Privacy policy

Draft for the site owner: this text is a starting template, not legal advice. Have a lawyer in your country review it, fill in the company name and contact email (COMPANY_NAME, CONTACT_EMAIL), then set LEGAL_REVIEWED=1 to hide this notice.

Last updated 16 October 2026. [company name] runs Site builder and is responsible for the personal data described here. Questions: [contact email].

What we collect

• Account: your email address and a scrambled (hashed) version of your password. We cannot read your password. If you sign in with Google, we receive your email address and Google's account ID for you (not your Google password), and store only those two.
• Your sites: the descriptions, contact details and text you give us, the site content we generate, and its saved versions.
• Photos: pictures you upload. We re-encode them, which removes location and camera data stored inside the file.
• API keys: if you add your own AI key, we store it encrypted and never show it again.
• Messages from your site visitors: the name, email address and message they type into your contact form. We store them for you and email them to you.
• Billing: handled by our payment provider. We receive your plan status and a customer reference, not your card number.
• Technical data: your IP address and login attempts (to prevent abuse), and standard server logs.

Cookies

We use only the cookies the service needs: one to keep you logged in, and a short-lived one that remembers what you typed on the home page until you finish signing up. We do not use advertising or tracking cookies, and customer sites do not receive your login cookie.

Why we use it

To provide the service you asked for: creating and publishing your site, sending account and contact-form emails, taking payment, preventing abuse, and keeping the service secure. We do not sell your data.

Who else handles it

• AI providers (for example OpenAI, Google, Anthropic or DeepSeek) receive the description and details you submit so they can write your site text, and the picture prompts when AI pictures are made. If you use your own key, your agreement with that provider applies.
• Hosting (DigitalOcean) stores the data on our servers.
• Payments (Stripe) process subscriptions.
• Email (Resend) delivers our emails.

These providers may be located in other countries, so your data can be transferred abroad.

What visitors to your site should know

Your published site is public. If you use the contact form, visitors’ messages come to you; you are responsible for how you use their details.

How long we keep it

While your account is open. Deleted sites are removed from our systems; backups are kept for up to about two weeks. You can delete your account yourself from the dashboard ("Delete my account"): this removes your sites, photos, saved versions, messages and keys at once, and cancels any paid subscription. Payment records stay with our payment provider as the law requires.

Your rights

You can delete your account yourself in the dashboard. You can also ask us to give you a copy of your data or correct it: email [contact email]. Depending on where you live, you may also have the right to complain to a data protection authority.

Security

Passwords are hashed, keys are encrypted, connections use HTTPS, and each customer can only reach their own data. No system is perfectly secure; tell us at once if you notice a problem.

Children

The service is not meant for people under 18, and we do not knowingly collect their data.

Changes

If we change this policy in an important way we will tell you by email or in the dashboard.