Legal

Privacy Policy

Last updated: 28 June 2026

1. Introduction

HypaSites is a business of Kempire Group Pty Ltd (“HypaSites”, “we”, “us”, “our”), the Australian company that operates the Service and is the entity responsible for your personal information. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use HypaSites (“the Service”). We are based in Melbourne, Victoria, and we comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

We collect the following types of information:

  • Account information — your name, email address, and password when you create an account.
  • Brief content — the text, images, and brand assets you provide when creating a site brief.
  • Contacts and leads you collect — when you use the Service to capture leads or import contacts, we store the contact data you collect (such as name, email, phone, company, and any message or form fields), together with the time, source page, IP address, and the consent wording shown at sign-up. This data belongs to you; we process it on your behalf (see “Contacts you collect” below).
  • Email engagement data — for emails sent through the Service we record delivery, opens, clicks, bounces, spam complaints, and unsubscribes, so you can see how your campaigns perform and so we can protect deliverability.
  • Your Anthropic API key — every plan uses your own Anthropic API key for AI generation. We encrypt it (AES-256-GCM) on save, store only encrypted bytes, decrypt it server-side only at generation time, and never log or display it in full. It is never sent anywhere except Anthropic.
  • Visitor analytics on your pages — when a visitor loads a page you publish, we record the page, event type, referrer, and a hashed IP address and user-agent (hashed so visitors can be de-duplicated without storing their raw personal data), plus a timestamp.
  • Usage analytics — how you interact with the Service, including pages visited, features used, and session duration.
  • Payment information — billing details processed securely through our payment provider (Stripe). We do not store your full card number.
  • Cookies and similar technologies — small files stored on your device to maintain your session and preferences.

3. How We Use Your Information

  • To operate, maintain, and improve the Service.
  • To generate landing pages based on your briefs using AI.
  • To process payments and manage your subscription.
  • To send you transactional emails (account confirmations, billing receipts) and, where relevant, product and marketing emails about HypaSites, which you can opt out of at any time.
  • To operate the email features you use — sending the auto-emails, sequences, and broadcasts you create to the contacts you have collected, applying merge fields, and recording engagement (opens, clicks, bounces, complaints, unsubscribes).
  • To generate AI summaries and intent signals for the leads you capture, to help you understand and prioritise them.
  • To protect deliverability and prevent abuse — maintaining suppression lists (hard bounces, spam complaints, unsubscribes) and monitoring sending across the shared platform.
  • To analyse usage patterns and improve AI generation quality.
  • To respond to support requests and communicate with you.

4. Third-Party Services

We use trusted third-party providers to deliver the Service:

  • Supabase — authentication and database hosting.
  • Anthropic (Claude) — AI-powered page generation and lead analysis. Brief and lead content is sent to Anthropic’s API for processing.
  • Vercel — hosting of the HypaSites application.
  • Netlify — hosting and deployment of generated landing pages.
  • Fly.io — background processing workers.
  • Resend — delivery of emails sent through the Service (transactional and the marketing emails you create).
  • Stripe — secure payment processing.

Each provider operates under their own privacy policy. We only share the minimum data necessary for each service to function.

Overseas disclosure. Several of these providers store and process data outside Australia. The likely recipient countries are in the United States (Anthropic, Vercel, Netlify, Fly.io, Resend, Stripe). By using the Service you consent to your information, and the contact data you collect, being disclosed to these providers in those locations for the purposes described in this policy.

4a. Contacts you collect (your role and ours)

When you capture leads or import contacts through the Service, that contact data is yours. As between you and HypaSites, you are the data controller and the responsible entity under the Australian Privacy Principles for those contacts, and we act as your processor, handling the data only to provide the Service to you and on your instructions. You are responsible for giving the people you collect data from a clear collection notice and privacy policy, for having a lawful basis (such as consent) to contact them, and for honouring their privacy and unsubscribe requests. We provide the tools to help — every marketing email includes an unsubscribe link and sender identification, and we maintain suppression lists — but the relationship with those contacts is yours.

If you use the Service on a white-label or agency basis to provide services to your own clients, you remain responsible for your clients’ and their contacts’ data as set out above, and you must ensure your clients agree to terms and privacy practices at least as protective as these. HypaSites has no direct relationship with your clients or their contacts.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain it. Anonymised, aggregated data may be retained indefinitely for analytics purposes.

6. Your Rights

You have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Correction — ask us to correct inaccurate or incomplete information.
  • Deletion — request deletion of your personal data and account.
  • Export — download your brief content and generated page code at any time.

To exercise any of these rights, contact us at hello@hypasites.com. We will respond within 30 days.

7. Cookies

We use essential cookies to keep you signed in and maintain your session preferences. We may also use analytics cookies to understand how the Service is used. You can disable cookies in your browser settings, but some features of the Service may not function correctly without them.

8. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. If a data breach occurs that is likely to result in serious harm, we will assess it and notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Service. Continued use after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related queries or to exercise your data rights, email us at hello@hypasites.com. HypaSites is operated by Kempire Group Pty Ltd, Melbourne, Victoria, Australia.