Team Members and Roles
Access is organised as User → Organization → Site. You do not grant access to a site; you add somebody to the organization the site belongs to. Moving a site between organizations is therefore how you change who can see it.
Where it is. Every organization has its own pages — its Sites, its Team and its Billing — and the team is on its own: open the organization (the menu on the left lists the ones you belong to, and every site page names its organization above the title), then Team.
The four roles
| Role | Can |
|---|---|
| Viewer | Read every screen. Change nothing. |
| Member | Everything a viewer can, plus triage — resolving errors, updating lead statuses — and exporting data as CSV. |
| Admin | Everything a member can, plus site settings, integrations, erasing a visitor's data, and managing viewers and members. |
| Owner | Everything, plus billing, deleting the site, rotating the API key, and adding or removing other owners. |
Two of those lines are worth stating on their own.
Exports are gated at member, and they are the only read that is. Every other screen hands over one page at a time; an export hands over the table. A lead's raw form fields need admin on top of that — the rest of a lead is what the product is for, and that column is the unaudited remainder of whatever the form contained.
Erasing a visitor is admin; exporting that visitor's data is member. Copying data and destroying it irreversibly are not the same act, and making the safe half as hard as the destructive half is how a shop ends up answering a subject access request by deleting the subject.
Inviting somebody
Open the organization's Team page, type the address into Invite by email, pick the role and press Invite. The invitation is a single-use link that expires; what is stored is a hash of it, never the link itself, so a database dump hands out nothing usable.
You must confirm your own email address before you can invite anyone. New accounts cannot sign in until they confirm, so for them this is already true. Older unconfirmed accounts can still sign in, but cannot invite. Sending mail from our domain to somebody else's inbox on the say-so of an address nobody has proved they can read is the action worth blocking. Somebody you invite who registers through the invitation link is confirmed at once — the invitation itself reached their inbox.
An admin cannot invite an owner. That is the owner's own privilege.
Handing over an organization
Owners can transfer ownership to another member, and can leave an organization once somebody else owns it. What is not possible is leaving an organization with no owner at all — everything that can delete or bill an organization assumes somebody is answerable for it, and an ownerless one keeps its sites and its data and can never be removed.
The same rule decides what happens when an account is closed: an organization dies with the last of its owners, and one with a surviving owner is left completely alone. The deletion preview names both lists before anything happens, because the blast radius reaches past the person pressing the button.
Personal workspaces
Every account gets one when it registers. It behaves like any other organization except that it cannot be deleted while its owner exists — deleting the account is what removes it, and doing it the other way round would leave the person with nowhere to put a site.
Organizations
Every organization has its own pages: Sites (its home — every site with whether it is still collecting, last week's numbers, and the ones that need attention first), Team, Settings and Billing. The menu on the left of your account lists the organizations you belong to, and every site page names its organization above the title.
Settings → General holds the organization's name, which an owner or an admin can change.
Organization digest
ONE letter about every shop in the organization, sent to the address you give and ranked by what needs you first. It is written by the AI writer, so it is sent only while that is switched on for the service. It is set on any of the organization's sites, in Settings → AI, below that site's own digest — which goes to whoever manages that one shop. Leave the address empty to stop it. An owner or an admin can set it — but not an admin who sees only some of the organization's sites, because the letter quotes every one of them.
AI clients
Settings → General → Connected AI clients is the owner's. A connected AI client can only read your shops unless you allow changes there; allowed, it may add or update a webhook destination for new leads, carts and orders, and only to a host on the list. What your own keys and connections read is on your profile, under AI & keys. See Connect your AI client.
Activity
Settings → Activity, the owner's: who deleted, rotated a key, invited or changed a role in this organization — the latest entries, newest first.
Deleting an organization
Settings → General → Delete this organization, for an owner of a team organization: it takes every site in it and everything they collected, and asks you to type its name first. A personal organization is not deleted here — it goes with its owner's account.