This policy explains what personal data Webty collects, why, who we share it with, how long we keep it and your rights. It covers our website at www.webty.co.uk, the Webty app and our emails.
1. Who we are
Webty is the trading name of Jamie Davies, a sole trader, of 43 Derlwyn, Dunvant, Swansea SA2 7QA. We are the controller of the personal data described here. Contact us about privacy at info@webty.co.uk.
Websites we build for clients are different. When a client's website collects data from its visitors, the client is the controller and we act on their behalf. That client's own privacy page explains how they use it.
2. What we collect, why, and how long we keep it
| What | Examples | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|---|
| Account details | Name, email address, password (stored scrambled, never readable), two-step sign-in settings | To create and secure your account | Contract | Until you delete your account. Accounts never verified are deleted after 7 days |
| Profile | Business name, phone number | To run your account and contact you | Contract | Until you delete your account |
| Websites and orders | Each website's business name and kit, what you bought, amounts, discounts, refunds, the version of our terms you accepted | To provide your websites and keep financial records | Contract; legal obligation (tax records) | Websites: until 90 days after archiving. Orders: 7 years from the order date |
| Payment and billing details | Card details, billing name and address | Taking payments | Contract | Held by Stripe, not by us. We never see your full card number |
| Unfinished checkouts | What you chose before paying | To let you finish your order | Contract | 90 days |
| Content you send us | Text, photos and logos for your website, and your onboarding answers | To build and run your website | Contract | Until 90 days after the website is archived. Uploads you don't use are deleted 30 days after you send your details |
| Security records | Sign-in history, devices, IP addresses, security events, actions by our staff | To keep accounts and data safe and prevent misuse | Legitimate interests | Sessions: until they expire. Security and audit logs: 2 years |
| Emails we send you | Which emails we sent and when | To send service emails reliably and avoid duplicates | Contract; legitimate interests | 2 years |
| Contact form messages | Name, email, business type, kit, message | To reply to you | Legitimate interests | Sent to our mailbox, not stored in our database. Deleted after 2 years |
| Mailing list | Email address, the topics you chose, when and how you agreed | To send the updates you asked for | Consent | Until you unsubscribe. Sign-ups you never confirm are deleted after 30 days. We keep a note of your unsubscribe so we don't email you again |
| Website statistics | Pages visited, referring site, country, device type | To understand how our website is used | Legitimate interests | Counted anonymously without cookies. Nothing identifies you |
| Error reports | Technical details when something goes wrong, which can include an IP address | To find and fix faults | Legitimate interests | Up to 90 days |
When you upload a photo, we remove location data (GPS) and other hidden details stored in the file before we save it, and keep only the cleaned copy.
We don't sell your data, use it for advertising profiles, or make decisions about you by automated means.
3. Who we share it with
We use these providers to run Webty. Each handles data only on our instructions and under a data protection contract.
| Provider | What they do |
|---|---|
| Vercel Inc. | Hosting our website and app; anonymous website statistics |
| Supabase Inc. | Our database and file storage, in London |
| Stripe Payments UK Ltd | Payments, receipts and invoices. Stripe also uses some data as an independent controller, for example to prevent fraud; see Stripe's privacy policy |
| Resend Inc. | Sending our emails |
| Functional Software Inc. (Sentry) | Error monitoring |
| Apple (iCloud Mail) | Our email inbox, which receives contact form messages and your emails to us |
We may also share data with professional advisers, such as an accountant or solicitor, and with authorities such as HMRC when the law requires it.
4. Data outside the UK
Some providers process data in the United States or the European Union. Where they do, we rely on the safeguards UK law requires, such as the UK–US data bridge or UK international data transfer agreements.
5. Your rights
You can ask us to:
- give you a copy of your data (you can also use Download your data in your account)
- correct anything that's wrong
- delete your data (you can delete your account yourself once none of your websites is active; we keep order records for 7 years because the law requires it)
- restrict or object to how we use it
- move it to another service
You can withdraw consent for our mailing list at any time using the unsubscribe link in any email. Email info@webty.co.uk to use any of these rights. We'll reply within one month.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
6. Cookies
We use only the cookies needed to keep you signed in. See our Cookies page for details.
7. Who our service is for
Webty is for businesses and isn't intended for anyone under 18.
8. Changes to this policy
We'll update this policy when how we use data changes, and tell account holders about significant changes by email. Each version is numbered and dated.