Privacy Policy

1. Who we are & scope of this policy

This Privacy Policy explains how WebReadyWebsites ("WebReadyWebsites," "we," "us," or "our") collects, uses, discloses, and protects personal data when you visit webreadywebsites.com, create an account, subscribe to our Service, or interact with a website we host on behalf of one of our business customers (a "Customer Site"). For purposes of applicable data protection law, when we process account, billing, and dashboard data about you as our customer, we act as the data controller. When we process data submitted by a visitor through a Customer Site's contact form or analytics (e.g. page views), we act as a data processor / service provider on behalf of the business that owns that Customer Site, who is the controller of that data — see Section 8.

2. Information we collect

We collect the following categories of data:

• Account & identity data: name, email address, password (stored as a salted hash, never in plain text), and role.
• Business & content data: business name, type, logo, hours, service listings, testimonials, and other content you provide for your Customer Site.
• Billing data: subscription plan and status. Full card numbers are never received or stored by us — payment details are collected and processed directly by Stripe, our PCI-compliant payment processor.
• Communications: messages you send us, including support requests, change requests, and contact-form submissions.
• Visitor / lead data: on your behalf, contact forms on your Customer Site collect a visitor's name, email, phone number, and message.
• Usage & analytics data: page views, phone/email click events, and contact-form submissions on Customer Sites, plus standard technical data (IP address, browser type, device information) collected automatically.
• Cookies: session cookies used for authentication, described further in Section 6.

3. Legal basis for processing (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases to process your personal data: (a) performance of a contract — to create your account, build and host your Customer Site, and provide the dashboard; (b) legitimate interests — to secure the Service, prevent abuse, and improve our features, balanced against your rights; (c) legal obligation — for tax, accounting, and record-keeping requirements; and (d) consent — where we ask for it explicitly (for example, optional marketing communications), which you may withdraw at any time.

4. How we use information

We use personal data to: provide, maintain, and improve the Service; build, host, and update your Customer Site; process subscription payments and prevent fraud; deliver leads and analytics to your dashboard; respond to support and change requests; send service-related and (where you've opted in) marketing communications; enforce our Terms of Service; and comply with legal obligations. We do not sell your personal information and do not share it with third parties for their own independent marketing purposes.

5. How we share information

We share personal data only with the following categories of recipients, each acting under contractual confidentiality and data-protection obligations:

• Stripe, Inc. — payment processing and fraud prevention (billing data).
• Supabase, Inc. — database hosting and authentication (all account, business, lead, and analytics data).
• Vercel Inc. — application hosting and content delivery (all data in transit through the Service).
• Legal & safety — where required to comply with law, enforce our Terms, or protect the rights, property, or safety of WebReadyWebsites, our customers, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy or a policy at least as protective.

6. Cookies & similar technologies

We use strictly necessary cookies to keep you signed in and maintain your session (via Supabase Auth). We do not use third-party advertising cookies or cross-site tracking pixels. Customer Sites record first-party analytics events (page views, form submissions, phone/email clicks) attributable to that site only, without building cross-site profiles or selling data to ad networks. You can control cookies through your browser settings; disabling strictly necessary cookies may prevent you from logging in.

7. International data transfers

Our service providers (Stripe, Supabase, Vercel) may process and store data in the United States and other countries. Where we transfer personal data of individuals in the EEA, UK, or Switzerland to a country not deemed to provide an adequate level of protection, we rely on appropriate safeguards recognized under GDPR/UK GDPR, such as Standard Contractual Clauses, as implemented by our service providers.

8. Leads collected on Customer Sites

When a visitor submits a contact form or interacts with a Customer Site, we collect that information as a data processor acting under the instructions of the business that owns the site, and we make it available to that business through its dashboard. The business that owns the Customer Site is the data controller for that visitor data and is responsible for its own compliance obligations toward its site visitors, including maintaining any privacy notice legally required in its own jurisdiction and honoring visitor requests regarding their data. If you are a website visitor and want to exercise a privacy right regarding data you submitted through a Customer Site's contact form, please contact that business directly; we will assist our business customers in responding to such requests as their processor.

9. Data retention

We retain account and business data for as long as your subscription is active, and for a reasonable period afterward (typically up to 12 months, or longer where required by law, tax, or accounting obligations) to allow reactivation, resolve disputes, and meet legal obligations, after which it is deleted or anonymized. Lead data collected through a Customer Site is retained per the instructions of the business that owns that site. You may request earlier deletion as described in Section 10, subject to our legal retention obligations.

10. Your privacy rights

Depending on where you live, you may have the right to: (a) confirm whether we process your personal data and access a copy of it; (b) correct inaccurate data; (c) request deletion of your data; (d) restrict or object to certain processing; (e) receive your data in a portable format; (f) withdraw consent at any time where processing is based on consent; and (g) not be discriminated against for exercising these rights. Residents of the EEA, UK, or Switzerland also have the right to lodge a complaint with their local supervisory authority. To exercise any of these rights, contact us using the details in Section 13; we will respond within the timeframe required by applicable law. We may need to verify your identity before fulfilling a request.

11. Data security

We use industry-standard technical and organizational measures to protect personal data, including encryption in transit (HTTPS/TLS), row-level access controls in our database, role-based access restrictions limiting internal access to authorized personnel only, and a documented incident-response process. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify affected individuals and, where required, relevant authorities, in accordance with applicable law.

12. Children's privacy

The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Contact & changes to this policy

Questions, requests, or complaints about this Privacy Policy or our data practices can be sent via our Contact page or to flupodsocials@gmail.com. We may update this policy from time to time; material changes will be notified by email or in-dashboard notice at least 15 days before taking effect. The "Last updated" date above reflects the most recent revision.