Privacy Policy
Website: https://sytelift.com
Company: Frostwave Labs Inc.
Contact: info@sytelift.com
Address: 2967 Dundas St. W. #992, Toronto, ON M6P 1Z2
Jurisdiction: Ontario, Canada
Effective date: 2026-10-09
We are based in Ontario, Canada.
Privacy contact and data controller
For purposes of applicable data protection laws, the data controller is:
Frostwave Labs Inc.
Email: info@sytelift.com
Address: 2967 Dundas St. W. #992, Toronto, ON M6P 1Z2
Ontario, Canada
Use the contact details above for privacy inquiries, rights requests, or complaints. We will review and respond in accordance with applicable law.
This Privacy Policy explains how Frostwave Labs Inc. ("we", "us", or "our") collects, uses, discloses, and protects information when you visit or use https://sytelift.com (the "Website").
This policy is intended to describe our practices in a clear manner. It does not limit any rights or remedies available under applicable law.
1) Definitions
For purposes of this Privacy Policy:
- "Personal information" / "personal data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with you or your device.
- "Processing" means any operation performed on personal information, including collection, use, storage, disclosure, or deletion.
- "Service providers" means vendors that process information on our behalf to provide enabled features such as hosting, security, payment processing, fulfillment, analytics, communications, and support.
- "Controller" or "business", where applicable, means the entity that determines the purposes and means of processing personal information.
2) What we collect
Information you provide
- Contact, order, and support information: If you contact us, request information, submit a form, place an order, or ask for support, we collect the details you choose to provide and may keep records needed to respond, fulfill the request, and maintain the resulting transaction or correspondence.
Information collected automatically
- Device and usage data: IP address, browser type, device identifiers, pages viewed, time spent, referral URLs, and similar diagnostics.
- Cookies and similar technologies: We may use cookies, pixels, tags, local storage, or similar technologies to operate the Website, remember preferences, measure performance, protect against abuse, and support the features enabled for this Website.
- Log and security data: We and our service providers may collect logs and related information to maintain the security and integrity of the Website, including detecting suspicious activity, preventing abuse, and troubleshooting.
3) How we use information
We may use information to:
- Provide, operate, secure, and maintain the Website
- Respond to inquiries and provide customer support
- Process enabled transactions, fulfill orders, and administer requests you submit
- Understand Website usage and improve content, performance, and reliability
- Prevent fraud, abuse, security incidents, and unlawful activity
- Enforce our Terms of Service and other agreements
- Comply with legal obligations and respond to lawful requests
- Protect the rights, safety, and property of us, our users, and others
4) Named service providers and recipients
The following providers or recipients are declared for this Website. Each is used only for the role and purpose described in the current configuration.
- Cloudflare, Inc. — Role: hosting, application database and security service provider. Purpose: Serve this website and run the application service (Cloudflare Workers and D1 database), protect the application form from automated abuse (Cloudflare Turnstile), host customer websites and route email sent to our public address. Cloudflare processes request data such as IP address, browser details and Turnstile signals to deliver and secure these services. Information: IP address and request metadata, browser and device details, Turnstile verification signals, application form answers stored in our database. Countries or regions: United States and other countries where Cloudflare operates. Transfer mechanism: Cloudflare's data processing terms, including Standard Contractual Clauses and its Data Privacy Framework certification where applicable. Legal basis: Legitimate interests in operating and securing the website; contract or steps at your request for processing your application.
- Google LLC (Google Ads) — Role: advertising, hosted application collection and measurement service provider. Purpose: Collect applications submitted through Google Ads lead forms hosted by Google and transfer the submitted answers and ad/form identifiers to SyteLift through an authenticated webhook. Google measures these hosted submissions natively. For applications submitted on our website, separately record ad conversions only when ad measurement is enabled. Information: Google ad click identifier (gclid, gbraid or wbraid), contact and business details and application answers submitted through a Google-hosted lead form, Google lead delivery, campaign, ad group, creative and form identifiers, one-way hashed (SHA-256) email address, time of the application. Countries or regions: United States and other countries where Google operates. Transfer mechanism: Google's data processing terms for Google Ads, including Standard Contractual Clauses where applicable. Legal basis: Steps at your request for collecting and transferring a hosted application; SyteLift website conversion uploads, which Global Privacy Control turns off automatically and which you can opt out of any time at info@sytelift.com.
- Resend, Inc. — Role: email delivery service provider. Purpose: Send application confirmations and decisions, finished-site delivery, payment receipts, domain setup help, site-live notices and refund confirmations, and website design tips only to people who opted in. Resend records delivery, bounce and complaint events. Information: name, email address, business name and website address, message content, delivery and bounce events. Countries or regions: United States. Transfer mechanism: Resend's data processing addendum, including Standard Contractual Clauses where applicable. Legal basis: Contract or steps at your request for application and customer emails; consent for marketing email.
