Privacy policy

This policy explains how innitweb, of 124 City Road, London, EC1V 2NX ("we", "us"), uses personal data when you use innitweb. We are the "controller" of the personal data described in this policy, under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Contact us about anything in this policy at support@innitweb.com.

• Account details: your email address, and either a password (stored only as a secure hash by our authentication provider) or the basic profile details Google shares with us if you choose to sign in with Google.
• Your sites: the text, images, settings and layouts you create and save, including images you upload.
• Earlier versions of your site: while you are signed in we keep automatic copies of your site as you work, so you can look at an earlier one, go back to it, or copy it as a new site. They contain whatever is in your site, including any personal details you typed into it. Work that is only in your browser, because you are not signed in, is not copied to us.
• Payment records: when you pay, Stripe collects your card details and any billing information on its own secure pages. We keep a record that a payment happened (an identifier, the amount, the date and your account), not your card number.
• Technical data: your IP address, browser and device information, and server logs, which our hosting and infrastructure providers create to deliver the service and keep it secure.
• Page-view statistics: when you visit innitweb's own pages (the home page, the templates, the builder and these policies) our analytics providers, Vercel and Cloudflare Web Analytics, record which page was visited, the page you came from, and your country, browser and device type, plus how quickly the page loaded. They don't use cookies, don't build a profile of you and don't follow you across other websites. It covers innitweb only: the sites you build and download, and any site you publish, don't include it.
• Product usage counts: when you use the builder we count a short, fixed list of actions, such as a template being opened or a site being saved. See "Counting how innitweb is used" below.
• Messages: anything you send us when you contact us, and our replies.
• Newsletter: if you sign up for our occasional updates, your email address, whether you signed up from your account or from our public form, and when you confirmed it.
• Data in your browser: we use your browser's local storage to keep your work in progress, your sign-in session, your theme choice and a template you've picked. These are essential to the service. We don't use advertising cookies or trackers, and our page-view statistics don't use cookies. If that changes we'll update this policy and ask for consent where the law requires it.

We don't intentionally collect special-category data (like health or political views). Please don't put it in your account details.

On innitweb's own pages we use Cloudflare Web Analytics, alongside Vercel's page-view statistics, to see how many people visit, which pages they read, where they arrive from, which countries and kinds of device they use, and how fast the pages load for them.

innitweb also uses Vercel Web Analytics, which counts page views without cookies.

• They use no cookies and store nothing on your device.
• They don't build a profile of you, don't track you from one website to another and aren't used for advertising.
• The figures are totals. We read them as counts of visits, not as a list of people.
• They cover innitweb's own pages only. The sites you build and download, and any site you publish, don't include them.

You can switch off page-view counting for yourself by turning on Do Not Track or Global Privacy Control in your browser, or by using a browser or extension that blocks analytics scripts.

To see what works and what breaks, we keep our own simple counts of how the builder is used. Each count is one line in our database saying that one of these things happened, and when:

• a template was opened from the templates page;
• the builder was opened (and which template it started from, or that it started blank);
• a site was saved, a checkout was started, a download finished, or hosting was started;
• one of a short list of builder features was used, such as 3D, motion, the section library or the price list;
• something went wrong while saving, downloading or paying, recorded only as one of three fixed reasons;
• the home, templates or pricing page was viewed. For these, and for the builder being opened or a checkout being started, we add one to a daily total for that step, together with a rough source (direct, a search engine, a social site, another site or our own pages) and whether the screen is phone-sized or larger. Your browser works out that rough source itself; the address of the page you came from is never sent to us or kept, and these totals are not linked to you or to each other.

What we don't do:

• We set no cookies and use no local storage, session storage or any other identifier on your device for this.
• We don't record your IP address, and we don't read or record anything you write or build. No text, pictures, page content or error messages are ever included.
• Counts made while you're signed out, such as a template being opened on the templates page, carry nothing that identifies you.
• Counts made while you're signed in and working in the builder or your account are linked to your account, only so that we can run and improve the service, for example to see how many people who save a site go on to publish it. We don't use them for advertising and we don't share them.

Legal basis: our legitimate interests in running and improving the service. We keep these counts for 400 days and then delete them. If you delete your account, the counts linked to it are deleted too.

To opt out, turn on Do Not Track or Global Privacy Control in your browser. When either is on, innitweb sends no usage counts at all. You can also write to us at support@innitweb.com and we'll delete the counts linked to your account.

