Privacy Policy
Last updated: 27 October 2026
This policy explains how we handle personal data when you visit the Siteholm website, ask for a free preview, or use a paid plan. It follows the EU General Data Protection Regulation (GDPR), which also applies in Norway through the EEA Agreement.
1. Who is responsible
The controller of your personal data is
Siteholm
India
Email: hello@siteholm.com
For any question about your data, email hello@siteholm.com.
2. What we collect and why
When you ask for a free preview
- Your answers in our form. These cover your business and the country it is in, the language you want for your site, what you offer, your audience, the look you like, websites you like, and any text you write for the site.
- Your name and email address.
- Files you upload, such as photos, a logo or a PDF with your prices or texts.
- Your answers are saved as you go, on our server and in your browser, so you can come back and finish later. A draft that is never sent is deleted from our server 30 days after your last change.
- Your IP address while you fill in and send the form, and your browser type when you send it.
- A normalised copy of your email address (lower case, plus tags and Gmail dots removed), so that each address gets one free preview.
We use this to build your preview, send it to you and stop misuse of the free preview. The legal basis is steps taken at your request before entering into a contract (GDPR Article 6(1)(b)) and our legitimate interest in preventing abuse (Article 6(1)(f)).
We check your answers, texts and photos against the rules in section 11 of our Terms, first with software and then, when the software holds a brief back, by a person. When the check finds a possible match, we keep a short record with the date, the rule and the word or reason found, but not your brief. We keep this record for 24 months, also after the rest of your data is deleted, to stop the same misuse coming back. The legal basis is our legitimate interest in keeping the service safe (Article 6(1)(f)).
When you buy a plan
- Your account details, which are your email address and a scrambled (hashed) version of your password. We never store the password itself.
- Your plan, billing cycle, PayPal subscription ID and payment status. We do not receive your card or bank details.
- Your confirmation that you buy for your business, the business name and address for invoices, the country of your business, your organisation number and, if you give one, your VAT number with the result and date of its check.
- Your invoices and credit notes.
- The domain you choose and its registration status.
- Change requests and money-back requests you send from your dashboard.
- Emails you send us and our replies.
We use this to provide the service, run your account, collect payments, register your domain and give support. The legal basis is the performance of our contract with you (Article 6(1)(b)). We keep accounting records because the law requires it (Article 6(1)(c)).
When you visit our website
Our web server records the IP address, time, page requested and browser type of each visit in a log file. We use this to keep the service secure and find faults, based on our legitimate interest (Article 6(1)(f)). The log files are deleted after 15 days.
When a page opens, our server looks up which country your IP address belongs to, in a list kept on the server itself. We use the country only to show information that applies where you are. It is not stored, and no outside service is asked. The list is IP Geolocation by DB-IP (db-ip.com), licensed under CC BY 4.0. The legal basis is our legitimate interest in showing relevant information (Article 6(1)(f)).
When you report content
When you email us a report, we get the web address, your explanation and, if you give them, your name and email address. We use them to handle the report and to tell you what we decided, as the Digital Services Act requires (Article 6(1)(c)). We keep reports for 24 months.
Emails we send you
We email you about your preview, your site, your account and your payments. We do not send newsletters or advertising emails, and we do not sell your data or use it for advertising.
3. How your site is made
Our software builds your site from your brief. To do this it sends the text of your brief, your contact details for the site, any text you upload, the text taken from any PDF or Word file you upload and later your change requests to Anthropic PBC in the USA, whose Claude language model writes the texts and code of your site. For our content check (section 2) it also sends smaller copies of the photos you upload. This is needed to build the site you ask for (Article 6(1)(b)).
We use Claude under Anthropic's consumer terms. Under those terms Anthropic is not our processor. It handles this data as a separate controller under its own privacy policy, which you can read at anthropic.com/legal/privacy. We send it only what is needed to build and check your site. When this changes, we update this section first.
The software does not make decisions about you that have legal or similarly significant effects. It produces the content of your website, which you can check and ask us to change, and when our content check holds a brief back, a person reviews it.
