Privacy Policy

1. Scope

This policy covers the studio, the marketing site, account and billing records, uploaded material, generated sites, form submissions, and support messages. A customer’s published site may have its own privacy notice; the customer is the controller of the content and submissions on that site, and we process them on the customer’s behalf.

2. Data we collect

• Account data: name, email address, password hash, workspace name, email verification status, login timestamps, and authentication version.
• Site material: company name, notes, brand words, colour preferences, reference URLs, uploaded documents, photos, logo, and the generated site specification.
• Generation data: prompts, model output used to build the draft, edit proposals, warnings, and the design fingerprint needed to reproduce a draft.
• Billing data: plan status, Stripe customer and subscription identifiers, current period end, and download purchase records. We do not store card numbers; Stripe handles payment details.
• Domain data: domain name, DNS records shown by the host, verification status, and TLS status. We do not store registrar credentials.
• Form submissions: the name, email address, message, and a truncated IP hash for the contact form on a published site.
• Technical data: request timestamps, error codes, tenant/site identifiers, and security events. We do not intentionally log full request bodies or card data.

3. How we use data

• To create and secure accounts, verify email addresses, and reset passwords.
• To generate, render, preview, publish, download, and edit your site.
• To process subscriptions and one-time source purchases through Stripe.
• To store and deliver contact-form submissions to the site owner.
• To attach domains, verify DNS/TLS, and keep canonical URLs correct.
• To prevent abuse, enforce limits, debug failures, and improve the product.
• To comply with legal obligations and respond to lawful requests.

4. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract for account, hosting, and payment processing; legitimate interests for security, abuse prevention, and product improvement; consent where we ask for it; and legal obligation where records must be retained. You can withdraw consent at any time without affecting prior processing.

5. AI processing

Uploaded notes, extracted document text, reference-site traits, brand signals, and the prompts needed to produce the draft are sent to DeepSeek to generate site copy and design decisions. Do not upload material that you are not allowed to send to a third-party AI provider, and do not upload special-category data or secrets. Generated output is reviewed by the customer before publishing.

6. Providers we use

Providers process data under their own terms and data-processing agreements. We share only what is needed for the relevant function. We do not sell personal data.

7. Cookies and local storage

• op_session: an essential, HttpOnly session cookie that keeps you signed in. It lasts up to 30 days and is revoked by password changes or “sign out everywhere”.
• Cloudflare Turnstile: may set a challenge cookie when the widget is enabled on sign-in, sign-up, or a contact form.
• Stripe: Stripe may set cookies during Checkout or the Billing Portal on its own domain.

We do not use advertising or cross-site tracking cookies. See the cookie policy for details.

8. Retention

• Account and site data are kept while the site or account exists.
• Uploaded material is deleted with the site or account, subject to backup expiry.
• Edit prompts are redacted after 90 days; the resulting draft and version history remain.
• Form submissions and audit events are deleted after 365 days.
• Stripe event records are kept for replay protection and deleted after 365 days.
• Billing records may be retained longer where tax, accounting, fraud-prevention, or legal rules require it.

9. Security

Passwords are hashed with scrypt. Sessions are signed with HMAC-SHA256 and carry an auth version so password changes revoke older sessions. Reset and verification tokens are stored only as SHA-256 hashes. Tenant data is filtered by workspace, uploads are type-checked and size-limited, SVG logos are sanitised, and published output is escaped. No system is perfectly secure; report suspected issues to support@fastwebsite.app.

10. International transfers

Our providers may process data outside your country. Where required, transfers rely on appropriate safeguards such as standard contractual clauses or an adequacy decision. Contact us for the current subprocessor locations.

11. Your rights

Depending on your location, you may request access, correction, export, deletion, restriction, or objection, and you may withdraw consent. Signed-in users can export their workspace as JSON and delete their account from the account page. We may need to verify your identity and may retain records required by law. You may also complain to your local data protection authority.

12. Children

The service is for businesses and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

13. Changes

We may update this policy to reflect changes in the service, providers, or law. The date at the top of the page changes when we do. Material changes will be announced by email or in the dashboard.

14. Contact

Privacy questions and requests: support@fastwebsite.app.