What data we hold, and where

This is the readable version of the privacy policy, which is the document that actually governs it. Where the two differ, the policy wins.

What we hold#

Roughly this, and it is all there because a step in the product needs it.

• Your contact and business details, and the owner details for a domain we register for you.
• Your quiz and brief answers, plus anything you uploaded.
• Your order, payment and subscription state - what you bought and whether it is current.
• Your sign-in record - a one-way hash of the magic link, or just your email address if you used Google.
• What you typed to the editor, so it can carry on from where you left it.
• A salted hash of your IP address for rate limiting, and a note of where your first visit came from.
• Enquiries sent through a form on your site, kept for twelve months and then deleted. That is your visitor's information rather than yours: we store it so it can be delivered and so a double submission can be spotted, and we hold a salted hash of their IP address rather than the address itself.

What we never hold#

The one people ask about first.

• Card details never touch us. Stripe processes payments and holds the card.
• We do not have your registrar login and we will never ask for it.
• We do not sell any of it.

Where it lives#

Two Cloudflare products and one honest caveat.

• Cloudflare D1 is the database.
• Cloudflare Pages serves the site.
• Processing happens inside and outside Australia. We do not pin it to a single region and we do not claim to.

Who else sees it#

Each one has a job, and none of them is advertising your customer list.

• Stripe - card payments.
• Resend - transactional email, including your sign-in links.
• OpenRouter - routes editor requests to the model that answers them.
• Meta, Microsoft Clarity and Google - analytics on this site. Visitors in the EU, UK, Switzerland and the Crown Dependencies never receive those tags at all; they are stripped before the page is sent.
• Tucows and Synergy Wholesale - domain registration, when we register one for you.

How long we keep it#

Retention is per category, not one number.

• Tax, order and payment records are kept for the period Australian law requires.
• Uploaded build files are deleted six months after the project ends.
• Editor history is kept while we host the site, then deleted or de-identified.
• Quote and waitlist entries are kept until you unsubscribe or ask for deletion.

Getting a copy, or getting it deleted#

Both are a single email.

• Email [email protected] and say which you want.
• We answer deletion requests within 30 days.
• A site export is a separate thing and it is described on move your site somewhere else.