, you can contact the ICO. If you are in the EEA, you can contact your local supervisory authority.
What we collect
We collect only what the product stores when you use it.
- The draft. The words you type to start a site, which may be a business name, a sentence, or a website address. We also store the site name, address slug, pages, menu, style, and the time an unclaimed draft expires. Unclaimed drafts are removed after the configured lifetime, which is seven days unless that setting is changed.
- An account. If you create one, we store your email address and, if you sign in with Google, your name and Google's account identifier. We do not store your Google password.
- A session cookie. After sign-in the browser stores a cookie named
beyondsite_session. It is HttpOnly and SameSite=Lax, and it is marked Secure on an https address. The database stores a hash of the cookie value and an expiry of 30 days, not the raw cookie. - A magic link. If you ask for an email sign-in, we store your email, a hash of the one-time link, and an expiry of one hour. The email is sent only when outbound email is switched on. The link is single use.
- A short-lived sign-in check. Google sign-in stores a hash of a one-time state value for up to one hour.
- Messages sent to a customer site. A contact form stores the sender's name, email address, and message for that site's owner. A booking stores the name, email, optional note, and the time. We do not add a separate marketing-consent tick box, and we do not use these messages to build a mailing list.
- Page counts. A published site can record how many times a path was opened on a given day. That count is not tied to a person, a cookie, or an IP address.
- The browser check. Creating a draft, and some forms, use Cloudflare Turnstile. Cloudflare receives a token and the IP address to decide if the browser looks automated. We store the time a guest draft passed that check, not the token.
- Abuse limits. The IP address is used to limit how often a draft can be created. We do not save that address on the customer record.
What we do not collect
- Card numbers. Stripe is not connected. The Basic price is listed at $5.50 AUD a month, and checkout does not charge a card. When payments are added, the card is intended to be handled by Stripe. BeyondSite would store the plan status, not the card number.
- A copy of an old WordPress site. Pasting an address does not download that site.
- A profile for advertising. We do not sell personal information, and we do not run advertising cookies on these pages.
Why we collect it
Under the Australian Privacy Principles, we collect personal information to provide the site you asked for, to keep the account signed in, to show the site owner the messages and bookings their visitors send, and to limit abuse. If you are in the UK or the EEA, the same reasons are the contract of providing the service and our legitimate interest in keeping the service from being abused. You can object to that legitimate interest by emailing us. We do not use the information to send marketing.
Who else handles it
Cloudflare hosts BeyondSite and processes the connection, including the IP address and browser data that a host normally sees, in the regions where its network runs. Site content is stored in Cloudflare's database and key-value services. A site record can include a jurisdiction and a location hint. This policy does not promise that every record stays in Australia.
Google receives the sign-in request only if you choose Google and that sign-in is enabled. Cloudflare receives the Turnstile check. If outbound email is enabled, a magic-link or a new-message email is sent through Cloudflare Email to the address the product is configured to use. Site owners can read enquiries and bookings in their dashboard. We do not give those records to other customers.
Cookies
The marketing pages do not set a tracking cookie. beyondsite_session is set only after you sign in. A guest draft is opened with a token in the address, not with an extra marketing cookie.
How long we keep it
Unclaimed drafts expire. Magic links and Google sign-in state expire within an hour and are single use. Sessions expire after 30 days. A claimed site, its pages, enquiries, and bookings stay until you ask us to delete them or we close the account. Email info@skyhive.com.au and we will delete what we can still identify as yours, unless we have to keep a record to resolve a dispute or meet a law.
Access and correction
You can ask for a copy of the personal information we hold about you, and you can ask us to correct it. Site owners can edit the pages they wrote. Visitors who sent a form or a booking should contact the site owner or email us and we will help where we can identify the record.
Children
BeyondSite is not directed at children, and we do not knowingly collect an account for a child.