Sitefill

Privacy

Last updated 13 November 2026.

Sitefill is operated by Skylive LLC. This page says what Sitefill stores, why, and where it sends it. Sitefill has no advertising, no analytics scripts and no tracking pixels.

Who is responsible for what

For studio accounts, Skylive LLC decides how the data is used. For what a studio's clients enter, the studio decides, and Skylive LLC stores and handles it on the studio's behalf. If you are a client and want something corrected or deleted, ask the studio that sent you the link, or write to us and we pass it on.

What Sitefill stores

  • About a studio member: the email address, and the sessions of signed-in browsers. There are no passwords. Sign-in codes are stored hashed and are valid for 15 minutes. A daily cleanup deletes expired codes and sessions.
  • About a studio: its name, logo, accent colour, plan, the Stripe customer and subscription ids, how many prefill runs it has started, and where the first visit came from (the utm parameters of the link, or the referring site).
  • About a site: its name, the address of the client's current website if given, the Framer project URL and API key or the Webflow token, and the collections and fields read from the CMS. The key or token is encrypted with AES-256-GCM before it is stored, and is never shown again or sent to a browser.
  • About a request: the client's name and email as the studio typed them, the sections and fields, every value and comment the client enters, the files they upload, the studio's notes, and a history of who did what and when.
  • For the free tool on the home page: the address you paste and the drafts made from it. They are reused for one day, and the daily cleanup deletes them within the day after that.
  • For rate limits: counters by IP address, email, studio or link. The longest limit runs for a day, and the daily cleanup deletes each counter within a day of its limit ending.

Cookies and browser storage

  • sitefill_session: keeps a studio member signed in for 60 days. It cannot be read by scripts.
  • sitefill_first: remembers for 60 days which campaign or site a first visit came from, and is read once at sign-up.
  • The address tried in the free tool is kept in the browser's local storage until sign-up, so the first site starts with it.

Clients who open a request link get no cookie. The first time a client's browser opens the link, the request's history records it, so the studio knows the link arrived.

Where data is sent

  • Resend sends the emails: sign-in codes, the request link, reminders, returned-entry notes, invitations and notices to the studio. It receives the recipient's address and the text of the email. Emails to a client carry the studio's name as the sender on paid plans and the name Sitefill on the Free plan. Replies go to the studio's owner on every plan.
  • Anthropic's Claude writes the prefill drafts. It receives the text of the public pages of the client's current website and the names and limits of the fields being asked for. It does not receive CMS credentials, uploaded files or what the client typed.
  • Stripe takes payments. It receives the owner's email and the plan. Card details go to Stripe directly and never reach Sitefill.
  • Framer or Webflow, whichever the studio connected, receives the entries the studio approved and the address of each uploaded file, which it then fetches.

Sitefill also reads the public pages of the client's current website when a studio or a visitor asks for drafts, obeying the site's robots.txt, at most 12 pages per run.

Uploaded files

A file a client uploads is served at an address with a long random key. The address is not listed anywhere and is not indexed, but anyone who has it can open the file. This is needed so that a CMS can fetch images and files.

How long data is kept

Requests, their content and files stay until the studio deletes the archived request, removes the site they belong to, or asks us to delete the studio. The database is backed up every day and 14 backups are kept, so deleted data leaves the backups within two weeks. Uploaded files are not part of those backups.

Your choices

You can ask for a copy of your data, for a correction or for deletion at support@skylive.world. A studio can export any request as JSON, CSV and a zip of its files. A client can stop reminder emails with the link at the bottom of each reminder.

Contact

Skylive LLC, support@skylive.world