Privacy policy

This policy explains how [Company name] (company number [Company number]), registered at [Registered address] ("we", "us"), uses personal data when you use innitweb. We are the "controller" of the personal data described in this policy, under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Contact us about anything in this policy at [support email].

• Account details: your email address, and either a password (stored only as a secure hash by our authentication provider) or the basic profile details Google shares with us if you choose to sign in with Google.
• Your sites: the text, images, settings and layouts you create and save, including images you upload.
• Payment records: when you pay, Stripe collects your card details and any billing information on its own secure pages. We keep a record that a payment happened (an identifier, the amount, the date and your account), not your card number.
• Technical data: your IP address, browser and device information, and server logs, which our hosting and infrastructure providers create to deliver the service and keep it secure.
• Messages: anything you send us when you contact us, and our replies.
• Data in your browser: we use your browser's local storage to keep your work in progress, your sign-in session, your theme choice and a template you've picked. These are essential to the service. We don't currently use advertising or analytics cookies or trackers; if that changes we'll update this policy and ask for consent where the law requires it.

We don't intentionally collect special-category data (like health or political views). Please don't put it in your account details.

• To create and run your account and provide the builder, downloads and any hosting you buy. Legal basis: contract.
• To take payments, issue receipts and keep accounting records. Legal basis: contract and legal obligation.
• To keep the service secure, prevent fraud and abuse, fix faults and improve how the service works. Legal basis: our legitimate interests in running a safe, reliable service.
• To answer your questions and complaints. Legal basis: contract and legitimate interests.
• To comply with the law, and to respond to lawful requests from authorities. Legal basis: legal obligation.

We don't currently send marketing emails. If we start to, we'll ask for your consent first and you'll be able to opt out at any time.

We use other companies to provide parts of the service. They only handle your data on our instructions, or under their own legal duties:

• Supabase: our database, sign-in and file storage.
• Stripe: payment processing, and identity and bank checks if you take payments on a hosted site.
• Vercel: hosting and delivery of our website and (if you buy hosting) your site.
• Google: only if you choose to sign in with Google.
• Professional advisers, insurers, and authorities or courts where we're legally required or need to protect our rights.

If we ever sell or restructure our business, personal data may be transferred to the new owner, who must use it in line with this policy.

Some of the providers above process personal data outside the UK, including in the United States. Where they do, we rely on a UK adequacy decision or on approved safeguards, such as the UK's International Data Transfer Agreement or Addendum, so your data receives an equivalent level of protection.

If you use our hosting, personal data that visitors or customers give through your site (for example a contact form) is data that you are responsible for as the controller. We are your processor: we handle it only to provide the hosting, on the terms in our terms and conditions, and we don't use it for our own purposes. You must tell your visitors how you use their data, for example in your own privacy policy.

• Account and site data: for as long as your account is open. If you close it or a hosting subscription ends, we keep your site for 30 days so you can come back or take your code, then delete it.
• Payment and accounting records: for 6 years, because UK tax and company law requires it.
• Support messages and logs: only as long as needed to deal with the matter and to keep the service secure.
• Backups: deleted data may remain in routine backups for a short time before it's overwritten.

Under UK law you can ask us to:

• give you a copy of your personal data;
• correct anything that's wrong;
• delete your data (unless we have to keep it, for example payment records);
• restrict how we use it, or object to us using it based on our legitimate interests;
• give you your data in a portable format;
• stop using it where we rely on your consent, which you can withdraw at any time.

Email [support email] to use any of these rights. We'll reply within one month and won't charge you unless a request is clearly unreasonable. We may need to check who you are first.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by phone on 0303 123 1113.

We protect personal data with measures such as encryption in transit, per-account access controls so one account can't read another's data, and keeping payment details with Stripe rather than on our systems. No online service can promise perfect security, so please use a strong, unique password and tell us straight away if you think your account has been accessed.

innitweb isn't intended for anyone under 18, and we don't knowingly collect data from children. If you think a child has given us data, contact us and we'll delete it.

We may update this policy from time to time. The date at the top shows the latest version. If a change matters to you, we'll tell you by email or in the product before it takes effect.