Privacy notice
We build websites for local businesses from the public facts on their Google listing. This page says what we hold, why, for how long, and how to make us delete it.
Who we are
Kim Matthew Belas runs QuickSite. Address: Mabalacat, Pampanga, Philippines. Email: [email protected].
Kim Matthew Belas is the data protection officer for QuickSite. Write to the email above with any privacy question.
We do not currently offer our service to businesses in the EU or EEA. For businesses and visitors in the United Kingdom, this notice is given under the UK GDPR.
What we collect from Google listings
To prepare a website for a business, we read its public Google Business listing. We keep:
- the Google place ID, which identifies the listing;
- business facts: name, address, phone number, opening hours, category, website and map link;
- Owner or contact names where the listing shows them.
We keep the place ID. Business facts are refreshed from Google. Photos and reviews are shown live from Google with credit; we do not store them.
Some of this can be personal data, for example when a business is a sole trader and the phone number is the owner's own. We keep only the fields the service uses.
Why we use it, and the legal basis
- To prepare a sample website for the business and to contact the business about it, by a person, using the business contact details. Our basis is legitimate interest (GDPR and UK GDPR Art. 6(1)(f)): a business is told that a website was prepared for it, and can say no.
- To keep a suppression record, so a business that asked us to stop is never contacted again. Our basis is legitimate interest, and where the law requires it, for example US do-not-call rules.
- To answer the forms on this site. Requests: steps before a contract, Art. 6(1)(b), and your consent for the channels you tick. Turnstile and the IP hash: legitimate interest in stopping abuse, Art. 6(1)(f).
We have weighed our interest against yours: we use only business contact facts that are already public, contact you once by a person, and stop on request. You can ask for our assessment.
We do not use this data for advertising and we do not sell it.
Information we give you when we did not collect it from you
This is the notice required by GDPR and UK GDPR Art. 13 and 14 and the Philippine Data Privacy Act. We obtained your business facts from your public Google listing, not from you. The categories are listed above.
These providers process data for us:
- Cloudflare hosts and delivers this site and counts visits with Cloudflare Web Analytics.
- Cloudflare Turnstile runs the spam check on the forms. Turnstile may read browser signals and may set a short security cookie.
- DigitalOcean hosts our API and database.
- Anthropic (Claude) writes draft website text from the business facts; it receives no form data.
- Telegram tells us a form was sent. Telegram receives a notice with the phone masked and no message text.
We are in the Philippines, which has no EU or UK adequacy decision. Providers receive data under their data processing terms with EU Standard Contractual Clauses and the UK Addendum.
What we collect from this site
| Request form | Business name, your name, email or phone, optional country, website and message, your consent choice and the version of the consent text, which section you used, a one-way hash of your IP address and the country of your IP address. Used to answer you. |
|---|---|
| Remove my business form | Business name, optional city and listing link, your email, a one-way hash of your IP address and the country. Used to find your record, delete it and confirm. |
| Analytics | Cloudflare Web Analytics. It sets no cookies, does not fingerprint visitors and does not follow you across sites, so there is no cookie banner. It counts page views and similar figures in aggregate. |
| Spam check | The forms use Cloudflare Turnstile to tell people from bots. It runs a short check in your browser, may read browser signals and may set a short security cookie. |
We never put phone numbers, email addresses, names or message text in our logs.
How long we keep it
- We delete your data on request: use Remove my business or email us. An opt-out erases the business record and keeps only a one-way hash of its phone number, so we never contact it again.
- Business records of leads that do not become clients are deleted 6 months after our last contact. We may keep the place ID, because Google allows it.
- Requests from the forms are kept until we have handled them, then we erase the contact details: your name, email, phone and message. The rest of the request is deleted on the same schedule as the business record it belongs to. You can have a request deleted at any time.
- Client records are kept for the time of the contract and then as the law requires for accounts.
- Analytics figures are aggregate and are not linked to you.
Your rights
You can ask us to show you what we hold, correct it, delete it, restrict it, move it, or stop using it. You can object to our use of your data at any time. Where we rely on your consent, for the channels you tick on the request form, you can withdraw it at any time; this does not affect what we did before.
In the UK you can complain to the Information Commissioner's Office. Under RA 10173 you also have the right to be informed, to damages, and to complain to the NPC at privacy.gov.ph.
To have your business deleted and never contacted again, use Remove my business. We match your request to our records and remove the business within 24 hours of matching it. You can also write to [email protected].
Voluntary notice for California residents
We are below the size at which the CCPA and CPRA apply to us. We give this notice and honour these rights anyway.
In the last 12 months we collected these categories, for the purposes above:
- Identifiers (name, email, phone, IP address hash): kept as set out under How long we keep it, by the record they belong to.
- Commercial information (business facts): deleted 6 months after our last contact unless the business becomes a client, then kept for the contract and as the law requires for accounts.
- Internet activity (aggregate page counts): not linked to you.
We do not sell or share personal information for cross-context advertising, and we do not use sensitive personal information. California residents may ask to know, delete or correct their information, and are not treated worse for asking. Use the form or the email above.
Children
This site is not meant for children.
Cookies
This site sets no cookies of its own and uses no advertising or tracking cookies. When you use a form, Cloudflare Turnstile may set a short security cookie.
Changes
If we change this notice we update this page and the date at the top.