Privacy Policy
This policy explains how DM-Me, trading as WebsitePal Pro and referred to as “WebsitePal”, “we”, “us” or “our”, collects and uses personal information through the WebsitePal website, portal and services.
1. Who Is Responsible
DM-Me trading as WebsitePal Pro is the controller of personal information used to manage enquiries, client accounts, contracts, billing, security and WebsitePal’s own business operations.
Address: 24 Santa Ana de Bolueta, 48004 Bilbao, Vizcaya, Spain.
Email: info@websitepal.pro
When WebsitePal hosts a client website and processes enquiries or other personal data solely for that client, the client is normally the controller and WebsitePal acts as processor. Those arrangements are covered by our Data Policy. The client’s own privacy notice should explain how that client uses website visitor information.
2. Information We Collect
Depending on how you use the service, we may collect:
- identity and contact details, including names, business names, email addresses, phone numbers, billing addresses and account identifiers;
- account and authentication information, including sign-in records, password-reset events and security settings, but not your readable password;
- business and website information, including services, areas covered, opening hours, team details, reviews, project information, social links, logos, photographs and content instructions;
- messages, support requests, approvals, feedback and records of our relationship;
- payment, subscription, invoice and transaction references supplied by Stripe. WebsitePal does not store full card numbers;
- technical and security information such as IP address, timestamps, browser and device information, request logs, rate-limit data and security events;
- analytics information collected only in accordance with section 11 below; and
- information submitted by visitors through a client website contact form, which may include a name, email address, phone number and enquiry message.
3. Where Information Comes From
We obtain information directly from account users, clients, website visitors and communications with us. Clients may also provide information about team members, reviewers, customers or project contacts. Payment and subscription information comes from Stripe, and technical information may come from our hosting, authentication, security and analytics providers.
If you provide personal information about another person, you must have a lawful reason to do so and give them any privacy information required by law.
4. Why We Use Information And Our Lawful Bases
- Contract: to create and administer accounts; collect a website brief; build, host and maintain a website; provide support; process orders and payments; manage subscriptions; and communicate about the service.
- Legal obligation: to keep required accounting and tax records; respond to valid legal requests; and meet applicable data-protection, fraud-prevention and regulatory duties.
- Legitimate interests: to secure our systems; prevent fraud and abuse; maintain service records; recover debts; defend legal claims; improve standard workflows; understand service performance; and operate WebsitePal efficiently. We consider the effect on individuals before relying on this basis.
- Consent: where required for optional analytics, marketing communications or another clearly identified optional purpose. Consent can be withdrawn at any time.
- Client instructions: where we act as processor for a client, we process personal data under that client’s documented instructions and applicable data-protection law.
Some account, business and billing information is necessary to enter into or perform the WebsitePal contract. If it is not supplied, we may be unable to create an account, take payment, build the website or provide support.
5. AI-Assisted Website Generation
WebsitePal uses OpenAI’s API to help generate initial website copy, layouts, field suggestions and design ideas from the business information supplied during onboarding or later generation requests. Relevant portions of a brief may be sent to OpenAI for this purpose. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer explicitly opts in.
We do not use this process to make legal or similarly significant decisions about people. Output is a website draft and should be reviewed by WebsitePal and the client. Clients should not submit special-category personal data, full payment-card details or information that is unnecessary for the website build.
6. Who We Share Information With
We use suppliers where reasonably necessary to operate the service. Important categories and current providers include:
- Stripe for checkout, recurring billing, invoices and payment administration;
- Supabase for database, authentication and file storage services;
- Vercel for application and website hosting and delivery;
- Resend and related email infrastructure for service and enquiry emails;
- OpenAI for AI-assisted website generation;
- Google Analytics, only where enabled under section 11;
- domain, email and WordPress providers where separately requested by a client; and
- professional advisers, insurers, auditors, regulators, courts or authorities where reasonably necessary.
We do not sell personal information. Suppliers acting as processors must handle information under contractual and confidentiality obligations appropriate to their role.
7. International Transfers
WebsitePal is based in Spain and serves clients in the United Kingdom. Some suppliers may process information in the United Kingdom, European Economic Area, United States or other countries. Where a transfer requires safeguards, we use an applicable adequacy decision or recognised contractual safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum, together with supplementary measures where appropriate.
You can contact us for more information about safeguards relevant to a particular transfer.
8. How Long We Keep Information
We apply the following normal retention criteria, subject to legal holds, disputes and any longer period required by law:
- active account, project and support information is kept while the service is provided and may then be retained for up to six years for contract, accounting and legal-claim purposes;
- billing, invoice, payment and Terms-acceptance records may be retained for up to six years after the relevant transaction or end of the relationship;
- incomplete or abandoned account information may be removed after 12 months of inactivity;
- security and application logs are normally retained for no longer than 12 months unless needed to investigate an incident;
- client website enquiries are kept under the client’s instructions and the Data Policy and are normally deleted or returned after the processing service ends; and
- backup copies are removed through the applicable rolling backup cycle and may remain for a limited additional period after deletion from live systems.
We may anonymise information so it can no longer identify anyone and retain the resulting statistics for service planning and security.
9. Security
We use technical and organisational measures designed to protect information, including access controls, authenticated accounts, restricted administrative permissions, encrypted network connections, protected storage, rate limiting, logging and supplier security controls. No online service can guarantee absolute security.
10. Your Rights
Depending on the applicable law and circumstances, you may have rights to access, correct, delete or receive personal information; restrict or object to processing; withdraw consent; and complain to a supervisory authority. You may also have a right to data portability and not to be subject to certain solely automated decisions.
Send requests to info@websitepal.pro. We may ask for proportionate information to verify identity. Withdrawing consent does not affect processing already carried out lawfully.
Because WebsitePal is based in Spain, you may complain to the Agencia Española de Protección de Datos. People in the United Kingdom may also contact the Information Commissioner’s Office. You may have the right to complain to another local supervisory authority where applicable.
11. Cookies And Analytics
The WebsitePal portal uses essential storage technologies to authenticate users, remember security state and provide requested account features. These are not used for advertising.
The WebsitePal marketing site offers optional Google Analytics to help us understand aggregate visits, devices and page use so we can improve the site. Analytics is not loaded until you choose “Accept analytics”. Google Analytics may then set first-party cookies including _ga and _ga_<container-id>, which Google documents as having a default duration of up to two years.
You can reject analytics and still use the site. You can change your choice at any time using “Analytics choices” in the website footer. Rejecting analytics prevents it loading on future pages in that browser; if it was already active, we also send a withdrawal instruction and attempt to remove its first-party identifiers.
12. Service Messages And Marketing
We send operational messages needed to provide the service, including account, build, payment, security, hosting and support notices. These are not marketing messages. We will obtain consent or rely on another lawful permission before sending optional electronic marketing, and every such message will provide an appropriate way to opt out.
13. Children And Sensitive Information
The service is intended for business users aged 18 or over and is not directed at children. WebsitePal does not ask clients to provide health, biometric, political, religious or other special-category personal data as part of the normal website build. Contact us before submitting any such information.
14. Changes To This Policy
We may update this policy when the service, suppliers or legal requirements change. We will update the date above and take reasonable steps to notify account users before a material change takes effect where appropriate.
15. Contact
Privacy questions can be sent to info@websitepal.pro or DM-Me trading as WebsitePal Pro, 24 Santa Ana de Bolueta, 48004 Bilbao, Vizcaya, Spain.