# Legal for user sites: guide for Site Owners and their AI assistants > For people and their AI: what a Site Owner takes on when their site has an app (https://pagelemon.com/agents/member-app). **This is general information, not legal advice.** Rules differ by country and by business; for a decision that matters, ask a qualified adviser. When your site has users who sign in and add their own records, you are running a small online service. This page explains, in plain words, what that means for you, and what Page Lemon does and doesn't do. ## 1. Who's responsible - **You are the controller** of your users' information: you decide what is collected, why, who sees it and how long it is kept. You are also the merchant for any paid membership: refunds, receipts, VAT and consumer rights are yours. - **Page Lemon is your processor:** it hosts the site, runs the user sign-in, stores entries and files for you, and follows your instructions under its Data Processing Agreement (https://pagelemon.com/dpa). It is never the merchant of record. - **Your users are adults** (18 or over), and you look after them: you answer their questions and requests. ## 2. What you can't collect The Acceptable Use Policy (https://pagelemon.com/acceptable-use#member-app) rules out, on any user site: - health or mental-health information, including mood, symptom and therapy journals, and clinical records; - accounts for children, or their personal data, including through a parent's account; - card numbers, bank account numbers and government ID numbers (passport, driving licence, national insurance). Users pay through Stripe, which holds their card details. If users photograph receipts, ask them to cover the long card number first. Collect only what you need for the purpose you tell users about. ## 3. Your privacy notice Users must be told, before they join, how their information is used. Publish a privacy notice on your site (the expense-log template has one with blanks) that says: - who you are and how to contact you; - what you collect (email, the entries and files they add, sign-in records) and why; - your legal basis (for example, a contract with the user, or a legal duty such as keeping tax records); - who sees it (you, your accountant) and that Page Lemon hosts it as your processor; - how long you keep it (next section); - their rights and how to use them, and the data protection authority they can complain to (the ICO in the UK). When you turn the app on, you confirm that the notice is published. ## 4. Retention Choose how long you keep the records of users who leave or whom you remove, and say it in your notice. Keep nothing longer than you need. - **The tax-records case (UK):** if users' entries are business records, such as expense receipts, tax rules may require you to keep them. Sole traders in the UK generally keep records for at least 5 years after the 31 January online tax return deadline of the tax year; limited companies generally for 6 years from the end of the financial year. Check the period that applies to you. - **When a user leaves**, their entries and files are erased at once, except records you have placed under a legal hold because the law makes you keep them; those become unreadable to the user and are erased when the hold ends. Tell users about this in your notice. ## 5. Rights requests Users can ask you for a copy of their information, to correct or delete it, or to stop using it. Answer within a month (UK and EU). - **A copy:** export their rows and files from the Dashboard's Apps tab. - **Deletion:** a user can leave and delete their data from their account block; you can also remove them and erase their records in the Dashboard. - **Everything about them across sites:** they can ask Page Lemon directly through its privacy page; Page Lemon checks it's them and passes on what concerns your site. Never send a user's data to anyone who hasn't proved they are that user. ## 6. Selling subscriptions Paid memberships run on **your own Stripe account** (on every paid plan: https://pagelemon.com/pricing); Page Lemon takes a small platform fee per payment and never holds the money. - Show the price, what it includes, how often it renews and how to cancel, before the user pays. - Users cancel and manage their card in the account block (Stripe's customer portal on your account). - **Consumers in the UK and EU** generally have 14 days to withdraw from an online subscription. If the service starts at once, they may owe for what they used; tell them before they pay. You handle refunds in Stripe. - Subscription renewal rules (reminders, easy cancellation) are tightening in the UK and EU: keep cancelling as easy as joining. ## 7. VAT and buyers in your own country - **You** charge and account for any VAT or sales tax on your memberships; Page Lemon doesn't. - By default your site sells **only to buyers in your own country** (the card's country and the billing address must both match yours). That keeps you to one country's tax rules. Selling digital services to consumers in other countries can bring their VAT rules in from the first sale (in the EU through the One Stop Shop). - If you aren't registered for VAT, check the registration threshold where you are and watch your takings against it. ## 8. When something goes wrong - **A user's data may have leaked** (a wrong person saw an entry, a device was lost): assess it, and in the UK and EU report a breach that risks people's rights to the data protection authority within 72 hours, and tell the users affected if the risk is high. Page Lemon tells you without delay if a breach on its side affects your users, and helps you. - **Sign everyone out** from the Dashboard if you suspect misuse; remove users who shouldn't have access. - **A dispute or chargeback** closes that user's access until you decide; answer it in Stripe. - **Page Lemon may pause** a user site that breaks the Acceptable Use Policy while it looks into it, and tells you why. ## 9. Not legal advice Privacy and data for people: https://pagelemon.com/docs/privacy-and-data. Setup guide: https://pagelemon.com/agents/member-app. This page gives general information to help you run a user site responsibly. It is not legal, tax or accounting advice and doesn't cover every country or business. Page Lemon's own terms are https://pagelemon.com/terms, https://pagelemon.com/privacy and https://pagelemon.com/dpa. For decisions that matter, ask a solicitor, accountant or tax adviser.