Privacy Notice

We use personal information to operate your account, provide paid website-building services, combat fraud and meet legal obligations. The controller and contact information are shown above.

1. Information we handle

Account name, email address, verified mobile number, Descope user identifier, subscription status and payment-provider transaction identifiers, website content you enter, security and audit events, support enquiries and technical request metadata. We do not store payment card numbers in our application; payments are processed by the selected provider (PayPal, Stripe or GoCardless).

2. Purposes and lawful grounds

Account creation and service delivery (contract); preventing account takeovers, abuse and chargeback fraud (legitimate interests); financial recordkeeping and regulatory requests (legal obligation); and optional marketing communications only when lawfully permitted. Essential service notices are separate from optional marketing. Website marketing requires recorded double opt-in and offers unsubscribe links. Account preferences default off. This application loads no optional analytics or advertising tracker; aggregate server page counters do not identify visitors.

AI, customer records and hosted websites

AI prompts and output may be processed by the configured AI provider. Do not submit credentials or sensitive personal information. Outputs are drafts requiring human review. Business enquiries, bookings, shop orders and consent records are held for the website owner to operate their business; that owner must provide their own appropriate privacy and sales notices. Store payments require separately verified Stripe Connect merchant onboarding. We do not claim to be the merchant of every customer shop.

3. Processors and sharing

Descope supplies identity verification with the enabled Google/Facebook OAuth providers, Cloudflare hosts the application and data, PayPal, Stripe and GoCardless process the selected payment method, the configured email service sends essential notices, and Cloudflare Workers AI processes prompts when AI is activated. The operator must complete processor agreements and the relevant international-transfer assessment before launch. These providers may process information outside the UK subject to applicable safeguards. Your published website details are intentionally public while your page is live.

4. Retention and security

Account and website content remain while your account operates. General event logs are kept for up to 90 days; resolved support requests for up to one year; financial and accepted-contract records normally for six years, subject to legal retention requirements and disputed transactions. Account deletion requests may not erase transaction records that must legally be retained. Access controls, HTTPS, least-privilege credentials and event logs protect stored information; no service is risk-free.

5. Your rights

You may request access, correction, deletion (where applicable), restriction, objection, and data portability by writing to the privacy contact shown above. You can complain to the Information Commissioner's Office. We will handle requests under the UK GDPR and applicable laws.

6. Cookies and browser storage

The authentication service uses session storage or cookies needed to sign you in. Anti-bot controls may use necessary technical identifiers. Optional analytics and advertising trackers are not enabled. They would require applicable consent before introduction. Privacy preferences record your optional choices. Installing the PWA caches public assets and offline information only; account details, private drafts, customer records and payment responses are not cached.