# What data we hold, and where

> A plain-English summary of the privacy policy: what we collect, which companies see it, where it is stored, and how long we keep it.

Security and your data · noboringsites documentation · https://noboringsites.com/docs/security/what-data-we-hold-and-where/

---

This is the readable version of the [privacy policy](/legal/privacy/), which is the document that actually governs it. Where the two differ, the policy wins.

## What we hold

Roughly this, and it is all there because a step in the product needs it.

- **Your contact and business details**, and the owner details for a domain we register for you.
- **Your quiz and brief answers**, plus anything you uploaded.
- **Your order, payment and subscription state** - what you bought and whether it is current.
- **Your sign-in record** - a one-way hash of the magic link, or just your email address if you used Google.
- **What you typed to the editor**, so it can carry on from where you left it.
- **A salted hash of your IP address** for rate limiting, and a note of where your first visit came from.

## What we never hold

The one people ask about first.

- **Card details never touch us.** Stripe processes payments and holds the card.
- **We do not have your registrar login** and we will never ask for it.
- **We do not sell any of it.**

## Where it lives

Two Cloudflare products and one honest caveat.

- **Cloudflare D1** is the database.
- **Cloudflare Pages** serves the site.
- **Processing happens inside and outside Australia.** We do not pin it to a single region and we do not claim to.

## Who else sees it

Each one has a job, and none of them is advertising your customer list.

- **Stripe** - card payments.
- **Resend** - transactional email, including your sign-in links.
- **OpenRouter** - routes editor requests to the model that answers them.
- **Meta, Microsoft Clarity and Google** - analytics on this site. Visitors in the EU, UK, Switzerland and the Crown Dependencies never receive those tags at all; they are stripped before the page is sent.
- **Tucows and Synergy Wholesale** - domain registration, when we register one for you.

## How long we keep it

Retention is per category, not one number.

- **Tax, order and payment records** are kept for the period Australian law requires.
- **Uploaded build files** are deleted six months after the project ends.
- **Editor history** is kept while we host the site, then deleted or de-identified.
- **Quote and waitlist entries** are kept until you unsubscribe or ask for deletion.

## Getting a copy, or getting it deleted

Both are a single email.

- **Email team@noboringsites.com** and say which you want.
- **We answer deletion requests within 30 days.**
- **A site export is a separate thing** and it is described on [move your site somewhere else](/docs/hosting/move-your-site-somewhere-else/).