Privacy Policy

360sites offers full circle visibility for your work and life: tools to publish a 360 Site with your social media, your websites, your contact options and everything about you, and for visitors to contact the person who publishes it (the “creator”) and book appointments. For the purposes of this policy, My360sites (“360sites”) is the data controller responsible for processing the personal data described below.

My360sites is based in the United States and relies on service providers located in the United States and other countries to run the platform (see “Service providers and international transfers”). For any privacy request you can reach us at info@my360sites.com.

Account data: your email address, an optional phone number, your password (stored only as a cryptographic hash — never in plain text), your account type, and account status.

Sign-in with Google or Facebook: if you choose “Continue with Google” or “Continue with Facebook”, we receive from that provider your name, your email address and the identifier of that account, and use them only to create your account, sign you in and prefill your profile. We do not receive your password for those services or access your posts, friends or contacts. You can stop using that sign-in at any time from the provider’s app settings.

Profile data: your name, professional headline, biography, city and country, profile photo, banner and presentation video, languages, skills, and professional background such as experience and education.

Identity verification (creators): when 360sites requires it, creators complete an identity check through our provider Didit (government ID plus a selfie). 360sites does not store your identity documents or selfie; it only receives the verified name and the result of the check.

Creator membership billing: subscription status, plan and billing records. Card data is handled by the payment provider and 360sites does not store full card numbers.

Paid sales: when a creator sells a paid session or offer, Stripe processes the payment in the creator’s own Stripe account. 360sites receives the sale record (amount, currency, status and payment processing fee) and the creator’s Stripe account status, never the buyer’s card data.

Content and communications: posts and media you publish, direct messages, intake answers, and support tickets. Video and audio streams of your sessions are transmitted through our video provider and are not stored by 360sites.

Technical and usage data: device push tokens (if you enable notifications), product-usage analytics (page views, clicks, funnels), and a random first-party identifier used for consented source attribution and 360 Site metrics (views, button/action clicks, normalized referrer host and, when trusted network geolocation is available, country). Optional measurement is collected only after you accept the shared consent.

To provide and operate the service: create and manage your account, publish profiles, run search and matching, schedule and hold sessions, and deliver messages and notifications.

To manage creator membership billing, process paid sales and the payment processing fee, and keep required billing records.

To send you news and offers from 360sites by email, including sponsored offers from our advertising partners. In the United States the sign-up box for these emails is pre-selected and you can untick it; elsewhere it is not pre-selected and we only send them if you tick it. You can change this anytime in your notification settings, and every marketing email has a one-click unsubscribe link. We never share your email address with partners, and unsubscribing does not affect account emails such as bookings, billing or security.

To verify creator identity when required, keep the community safe, prevent fraud and abuse, and enforce our Terms.

To provide customer support (including an AI assistant) and to measure and improve the product through analytics.

To comply with legal, accounting and tax obligations.

When you create an account you provide your prior, express and informed authorization to process your personal data for the purposes described here.

We also rely, as applicable, on the performance of our contract with you, our legitimate interest in operating and securing the platform, your shared consent for optional product analytics and source measurement, and compliance with legal obligations.

Essential cookies: we use strictly necessary cookies to keep you signed in (secure, http-only session tokens). These are required for the service to work.

Optional measurement: with one shared consent, we use PostHog for product analytics and separate first-party systems for acquisition attribution and 360 Site reporting. The 360 Site report counts views, unique consented visitors, button/action clicks, normalized traffic sources and referrer hosts; country is included only when supplied by trusted network geolocation. Rejecting or withdrawing consent disables measurement and removes first-party facts for that browser. The first-party systems use a random browser identifier for up to 90 days; they do not store search terms, prompts, user-agent, contact/button text or full URLs and do not depend on PostHog. We never place personal data in analytics events: PostHog uses an internal account ID, never your name, email, phone or message content. Where session replay is enabled, input fields are masked.

Tags connected by 360 Site owners: creators with a paid plan can connect their own analytics and advertising accounts to their public 360 Site — Google Analytics, Google Ads, Google Tag Manager (restricted to Google tags), Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag and Microsoft Clarity. The creator only enters the account ID; 360sites adds the provider’s official code. These tags load only on that creator’s public 360 Site and only after you accept the shared consent; they never load in the editor or when creators view their own site. They send data such as the page visited, your browser and device information, and cookie identifiers directly to the creator’s account with that provider, under the provider’s own terms and privacy policy. The creator is responsible for that processing and for disclosing it to their visitors. Rejecting or withdrawing consent stops these tags (the page reloads without them).

We share the minimum necessary data with trusted providers that help us run the platform: Stripe (creator membership billing and paid sales through Stripe Connect), Amazon Web Services (hosting, database and file storage via S3), Resend (transactional email delivery), Google and Meta (sign-in with Google or Facebook when you choose it), Google Firebase (push notifications and phone-number verification), LiveKit (in-platform video), Meilisearch (community search), Cloudflare Turnstile (bot protection at sign-up/login), Didit (identity verification), PostHog (analytics), Sentry (error monitoring), and Google or Anthropic (the AI assistant that answers support questions).

Several of these providers process data in the United States and other countries. By using 360sites you acknowledge that your data may be transferred internationally to these providers, which are bound to process it only on our instructions and to apply adequate security safeguards.

Payment card data is processed exclusively by Stripe under PCI-DSS standards; identity documents are held by Didit, not by 360sites.

We protect your data with industry-standard measures: passwords hashed with Argon2id, encryption in transit (TLS) and at rest, encryption of sensitive billing and integration credentials, revocable sessions, and role-based access controls.

No system is completely secure, but we work continuously to protect your information and to respond to incidents responsibly.

We keep your personal data while your account is active. When you delete your account, we anonymize your personal data and revoke your sessions so the account can no longer be accessed.

Some records — such as creator membership billing records, paid sale records and security audit logs — are retained for the periods required by accounting, tax and legal obligations, even after account deletion.

You can delete your account at any time from your Account settings.

You may access, update and rectify your data, request its deletion, and revoke the authorization you gave for its processing, subject to legal limits.

You can exercise these rights from within the app (edit your profile, manage notification preferences, reject analytics, delete your account) or by writing to info@my360sites.com. You may also have the right to lodge a complaint with the data protection authority where you live.

360sites is intended for people aged 18 or older. We do not knowingly collect personal data from children. If you believe a minor has provided us data, contact info@my360sites.com so we can remove it.

We may update this Privacy Policy from time to time. We will post the new version here and update the “Last updated” date; for material changes we will provide additional notice. Continued use of 360sites after the changes take effect means you accept the updated policy.

For any question or request about your personal data, write to info@my360sites.com.