- Stripe, Inc. — Role: payment processor. Purpose: Collect one-time payment, calculate applicable tax, issue receipts and prevent fraud when you buy a SyteLift website. Card and bank details go to Stripe, not to us. Information: name and email address, billing details, payment method details handled by Stripe, transaction records. Countries or regions: United States and other countries where Stripe operates. Transfer mechanism: Stripe's data processing agreement, including Standard Contractual Clauses and its Data Privacy Framework certification where applicable. Legal basis: Contract and legal obligation (accounting and tax records).
- Fastmail Pty Ltd — Role: correspondence service provider. Purpose: Host the mailbox for our public address (info@sytelift.com), where emails you send us, our replies and internal copies of our customer service emails are stored for correspondence and follow-up. Information: email address, message content, internal customer service email copies and attachments you send us. Countries or regions: United States and Australia. Transfer mechanism: Fastmail's privacy terms and data processing terms, including Standard Contractual Clauses where applicable. Legal basis: Contract or steps at your request; legitimate interests in answering correspondence and keeping records.
5) Payments and invoicing
If you receive an invoice, make a payment, request billing support, or otherwise buy from us, we may use a third-party payment processor such as Stripe.
Payment processors may collect and process billing details, payment method details, authentication data, transaction details, tax information, customer identifiers, fraud-prevention signals, and related records. Card, bank, and payment method details are handled by the payment processor rather than by the Website.
We receive and retain information needed to manage invoices, confirm payment, provide receipts, handle support, maintain accounting and tax records, prevent fraud, and respond to disputes or legal obligations. Payment processors process information under their own terms and privacy policies.
6) Applications for your new website
When you apply we collect your name, email address, business name, current website address, your description of your dream site and, if you provide them, a phone number, industry and city or region. Our service is for United States businesses. We use your answers to review your application, email a decision within 2 business days and, if you are accepted, build and send your new website as fast as possible. We also use them to discuss requested changes, process a purchase, connect your domain, fix real hosting issues, keep business records and protect against fraud, abuse and disputes. We may follow up personally about your application or new website. We send website design tips only if you opt in, and every such email has an unsubscribe link.
7) Google-hosted applications
You may also apply through a Google Ads lead form hosted by Google. Google collects the contact and business details and answers you submit, including your website, industry, role, purchase timeline and business goals, under its own privacy practices. Google transfers those answers, a lead delivery identifier, ad and form identifiers and an available Google click identifier to our application service through an authenticated webhook. We store them with your application and use them for the same fit review, website build and service correspondence as website applications. Submitting a Google-hosted form does not subscribe you to website design tips or grant SyteLift permission to upload website ad-measurement data. We record no marketing opt-in from that submission. Google measures hosted form submissions natively; we do not upload them again as website applications.
8) Analysis of your public website
To build your new website and prepare your report, we and our software analyze publicly reachable pages of the website address you give us: text, images, structure, speed, accessibility and search-engine readiness. We do not log in, access private areas or change your current site. We keep the results with your application.
9) Security and Cloudflare Turnstile
The application form on our website uses Cloudflare Turnstile to help distinguish people from automated bots. Turnstile may load a Cloudflare script, run a check in your browser and share IP address and browser signals with Cloudflare. We store a salted one-way hash of your IP address, browser user agent and the verification result to protect the application service. A short per-minute burst limit protects public routes. Duplicate applications and filled hidden fields are recorded for review.
10) Advertising attribution and Google Ads measurement
If you arrive from a SyteLift ad, the link may carry a Google click identifier (gclid, gbraid or wbraid) and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content). When one is present, your browser keeps it in session storage, which ends when you close the tab, together with your landing page and referrer. We use it to show any exclusive offer tied to that ad and send it with your application to label its source. On our website, SyteLift does not run a Google tag or advertising cookies in your browser. Separately, from our server, we share the click identifier, a one-way hashed (SHA-256) copy of your email address and the application time with Google Ads, so we can measure which ads lead to applications. Under some US state privacy laws, this can count as sharing or targeted advertising. We honor Global Privacy Control: if your browser sends it, we do not share your data with Google Ads. You can also opt out at any time by emailing info@sytelift.com. Opting out never affects your application or its price.
11) Retention
Applications that do not become a customer relationship are kept for up to 24 months and then deleted or de-identified. Customer payment, tax, accounting, domain and hosting records are kept as long as the relationship lasts and for the period required by law. Email correspondence stays in our mailbox until deleted. We retain unsubscribe and suppression records so we can honor opt-outs. Ask us to delete your application at info@sytelift.com.
