Privacy Policy

Who this covers

This policy covers buysitesdirect.com, a marketplace where sellers list websites and online businesses for sale and buyers contact those sellers directly. Buy Sites Direct started in 2026 and is operated by [LEGAL ENTITY NAME].

What we collect

If you register as a seller

• Email address. Used to sign you in, to reset your password, and to reach you about your account.
• Password. Stored only as a bcrypt hash. We cannot read your password and neither can anyone with access to the database.
• Username. Public. It appears on your listings and on your seller page.
• Listing content. Titles, descriptions, asking price, revenue and traffic figures, and the website URL you enter. All of it is public once you publish the listing.

Buyers do not need an account. Browsing listings requires nothing from you.

If you contact a seller

• The name, email address, and message you type into the contact form.
• Your IP address, recorded with the inquiry and used to rate limit the form so it cannot be used to flood sellers with spam.

Inquiries are stored in our database and shown to the seller inside their dashboard. We do not currently forward inquiries by email, so a seller sees your message when they sign in. Your email address is visible to the seller you contacted so they can reply to you. It is not shown publicly and it is not sold or rented to anyone.

When anyone visits

Google Analytics 4 (measurement ID G-FFY4N56NZG) records standard visit data: pages viewed, approximate location derived from IP, device and browser type, and how you arrived at the site. We use it to understand which pages are useful, not to identify individual people. Our hosting provider also keeps short lived server request logs.

Why we collect it

• To create and secure your seller account and keep you signed in.
• To publish the listings you choose to publish.
• To deliver buyer inquiries to the seller they were sent to.
• To stop spam and abuse of the contact form.
• To see how the site is used so we can improve it.

We do not run advertising, we do not build advertising profiles, and we do not sell personal information to anyone.

Who else handles your data

We use a small number of service providers to run the site. Each one only receives what it needs to do its job, and each has its own privacy policy.

• Vercel hosts the site and serves every page request.
• Neon hosts the Postgres database that stores accounts, listings, and inquiries.
• Google Analytics 4 receives anonymous usage data about page visits.
• Resend delivers password reset emails.

We may also disclose information if the law requires it, or to protect the safety and rights of users of the site.

The AI listing tool

Sellers can ask the site to draft a listing for them. When you use that feature, we fetch the public homepage of the website URL you supplied and send that public page content, along with the figures you entered, to an AI model provider to produce a draft. Only information that is already public on your site, plus what you typed into the form, is sent. Nothing is sent unless you start the draft yourself, and you can edit or discard the result before publishing.

Cookies

This site sets very few cookies.

• Session cookie. Set only when you sign in as a seller. It is a signed token, HTTP-only so JavaScript cannot read it, and it expires after 7 days. Without it we cannot keep you signed in.
• Google Analytics cookies. Set on every visit to count visits and sessions. You can block them with a browser setting, a tracking blocker, or the Google Analytics opt out browser add-on, and the site will still work normally.

How long we keep it

• Seller accounts and listings are kept until you delete them or ask us to close your account.
• Inquiries are kept in the seller dashboard until the seller deletes them or the account is closed.
• Session cookies expire after 7 days.
• Google Analytics applies its own retention period to the usage data it holds.

Getting your data deleted

You can delete any listing yourself from your dashboard at any time. To have your account and the data attached to it removed, or to ask what we hold about you, get in touch through the FAQ page. Tell us the email address on the account so we can find it. We will confirm once the account is gone. Copies may remain in routine backups for a short period before those backups roll over.

Security

Passwords are hashed with bcrypt and never stored in readable form. Sessions use signed, HTTP-only cookies. The site is served over HTTPS. No system is perfectly secure, so please use a password you do not reuse elsewhere.

Children

This site is not directed at children and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

If we change how the site handles data, we will update this page and change the date at the top. Significant changes will be noted here rather than made quietly.

Contact

There is no phone number or mailing address for the site. Questions about this policy go through the FAQ page.