4. Who we share data with
We only share personal data with the service providers we need to run the service. Each one gets only the data it needs.
| Provider | Role | What it receives | Location |
|---|---|---|---|
| Contabo GmbH | Hosting of our servers, the website, the database and your site. Our emails are also sent from our own mail server at Contabo. | All data described in this policy, stored on our servers | Germany (EU) |
| Anthropic PBC | Separate controller under Anthropic's consumer terms (section 3). Its Claude model writes the texts and code of your site and helps with our content check. | Brief text, site contact details, uploaded text, text from PDF and Word files, smaller copies of uploaded photos, change requests | USA |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Takes your payments. PayPal acts as its own controller under its own privacy statement. | Plan, price, subscription details. Your payment details go straight to PayPal, not to us. | Luxembourg (EU) |
| European Commission (VIES) | Checks EU tax numbers (section 2) | The number you give | EU |
| Brønnøysundregistrene | Checks Norwegian organisation numbers | The organisation number you give | Norway (EEA) |
| Spaceship, Inc. | Domain registrar. Registers and renews your domain. | Your domain name and, where a registry requires it, your details as the domain holder | USA |
| Pexels | Stock photo library | Search words based on your type of business. No personal data. | Germany (EU) |
- We also look up photos in Wikimedia Commons when Pexels has none, and we check domain prices with Dynadot. Neither receives any personal data, only search words or domain endings.
- Emails we send pass through the mail service of whoever runs your mailbox, as with any email.
- We may share data with authorities when the law requires it.
5. Transfers outside the EU and EEA
Anthropic and Spaceship are in the USA. Anthropic's consumer terms do not include the EU Standard Contractual Clauses. We send data to Anthropic because it is needed to build the site you ask for (GDPR Article 49(1)(b)). Spaceship receives personal data only where a registry's rules require you to be the domain holder. That transfer is needed to register the domain you ask for (GDPR Article 49(1)(b)).
We run Siteholm from India, outside the EU and EEA, and reach the data on our servers in Germany from there. You can ask us about these transfers at hello@siteholm.com.
6. How long we keep data
| Data | How long |
|---|---|
| A preview that is not paid for | The preview site is removed after 14 days. The brief, uploads and contact details are deleted 90 days after the preview is removed. |
| A form draft that is never sent | 30 days after the last change |
| The normalised email address used for the one-preview rule | 365 days |
| Account, site and plan data | While your plan runs, and deleted within 90 days after it ends |
| Invoices and payment records | As long as the accounting law that applies to us requires |
| Server log files | Web server logs 15 days, app logs 30 days, mail server logs up to 35 days |
| Support emails | 24 months |
| Records of our content check | 24 months |
| Reports of illegal content | 24 months |
7. Your rights
You have the right to
- get a copy of the personal data we hold about you
- have wrong data corrected
- have your data deleted
- have the processing restricted
- object to processing based on our legitimate interest
- receive your data in a common machine-readable format and have it moved to another provider
To use any of these rights, email hello@siteholm.com. We answer within one month. We may ask you to confirm your identity first.
You also have the right to complain to a data protection authority, in particular in the country where you live or work. In Sweden this is Integritetsskyddsmyndigheten (IMY), in Denmark Datatilsynet, and in Norway Datatilsynet.
Indian law governs this policy and the courts of India decide any dispute about it, without limiting your rights under the GDPR.
8. Do you have to give us your data
You do not have to. Without your brief and email address we cannot build a preview, and without account and payment details we cannot provide a paid plan.
9. Security
Our website and every site we host use encrypted connections (HTTPS). We store the data described in this policy on our servers at Contabo GmbH in Germany, inside the EU, and the copies we keep for safety stay on the same servers. Some data also goes to the providers in section 4, some of them outside the EU, as section 5 explains. Access is limited to the people who run the service, and passwords are stored only in hashed form.
10. Your own customers' data
If your site takes bookings or orders, or receives messages through its contact form, you are the controller of your customers' data and we process it on your behalf. Our Data Processing Agreement covers this. You can ask us for a copy at hello@siteholm.com.
11. Cookies
See our Cookie Policy.
12. Changes
We update this policy when our processing changes. The date at the top shows the latest version. If a change matters for you, we tell you by email.