• To create and run your account and provide the builder, downloads and any hosting you buy. Legal basis: contract.
• To take payments, issue receipts and keep accounting records. Legal basis: contract and legal obligation.
• To keep the service secure, prevent fraud and abuse, fix faults and improve how the service works. Legal basis: our legitimate interests in running a safe, reliable service.
• To see which parts of innitweb are used, through cookie-free page-view statistics and our own simple usage counts, so we can fix faults and improve the service. Legal basis: our legitimate interests.
• To answer your questions and complaints. Legal basis: contract and legitimate interests.
• To comply with the law, and to respond to lawful requests from authorities. Legal basis: legal obligation.

We send our newsletter (occasional news about new features) only to people who have signed up and confirmed through a link we email to them. Legal basis: consent. Every issue has an unsubscribe link, and you can withdraw your consent at any time. We don't send other marketing emails.

We use other companies to provide parts of the service. They only handle your data on our instructions, or under their own legal duties:

• Supabase: our database, sign-in and file storage.
• Stripe: payment processing, and identity and bank checks if you take payments on a hosted site or sell templates on the High Street through a developer account.
• Vercel: hosting and delivery of our own website, and cookie-free page-view statistics on our own pages.
• Cloudflare: cookie-free Web Analytics on our own pages, and hosting and delivery of a site you buy hosting for.
• Resend: sends some of our emails. It receives the recipient's email address and the content of the message. We use it to send the newsletter confirmation email and the newsletter itself to people who signed up (it also keeps that mailing list and handles unsubscribes), and to email the owner of a hosted site when a form on it is submitted (the owner's email address, the site's name and a link to their inbox; the visitor's answers are not in that email). Resend keeps its own record of the emails it sends.
• Google: only if you choose to sign in with Google.
• Professional advisers, insurers, and authorities or courts where we're legally required or need to protect our rights.

If we ever sell or restructure our business, personal data may be transferred to the new owner, who must use it in line with this policy.

Some of the providers above process personal data outside the UK, including in the United States. Where they do, we rely on a UK adequacy decision or on approved safeguards, such as the UK's International Data Transfer Agreement or Addendum, so your data receives an equivalent level of protection.

If you use our hosting, personal data that visitors or customers give through your site (for example a contact form) is data that you are responsible for as the controller. We are your processor: we handle it only to provide the hosting, on the terms in our terms and conditions, and we don't use it for our own purposes. You must tell your visitors how you use their data, for example in your own privacy policy.

• Account and site data: for as long as your account is open, and we delete it when you ask us to (email support@innitweb.com), apart from the records described below. If a hosting subscription ends, your hosted site stays online for 7 days and is then taken offline and its hosted copy deleted; the site saved in your account is not deleted by that and stays for as long as your account is open.
• Newsletter sign-ups: your email address and sign-up record until you ask us to delete them. Unsubscribing stops the emails.
• Payment and accounting records: for 6 years, because UK tax and company law requires it.
• Earlier versions of your site: up to 20 recent automatic copies plus the last one of each day for 14 days, and the "Before going back" copy made when you go back to an earlier version for 30 days. You can clear all the earlier versions of a site yourself at any time, from Earlier versions in the editor's Site tab. They are deleted with the site when it is permanently deleted (see above), or with your account.
• Usage counts (the simple counts described above): 400 days.
• Support messages and logs: only as long as needed to deal with the matter and to keep the service secure.
• Backups: deleted data may remain in routine backups for a short time before it's overwritten.

Under UK law you can ask us to:

• give you a copy of your personal data;
• correct anything that's wrong;
• delete your data (unless we have to keep it, for example payment records);
• restrict how we use it, or object to us using it based on our legitimate interests;
• give you your data in a portable format;
• stop using it where we rely on your consent, which you can withdraw at any time.

Email support@innitweb.com to use any of these rights. We'll reply within one month and won't charge you unless a request is clearly unreasonable. We may need to check who you are first.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by phone on 0303 123 1113.

We protect personal data with measures such as encryption in transit, per-account access controls so one account can't read another's data, and keeping payment details with Stripe rather than on our systems. No online service can promise perfect security, so please use a strong, unique password and tell us straight away if you think your account has been accessed.

innitweb isn't intended for anyone under 18, and we don't knowingly collect data from children. If you think a child has given us data, contact us and we'll delete it.

We may update this policy from time to time. The date at the top shows the latest version. If a change matters to you, we'll tell you by email or in the product before it takes effect.