Privacy policy

Last updated 31 October 2026

This policy explains how needthatwebsite ("we", "us") uses personal data when you visit needthatwebsite.com, create an account, or build and run a website with us. We're the data controller for your account data. You can contact us about anything in this policy at hello@needthatwebsite.com.

Data we collect

Account data: your email address and login details, and your profile and billing references.
Website content: everything you add to your sites, including text, images, products, posts, events and settings, plus the descriptions you give our AI tools.
Payment data: handled by Stripe. We receive limited information such as your customer ID and subscription status, never your full card number.
Domain and email data: details needed to register domains and set up mailboxes, including registrant contact details where registries require them.
Support messages: what you send us through our contact form or by email.
Technical data: IP address, browser and device information and logs, used to run and secure the service.

How we use it

To provide the service: building, hosting and publishing your websites (contract).
To take payments and manage subscriptions (contract).
To register domains and provide email (contract).
To generate AI content and images when you ask us to (contract).
To send essential service emails such as receipts, security notices and invitations (contract / legitimate interests).
To keep the service secure and prevent abuse (legitimate interests).
To meet legal and tax obligations (legal obligation).

We don't sell your personal data.

We use trusted providers (processors) to run the service. They only process data on our instructions:

Vercel: website hosting and delivery.
Supabase: database, file storage and authentication.
Stripe: subscription payments, and Stripe Connect for shop payments.
Resend: transactional email.
Anthropic: AI text generation from the descriptions and notes you provide.
fal.ai: AI image generation from your prompts.
DNSimple: domain registration and DNS.
ResellerClub / Titan: professional email mailboxes.

Some providers are based outside the UK. Where data is transferred internationally we rely on appropriate safeguards such as the UK International Data Transfer Addendum or adequacy regulations.

Your visitors' and customers' data

When your website collects data from its visitors (for example contact form messages, newsletter sign-ups, shop orders and customer accounts), you are the controller of that data and we process it on your behalf to provide the service. You're responsible for having your own privacy notice on your website and a lawful basis for any marketing you send.

How long we keep data

We keep account and website data while your account is active. If a subscription ends, we keep your site content so you can restart it, unless you ask us to delete it. Billing records are kept as long as the law requires (typically six years).

Your rights

You can ask to access, correct, delete or export your data, object to or restrict certain processing, and withdraw consent where we rely on it. Email hello@needthatwebsite.com. You can also complain to the Information Commissioner's Office (ico.org.uk).

Security

We use encryption in transit (HTTPS), access controls, and private storage for sensitive files such as digital products. Mailbox passwords are never stored by us.

Changes

We'll update this page if our practices change and, for significant changes, let account holders know by email.