Privacy Policy

1. Who is responsible for your data

[Company legal name] ([Registered address]) is the controller of personal data about our customers (account holders). Contact us at [contact email]. [Data protection contact / ICO registration number — to be added.]

Enquiries sent through customers' websites: the business that owns the website is the controller of that data; we process it on their behalf to store it and alert them. [Data processing terms for customers — to be added.]

2. What we collect

• Account: name, email address, password (stored only as a secure hash), sign-in records.
• Billing: plan, payment status, invoices. Card details are handled by Stripe — we never receive full card numbers.
• Your websites: business details, text, photos and settings you add, and the AI-generated content.
• Domains: the registrant name, email, phone and address you give, which are passed to the domain registrar.
• Enquiries (leads): what visitors type into your website's form (for example name, phone, email, postcode, message, photos).
• Online orders (if a business takes payments): the customer's name, email, phone, delivery address, notes and what they ordered. Card details go only to Stripe. Orders that are never paid are deleted after 7 days.
• Usage: AI generations and credits used; anonymous visit and button-tap counts for your websites (no cookies or personal identifiers).
• Security: IP addresses are used briefly, in hashed form, for rate limiting and abuse prevention.

3. Why we use it (lawful bases)

• To provide the service you signed up for (contract).
• To take payments and keep accounting records (contract; legal obligation).
• To keep the service secure and prevent spam and fraud (legitimate interests).
• To send service emails such as receipts, password resets and lead alerts (contract). We don't send marketing emails without consent.
• Optional analytics/marketing cookies only with your consent (see the Cookie Policy).

4. Who we share it with

Service providers who process data for us under contract:

• Stripe — payments and invoices; for businesses taking payments, Stripe processes their customers' payments in the business's own Stripe account
• Anthropic — AI generation (the business details and instructions you provide)
• Resend — sending emails; Twilio — SMS/WhatsApp alerts if you turn them on
• Vercel — hosting; Supabase — database and file storage
• Domain registrar and DNS providers — when you buy or connect a domain
• Cloudflare — spam protection on website forms (if enabled); Google Fonts — fonts on published websites

[Confirm the final list of processors, their locations and the safeguards for international transfers (e.g. UK IDTA / adequacy).]

5. How long we keep it

• Account, website and lead data: while your account is open. Deleting your account deletes them.
• Payment and invoice records: kept for the period required by law (typically 6 years) after which they are deleted. [Confirm.]
• Email delivery logs: 30 days. Security rate-limit records: hours.

6. Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict some uses, and ask for a copy in a portable format. You can delete your account yourself in Settings. To exercise your rights, contact [contact email]. You can also complain to the Information Commissioner's Office (ico.org.uk).

7. Security

Passwords are hashed, sessions use secure cookies, data is encrypted in transit, access is restricted, and staff don't view your website content or leads unless needed to help you or investigate abuse.

8. Children

The service is not intended for anyone under 18.