Our role: controller and processor
We act in two roles.
- Controller. We decide how we handle the details of people who use the SiteBeacon admin panel (for example a client's staff), our records of how the service is used and secured, and our billing and support records.
- Processor. For a client's website content, the data about visitors to a client's website that SiteBeacon sees on the client's behalf, and the Google data a client connects, the client decides why and how it is used and we process it on the client's instructions. Our Data Processing Addendum applies to business customers.
For privacy questions, email privacy@umbrellatech.com.au. For support, email support@umbrellatech.com.au.
Whose information we handle
- Client staff and panel users: people who sign in to the SiteBeacon admin panel.
- Visitors to client websites: people who visit a website that SiteBeacon serves or monitors. We see them only as technical records, described below.
- People named in client content: names or details that appear in a client's pages, listings or other content.
- Umbrella staff: people who operate the service.
What we collect
Panel users
- name, work email address and role
- sign-in details. We store passwords only as hashes, never in readable form. Where two-step sign-in is used, we hold what it needs to check a code.
- sign-in sessions, and a record of actions taken in the panel (who changed what, and when)
Visitors to client websites
- AI crawler analytics. When a known AI or search crawler requests a page, SiteBeacon records which crawler it was, which page it asked for and when. It records the crawler's name from its user agent, not the visitor's identity.
- Abuse protection. To limit abuse and automated attacks, SiteBeacon uses the IP address of a request to count how often it is made. These counts expire after a short time. Our hosting provider also processes IP addresses to deliver and protect websites.
Client content and settings
The pages, text, listings, services, locations, settings and notes a client gives us or asks SiteBeacon to produce, and the drafts it generates.
Search and analytics data
If a client connects Google Search Console or Google Analytics, SiteBeacon keeps the reporting figures it needs, such as queries, pages, clicks, impressions, position, sessions and key events. See the Umbrella Connect privacy notice for how access is obtained and deleted.
Usage and cost records
SiteBeacon records how many AI and data-provider requests each client uses and what they cost, so we can apply plan limits and invoice correctly. These records do not contain the content of the requests.
AI features and data providers
SiteBeacon has AI features that analyse performance, suggest keywords and draft page text. When a user runs one, SiteBeacon builds a request from the information that feature needs and sends it through Cloudflare AI Gateway to an AI model. We use Anthropic's Claude models, with a Cloudflare Workers AI model as a fallback. A separate Cloudflare Workers AI model screens content for safety.
The request can include:
- the business name, a short description of the business, its services and its locations
- text from the client's own pages
- the user's instructions
- where the client has connected Google Search Console, figures such as top search queries and pages with their clicks, impressions and positions
A person's name or email address is not part of a request unless it appears in the client's own content.
SiteBeacon also sends keyword phrases and a location to DataForSEO, through Cloudflare AI Gateway, to get search volume, cost-per-click and difficulty figures. The phrases can come from a page's own words or from a client's Search Console queries. We do not send account details, email addresses or access tokens.
Generated text is a draft. A person at the client approves it before it is published to be indexed. SiteBeacon does not make decisions about individuals using these features. They produce drafts and figures about websites.
We do not use Google user data to develop, improve or train generalised AI or machine learning models. The providers above are listed, with what they receive and where, on our sub-processors page.
Why we use the information, and our lawful bases
- Providing SiteBeacon to a client (account, panel, content, reports, AI features): performing our contract with the client, and the client's instructions where we are a processor.
- Securing the service and preventing abuse (sign-in checks, rate limiting, activity records): our legitimate interest in keeping the service and our clients safe.
- Metering usage and invoicing: performing our contract, and our legal obligations to keep financial records.
- Support and service messages: performing our contract and our legitimate interest in running the service well.
- Marketing: only with your consent, and you can opt out at any time.
Providing the information needed to create a panel account is required to use the panel. Visitors to client websites are not required to give us anything.
Cost and usage metering
Each client has a plan (Starter, Growth or Pro) with monthly limits. We count requests and costs per client so that limits work and invoices are correct. Plans are invoiced. SiteBeacon does not collect or store payment card details.
Overseas processing
Cloudflare operates a global network. Anthropic and DataForSEO process data on their own infrastructure outside Australia. We take reasonable steps to make sure our providers handle personal information in a way that is consistent with the Australian Privacy Principles. If the UK or EU GDPR applies, see the transfer section of our Data Processing Addendum.
How long we keep it
| Information | How long we keep it |
|---|---|
| Panel accounts, client content and settings | While the client is with us |
| Activity records in the panel | 90 days by default |
| AI crawler tallies | 30 days |
| Rate-limit counters | A short window, then they expire |
| Search Console reporting history | Up to 100 days for the comparison summaries. Current figures are replaced each day |
| Keyword figures from DataForSEO | Cached for 30 days |
| Usage and cost records | For as long as we need them for invoicing and our legal obligations |
Leaving SiteBeacon and offboarding
When a client leaves, we can give them an export of their data and their content stays theirs. A client's site belongs to the client and the SiteBeacon worker can be removed so the site is served as before. After we remove a client from SiteBeacon we keep their data for 30 days so a mistake can be undone, then we purge it. A purge removes their content, settings, research, records, keys and cached provider data. Aggregate counts that expire on their own, and our record that the client was removed, are kept. Google data is deleted within 30 days as set out in the Umbrella Connect privacy notice.
Security
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Staff access to the operator console goes through Cloudflare Access. Passwords are hashed. Each client's data is kept separate from every other client's. If we become aware of a data breach that is likely to result in serious harm, we will contain it, assess it and notify affected people and the OAIC as the Notifiable Data Breaches scheme requires. For business customers, our Data Processing Addendum sets out how we tell you.
Your rights and how to complain
You can ask to access or correct the personal information we hold about you, or ask us to delete it, by emailing privacy@umbrellatech.com.au. We respond within 30 days. If your information is in a client's SiteBeacon account, we may refer you to the client, who is responsible for it. If the UK or EU GDPR applies, you also have the right to restrict or object to our handling, to receive your information in a portable format and to withdraw consent. You can complain to us first. You can also contact the OAIC at oaic.gov.au or on 1300 363 992, or your local data protection authority.
Automated decisions
We do not make automated decisions that significantly affect your rights or interests. Bot protection and rate limiting only slow or block requests that look abusive. If we ever introduce an automated decision of that kind, we will describe it in this notice first.
What changed
- Version 1.0, 31 October 2026: first published.
Contact us
- Business: Umbrella Technologies Pty Ltd (ABN 15 701 061 243)
- Location: Osborne Park, Perth WA 6017 (by appointment)
- Privacy email: privacy@umbrellatech.com.au
- Support email: support@umbrellatech.com.au
- Phone: 1800 262 262