Privacy Policy

This Privacy Policy explains how Startspot ("we", "us") collects, uses and protects personal data when you use our website-builder service (the "Service"). We act as the data controller for your account data, and as a processor for the personal data contained in the sites you build and the form submissions they receive.

We collect the following categories of data:

• Account data — your name, email address and password (stored only as a secure hash).
• Content data — the descriptions, text, images, logos and settings you provide, and the websites we generate for you.
• Form submissions — data that visitors send through forms on your published sites (for example a name, email and message), which we store on your behalf so you can read it in your dashboard.
• Usage and technical data — log data, IP address, device and browser information, and basic analytics needed to run and secure the Service.
• Cookies — a session cookie and a CSRF-protection cookie required for the app to work.

We use personal data to: provide and operate the Service; generate, host and serve your sites; capture and show you form submissions; secure the Service and prevent abuse; communicate with you about your account; and improve the Service.

We do not sell your personal data, and we do not use your content to train third-party AI models.

To generate a site we send the relevant description and settings to our AI provider (Anthropic) to produce copy, designs and logos. We send only what is needed for the task and do not include your password or unrelated personal data.

Where the GDPR applies, we process personal data on these bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure and improve the Service and, unless you opt out, to showcase published sites); your consent where required; and compliance with legal obligations.

We share personal data only with service providers that help us run the Service, under appropriate contracts:

• Anthropic — AI generation.
• Cloudflare — custom-domain TLS and form bot protection.
• Cloud object storage (S3-compatible) — asset hosting.
• Hosting, database and email providers used to operate the Service.

We may also disclose data where required by law or to protect our rights, users or the public.

Some providers may process data outside your country, including outside the EEA. Where that happens we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

We keep account and content data for as long as your account is active. When you delete a site, a design or your account, we delete the associated content and generated assets within a reasonable period, except where we must retain limited data to comply with the law or resolve disputes.

You control form submissions on your sites and can delete them at any time.

Subject to applicable law, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can exercise many of these directly in the app (editing your profile, deleting sites or your account), or by contacting us.

If you are in the EEA/UK, you also have the right to lodge a complaint with your local data-protection authority.

We use technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, access controls and validated, sandboxed rendering of generated content. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The Service is not intended for children under the age of digital consent, and we do not knowingly collect their personal data.

We may update this Policy from time to time; material changes will be announced in the app or by email.

For any privacy question or request, contact us at privacy@startspot.app.