Privacy Policy

Last updated: 21 October 2026

This policy explains how we handle personal data when you visit the Siteholm website, ask for a free preview, or use a paid plan. It follows the EU General Data Protection Regulation (GDPR), which also applies in Norway through the EEA Agreement.

1. Who is responsible

The controller of your personal data is

__OPERATOR_LEGAL_NAME__
__OPERATOR_ADDRESS__
__OPERATOR_COUNTRY__
Email: __OPERATOR_EMAIL__

__EU_REPRESENTATIVE__

For any question about your data, email __OPERATOR_EMAIL__.

2. What we collect and why

When you ask for a free preview

• Your answers in our form. These cover your business and the country it is in, the language you want for your site, what you offer, your audience, the look you like, websites you like, and any text you write for the site.
• Your name and email address.
• Files you upload, such as photos, a logo or a PDF with your prices or texts.
• Your answers are saved as you go, on our server and in your browser, so you can come back and finish later. A draft that is never sent is deleted from our server 30 days after your last change.
• Your IP address while you fill in and send the form, and your browser type when you send it.
• A normalised copy of your email address (lower case, plus tags and Gmail dots removed), so that each address gets one free preview.

We use this to build your preview, send it to you and stop misuse of the free preview. The legal basis is steps taken at your request before entering into a contract (GDPR Article 6(1)(b)) and our legitimate interest in preventing abuse (Article 6(1)(f)).

When you buy a plan

• Your account details, which are your email address and a scrambled (hashed) version of your password. We never store the password itself.
• Your plan, billing cycle, PayPal subscription ID and payment status. We do not receive your card or bank details.
• The domain you choose and its registration status.
• Change requests and money back requests you send from your dashboard.
• Emails you send us and our replies.

We use this to provide the service, run your account, collect payments, register your domain and give support. The legal basis is the performance of our contract with you (Article 6(1)(b)). We keep accounting records because the law requires it (Article 6(1)(c)).

When you visit our website

Our web server records the IP address, time, page requested and browser type of each visit in a log file. We use this to keep the service secure and find faults, based on our legitimate interest (Article 6(1)(f)). The log files are deleted after 15 days.

Emails we send you

We email you about your preview, your site, your account and your payments. We do not send newsletters or advertising emails, and we do not sell your data or use it for advertising.

3. How your site is made

Our software builds your site from your brief. To do this, the text of your brief, your contact details for the site, any text you upload, the text taken from any PDF you upload, the names of your photo files and later your change requests are sent to Anthropic, who provides the language model software that writes the texts and code of your site. Anthropic processes this data on our behalf to produce your site.

The software does not make decisions about you that have legal or similarly significant effects. It only produces the content of your website, which you can check and ask us to change.

4. Who we share data with

We only share personal data with the service providers we need to run the service. Each one gets only the data it needs.

• We also look up photos in Wikimedia Commons when Pexels has none, and we check domain prices with Dynadot. Neither receives any personal data, only search words or domain endings.
• Emails we send pass through the mail service of whoever runs your mailbox, as with any email.
• We may share data with authorities when the law requires it.

5. Transfers outside the EU and EEA

Anthropic and Spaceship are in the USA. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on that framework. Otherwise it is based on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards at __OPERATOR_EMAIL__.

6. How long we keep data

7. Your rights

You have the right to

• get a copy of the personal data we hold about you
• have wrong data corrected
• have your data deleted
• have the processing restricted
• object to processing based on our legitimate interest
• receive your data in a common machine readable format and have it moved to another provider

To use any of these rights, email __OPERATOR_EMAIL__. We answer within one month. We may ask you to confirm your identity first.

You also have the right to complain to a data protection authority, in particular in the country where you live or work. In Sweden this is Integritetsskyddsmyndigheten (IMY), in Denmark Datatilsynet, and in Norway Datatilsynet.

8. Do you have to give us your data

You do not have to. Without your brief and email address we cannot build a preview, and without account and payment details we cannot provide a paid plan.

9. Security

Our website and every site we host use encrypted connections (HTTPS). Data is stored on our servers in Germany, access is limited to the people who run the service, and passwords are stored only in hashed form.

10. Your own customers' data

If your site takes bookings or orders, or receives messages through its contact form, you are the controller of your customers' data and we process it on your behalf. Our Data Processing Agreement covers this. You can ask us for a copy at __OPERATOR_EMAIL__.

11. Cookies

See our Cookie Policy.

12. Changes

We update this policy when our processing changes. The date at the top shows the latest version. If a change matters for you, we tell you by email.