Team Members and Roles
Access is organised as User → Organization → Site. You do not grant access to a site; you add somebody to the organization the site belongs to. Moving a site between organizations is therefore how you change who can see it.
The four roles
| Role | Can |
|---|---|
| Viewer | Read every screen. Change nothing. |
| Member | Everything a viewer can, plus triage — resolving errors, updating lead statuses — and exporting data as CSV. |
| Admin | Everything a member can, plus site settings, integrations, erasing a visitor's data, and managing viewers and members. |
| Owner | Everything, plus billing, deleting the site, rotating the API key, and adding or removing other owners. |
Two of those lines are worth stating on their own.
Exports are gated at member, and they are the only read that is. Every other screen hands over one page at a time; an export hands over the table. A lead's raw form fields need admin on top of that — the rest of a lead is what the product is for, and that column is the unaudited remainder of whatever the form contained.
Erasing a visitor is admin; exporting that visitor's data is member. Copying data and destroying it irreversibly are not the same act, and making the safe half as hard as the destructive half is how a shop ends up answering a subject access request by deleting the subject.
Inviting somebody
Settings → Team → Invite. The invitation is a single-use link that expires; what is stored is a hash of it, never the link itself, so a database dump hands out nothing usable.
You must confirm your own email address before you can invite anyone. It is the one thing an unconfirmed account cannot do. Sending mail from our domain to somebody else's inbox on the say-so of an address nobody has proved they can read is the one action worth blocking — and notably, signing in is not blocked, because a mail relay being down would otherwise lock out every new customer at once.
An admin cannot invite an owner. That is the owner's own privilege.
Handing over an organization
Owners can transfer ownership to another member, and can leave an organization once somebody else owns it. What is not possible is leaving an organization with no owner at all — everything that can delete or bill an organization assumes somebody is answerable for it, and an ownerless one keeps its sites and its data and can never be removed.
The same rule decides what happens when an account is closed: an organization dies with the last of its owners, and one with a surviving owner is left completely alone. The deletion preview names both lists before anything happens, because the blast radius reaches past the person pressing the button.
Personal workspaces
Every account gets one when it registers. It behaves like any other organization except that it cannot be deleted while its owner exists — deleting the account is what removes it, and doing it the other way round would leave the person with nowhere to put a site.