12) Customer websites, hosting and domains
If you purchase a site, we host it on Cloudflare for free and you keep your domain registration. On the same offer page after payment, we collect your domain, provide provider-specific DNS instructions and check the records and connection status. We never ask for your registrar password. You can request a static export and move the site any time. Support after delivery is for real hosting issues.
13) Sharing and disclosures
We may share information:
- With service providers who help operate the Website and provide enabled features
- To comply with legal obligations or lawful requests
- To protect our rights, safety, and property, and that of users and others
- In connection with a merger, acquisition, financing, restructuring, or sale of assets, where permitted by law
We do not authorize service providers to use personal information we share with them except as necessary to provide services to us or to comply with applicable law.
We may also share aggregated or de-identified information that cannot reasonably be used to identify you.
14) Data retention
We retain personal information only as long as needed for the purposes described in this policy, unless a longer retention period is required or permitted by law.
Examples include retaining correspondence for support records, technical logs for security and operational purposes, billing records for accounting and tax obligations where applicable, and unsubscribe records to respect communication preferences.
15) Security and your rights
We use reasonable technical and organizational measures to protect information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
You may have rights depending on your location, including:
- Access, correction, or deletion of personal information
- Objection or restriction of processing
- Data portability
- Withdrawal of consent where processing is based on consent
To exercise rights, contact: info@sytelift.com
16) GDPR notes
If you are in the EEA or UK, we rely on a legal basis for processing such as:
- Consent, for example where required for optional cookies or requested email communications
- Legitimate interests, for example site security, fraud prevention, support, and basic operational analytics where permitted by law
- Contract, where processing is needed to take steps at your request or perform an agreement
- Legal obligation, where processing is required by applicable law
Where we rely on legitimate interests, we consider and balance any potential impact on your rights and may limit processing where required. You also have the right to lodge a complaint with your local data protection authority.
17) California privacy notes
We may collect identifiers, internet or electronic network activity information, commercial information where applicable, and other information you provide or that is generated through your use of the Website.
We do not sell personal information in the traditional sense. Some advertising or ad-tech practices may be considered sharing under California privacy law. Where required, we provide mechanisms to opt out of that sharing.
If you submit a request to exercise your rights, we may need to verify your identity, which may require additional information. We will use verification information only for that purpose.
18) Do Not Track signals
Some browsers transmit Do Not Track or other browser-based privacy signals. We honor such signals where applicable law requires it. Otherwise, because there is no consistent standard for interpreting every signal, users can manage cookie preferences through browser settings and any consent tools we provide.
19) International visitors
If you access the Website from outside Ontario, Canada, your information may be processed in countries where our service providers operate, which may have different data protection laws.
For the named providers or recipients above, the declared transfer details are:
- Cloudflare, Inc. — countries or regions: United States and other countries where Cloudflare operates; transfer mechanism: Cloudflare's data processing terms, including Standard Contractual Clauses and its Data Privacy Framework certification where applicable.
- Google LLC (Google Ads) — countries or regions: United States and other countries where Google operates; transfer mechanism: Google's data processing terms for Google Ads, including Standard Contractual Clauses where applicable.
- Resend, Inc. — countries or regions: United States; transfer mechanism: Resend's data processing addendum, including Standard Contractual Clauses where applicable.
- Stripe, Inc. — countries or regions: United States and other countries where Stripe operates; transfer mechanism: Stripe's data processing agreement, including Standard Contractual Clauses and its Data Privacy Framework certification where applicable.
- Fastmail Pty Ltd — countries or regions: United States and Australia; transfer mechanism: Fastmail's privacy terms and data processing terms, including Standard Contractual Clauses where applicable.
Where required by applicable law, cross-border transfers are subject to recognized safeguards, such as an adequacy decision, Standard Contractual Clauses, a UK International Data Transfer Addendum, or another lawful transfer mechanism. The safeguards stated for a named provider apply only where that provider and transfer are enabled.
20) Links to other websites
The Website may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of third-party sites or services.
21) Children's privacy
The Website is not intended for children under 13, or the minimum age required by your jurisdiction if higher. We do not knowingly collect personal information from children. If you believe a child provided us data, contact info@sytelift.com.
22) Sensitive personal information
We ask that you do not send us, and do not disclose, any sensitive personal information on or through the Website or otherwise to us unless we specifically request it for a lawful purpose.
23) Changes to this policy
We may update this policy from time to time. The updated version will be posted on this page with a revised effective date.
24) Contact
Questions about this Privacy Policy: info@sytelift.com
Mailing address: 2967 Dundas St. W. #992, Toronto, ON M6P 1Z2