Privacy Policy
Last updated September 3, 2026
Working draft. This document has not yet been reviewed by a lawyer and contains bracketed placeholders (entity name, jurisdiction, contact addresses). Do not rely on it for a public launch until it has been completed and reviewed.
This policy explains what personal data [LEGAL ENTITY NAME] collects when you use websmith, why, and your rights over it.
Data we collect
- Account data: your email address and, if you provide it, your name.
- Workspace and project data: the sources, briefs, themes, and websites you generate, and workspace/member settings.
- Usage and billing data: builds run, supercoins spent and granted, plan and subscription status, invoices, and payment records. Card details are handled entirely by Stripe — we never see or store them.
- Technical data: IP address, browser type, and server logs, used for security, abuse prevention, and debugging.
- Provider keys you choose to store for “bring-your-own-key” builds are encrypted at rest.
Why we use it
Where the GDPR or similar laws apply, our legal bases are performance of our contract with you (providing the Service and billing) and our legitimate interests (security, abuse prevention, product improvement). We do not sell personal data and do not use it for third-party advertising.
- To provide the Service — run builds, store your projects, show your dashboard.
- To bill you and prevent fraud and abuse.
- To provide support and send service messages (sign-in codes, build results, low-balance and billing notices).
- To meet legal and tax obligations.
Sub-processors
We use the following providers to operate the Service. Each processes personal data only as needed to provide its function and under its own data-protection commitments:
- Neon — managed PostgreSQL database (United States).
- Cloudflare — application hosting and object storage (R2) for generated files.
- Upstash — managed Redis used as the build job queue.
- Resend — transactional email delivery.
- Stripe — payment processing and subscription billing.
- Vercel — hosting for the web application.
International transfers
Our infrastructure is primarily in the United States. If you are outside the US, your data will be transferred to and processed there. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.
Retention
We keep account and project data while your account is active and for a short grace period after deletion so it can be restored if you change your mind. Billing and tax records are kept for as long as the law requires (typically up to seven years). Server logs are kept for a limited period for security and debugging.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can delete your account at any time; to make any other request, email privacy@[yourdomain]. We will respond within the time the applicable law requires.
If you are in Canada, you may also contact the Office of the Privacy Commissioner of Canada. If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority.
Cookies
We use a single essential cookie to keep you signed in. We do not use advertising or cross-site tracking cookies. If we add product analytics we will use a privacy-preserving, cookieless tool or add a consent notice.
Children
The Service is not directed to children and is not intended for anyone under 18.
Changes
We may update this policy; material changes will be notified by email or an in-app notice, and the “last updated” date above will change.
Contact
Privacy questions and requests: privacy@[yourdomain].