Privacy Policy

1. Information we collect

We collect the account details, contact information, support messages, website briefs, AI prompts, uploaded files, generated content, and preferences you provide. We process technical and security information such as IP addresses, device and browser details, request logs and usage records. When you purchase a plan, we receive subscription and transaction records; card details are handled by our payment services provider.

If you sign in using Google or Microsoft, we receive the identity or profile details that you authorize.

2. Purposes and lawful bases

We use information to provide and secure accounts, create and manage websites, process billing, deliver operational communications, respond to support requests, prevent abuse, improve service reliability and meet legal obligations. Where consent is legally required, we seek meaningful consent and allow withdrawal subject to legal or contractual restrictions.

Where the GDPR or UK GDPR applies, we rely, as appropriate, on contract performance, legitimate interests in security and reliable service operations, legal obligations, or consent. Optional marketing is not required to use the service. We will explain material new purposes and obtain fresh consent when legally necessary.

3. Google and Microsoft sign-in

Connecting a third-party sign-in provider is optional. We may obtain your name, email, profile image and provider ID and store authentication tokens as needed to maintain your sign-in. Basic Google sign-in does not give us access to your Gmail, Google Drive or contacts. We do not sell provider sign-in data or use it for targeted advertising or AI-model training.

Our access to and use of Google data follows the Google API Services User Data Policy, including Limited Use where applicable. You can revoke access with the provider, and you may contact [email protected] to request disconnection or deletion. Revoking a sign-in connection does not cancel a paid subscription.

4. Cookies and communications

Essential cookies support sessions, authentication and security; blocking these may impair the builder. With your permission, we use Google Analytics (measurement ID G-Z5M0FPHR6M) to understand visits to our public website, and the Meta Pixel on our public website to share page-view information with Meta for advertising measurement and relevant advertising. You can accept or reject optional analytics and advertising cookies and change your choice through Cookie settings. Google Analytics and the Meta Pixel do not load before you accept. Google Consent Mode v2 defaults analytics_storage, ad_storage, ad_user_data and ad_personalization to denied and updates them to reflect your choice. We remember your choice for 180 days and honour your browser’s Global Privacy Control signal by keeping optional cookies off. We do not enable automatic advanced matching or send form-field values through this integration. Optional analytics, advertising or third-party tracking may be used only when enabled and subject to applicable consent requirements. When Google reCAPTCHA is used, Google may process technical information for abuse detection according to its policies. Browser controls and applicable consent tools provide cookie choices.

Marketing messages are sent subject to Canada's anti-spam legislation and other applicable laws and contain a lawful unsubscribe mechanism. Necessary account, billing and security notices are not marketing.

5. Providers, AI and disclosures

We use service providers for infrastructure, hosting, storage, payment processing, email, authentication, support and other necessary operations. When you use AI functionality, relevant prompts, business descriptions, files or images may be processed by an AI provider to fulfil your request. Provider terms and retention practices may apply; avoid entering unnecessary sensitive data.

AI output may be incomplete or inaccurate, including about individuals, and must be reviewed before publication. We do not use AI website generation to make decisions with legal or similarly significant effects about you. We may disclose information to comply with law, address security and rights issues, or in a qualifying corporate transaction subject to applicable privacy safeguards. We do not sell personal information. When you accept advertising cookies, we share page-view information with Meta for advertising measurement and relevant advertising as described in section 4.

In any merger, reorganization, financing, sale, incorporation of a dedicated WebTummy entity or transfer of the WebTummy business, we may disclose or transfer personal information only as permitted by applicable law. We will use appropriate confidentiality, purpose limitation, notice and consent measures where required; no clause in this Policy overrides statutory privacy rights.

6. Hosting and international processing

Our primary application and database use AWS infrastructure in Canada. Some service providers, content delivery networks, AI services and integrations may process information outside Canada. Information processed abroad may be subject to lawful access by authorities in those jurisdictions. We remain accountable for information transferred to processors and use appropriate contractual and technical safeguards.

Where the GDPR or UK GDPR applies, international transfers are made under an applicable legal transfer mechanism. Contact [email protected] for further information about relevant processors or safeguards.

7. Customer websites and visitors

Information that you publish on a website may become publicly accessible and may be copied by others. Where WebTummy handles your website visitors' form submissions, analytics or mailing-list information on your behalf, you determine the purposes and legal basis for that processing and are responsible for notices, permissions, consent and lawful instructions. We process such information to deliver the requested functionality, subject to security and legal requirements.

Website visitors should ordinarily direct privacy requests about a customer website to its owner. WebTummy will provide reasonable assistance when necessary and legally required. Business customers whose sites collect sensitive or regulated information may need a separate data-processing agreement; contact [email protected] before using the service for those purposes.

8. Security, retention and deletion

We use reasonable administrative, technical and physical safeguards, including encrypted connections, password hashing and access restrictions. No online service is completely secure. We keep information for as long as reasonably needed for service delivery, legal compliance, fraud prevention, billing, dispute resolution and backup recovery, and apply retention criteria according to the category of data.

You may request account closure and deletion subject to identity verification, applicable laws, legitimate documented retention needs and backup cycles. Suspended website content is retained for at least 90 days to facilitate reactivation, with multiple notices before permanent deletion review, as described in our Terms. Legal holds and mandatory legal retention take priority. We notify affected parties and authorities of qualifying security incidents when legally required.

Retention and backup schedules may evolve. Specific deletion or backup expiry dates should not be inferred from the 90-day minimum suspension-retention period.

9. Your privacy rights and complaints

Email [email protected] to request access, correction, deletion, information on disclosures, or withdrawal of consent, subject to reasonable verification and applicable limits. Additional rights, such as portability, restriction and objection, may apply under the GDPR or UK GDPR. We respond within applicable legal periods and explain refusals and recourse.

You may submit a complaint to the Office of the Privacy Commissioner of Canada, an applicable provincial privacy authority, or the competent European or UK supervisory authority. This Policy does not limit mandatory privacy rights.

10. Children and changes

WebTummy accounts are for individuals who have reached the age of majority in their jurisdiction. We do not knowingly permit children to open their own accounts. Please contact [email protected] if you believe a child has provided personal data through an account. Customers operating websites are responsible for lawful collection from their own visitors, including children.

We will post Policy updates with a new effective date and provide additional notice or obtain fresh consent where legally required. Material changes do not retroactively authorize previously undisclosed uses of information.

11. Contact and legal operator

Privacy and data requests: [email protected]. General support: [email protected]. Legal notices: [email protected].

WebTummy is operated by Dot H Digital Inc., an Ontario corporation, under the WebTummy brand. Dot H Digital Inc. is currently the legal service provider and is responsible for personal information it controls.

The privacy mailbox must be monitored by the person designated to oversee WebTummy privacy compliance. Where required by law, additional legal supplier details are provided at checkout or upon request. Additional supplier contact details, including any telephone or postal address required for relevant transactions, must be displayed through the applicable legally compliant customer-contact channel.