Privacy Policy

This Privacy Policy describes how Webspin LLC (“Webspin,” “we,” “us,” or “our”) collects, uses, and protects information when you visit our website at webspin.com (the “Site”), use our services, or otherwise interact with us.

By using the Site or purchasing our services, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Site or our services.

1. Information We Collect

1.1 Information You Provide to Us

We collect information that you voluntarily provide when you:

• Purchase a website from us (name, email address, phone number, business name, business address, payment information)
• Create or sign in to a customer account (email address, password or passkey credentials — we store only the passkey’s public key and salted hashes of passwords and recovery codes, never the secrets themselves)
• Use the site editor (content you add to your website, images you upload, and messages you send to the AI assistant)
• Contact us via email or through the Site (name, email address, message content)
• Subscribe to communications from us (email address)

1.2 Information Collected Automatically

When you visit the Site, we may automatically collect certain information, including:

• Device and browser information (browser type, operating system, device type)
• IP address and approximate geographic location
• Pages visited, time spent on pages, and referring URLs
• Cookies and similar tracking technologies (see Section 4 below)

1.3 Information from Third-Party Services

We use third-party services that may collect information on our behalf:

• Stripe: Processes payments. Stripe collects payment card information directly and is subject to Stripe’s own privacy policy. We do not store your full credit card number.
• PostHog: Provides analytics on Site usage. PostHog may collect device information, IP addresses, and browsing behavior on the Site. PostHog is loaded only after you accept analytics via the cookie banner.
• Sentry: Captures error reports and performance metrics so we can detect and fix bugs. Sentry may receive URL paths you visit on the Site, browser and operating system details, and error stack traces. Personal information is not intentionally captured; we redact email addresses from error messages before they reach Sentry.
• Google Places API: Used to look up publicly available business information. We may collect publicly listed business names, addresses, phone numbers, and website URLs from Google’s services.
• Hunter.io and Apollo.io: Business-contact data providers. To reach a business about a website we have designed for it, we use these services to find a business contact email address associated with the business’s domain. They may provide business email addresses and related business-contact information, sourced from publicly available and third-party data. See Section 1.4.
• NeverBounce: An email-verification service. Before we send outreach to a business contact email address (see Section 1.4), we use NeverBounce to check that the address is deliverable; the address is shared with NeverBounce for that check.
• Instantly: The email platform through which we send our business outreach. Instantly processes the business contact email addresses we send to and the content of those messages, including delivery and reply status.
• Resend: Delivers our transactional email (order confirmations, sign-in links, account and billing notices). Resend processes recipient email addresses and message content.
• Anthropic and OpenRouter: Provide access to the AI models behind our service. Anthropic’s models generate the websites we design, from publicly available business information and content you provide. Models accessed through OpenRouter draft our outreach messages and power the AI features of the site editor (AI-assisted changes and the editor’s assistant) — so content of your website, your change requests, and your assistant messages may be processed by these providers. We do not send payment information to either.
• Amazon Web Services (AWS): Hosts our application, our databases, and the websites we generate. Information we process is stored on AWS infrastructure in the United States.

1.4 Information About Businesses We Contact

A core part of our service is designing a sample website for a small business on spec — before the business has contacted us — and then reaching out to show the business what we made. To do this, we collect information about businesses and their publicly listed contact details from publicly available sources (such as business directories and map listings) and from the business-contact data providers named in Section 1.3. This may include the business name, address, phone number, website, and a business contact email address.

We use this information to design a sample website for the business and to send commercial email about it. These messages are not solicited by the recipient. Every such message identifies us, includes our physical mailing address, and provides a working way to opt out, as required by the U.S. CAN-SPAM Act. If you opt out — or ask us to stop — we add you to a suppression list and do not contact you again, and you may ask us to delete the information we hold about you (see Section 7).

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, deliver, and improve our services, including generating and delivering websites
• To process payments and fulfill orders
• To communicate with you about your order, account, or inquiries
• To send commercial outreach email to a business about a sample website we have designed for it, in compliance with the CAN-SPAM Act — every message identifies us, includes our physical mailing address, and provides a working opt-out (see Section 1.4)
• To send marketing communications to customers and to people who have subscribed; you may opt out at any time
• To analyze usage of the Site and improve user experience
• To detect, prevent, and address fraud, abuse, or technical issues
• To comply with legal obligations

3. How We Share Your Information

We do not sell your personal information to third parties. We may share your information in the following circumstances:

• Service Providers: We share information with third-party service providers who help us operate our business (payment processing, analytics, email delivery, hosting). These providers are contractually obligated to use your information only as directed by us and to maintain its confidentiality.
• Legal Requirements: We may disclose your information if required to do so by law, or in the good-faith belief that such action is necessary to comply with legal process, protect our rights, or ensure the safety of our users or the public.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity.

4. Cookies and Tracking Technologies

We use cookies and similar technologies on the Site for the following purposes:

• Essential Cookies: Required for the Site to function (e.g., session management, security).
• Analytics Cookies: Help us understand how visitors interact with the Site (e.g., PostHog analytics).

Preview sites. When we send a business a link to a website preview we have designed for it (see Section 1.4), opening that link sets first-party cookies on the preview domain that record which outreach message the visit came from, and the preview page reports basic interaction events (page views, button clicks) back to us. We use this only to know whether the business we contacted has seen its preview and to attribute its response to our message; it is not used for advertising, and no third-party analytics run on preview pages.

Your consent. On your first visit, we present a consent banner. You can accept or decline analytics; your choice is remembered on this browser. We do not load any analytics until you accept.

Global Privacy Control (GPC). If your browser sends the GPC signal (as required for honoring under the Texas Data Privacy and Security Act and the California Consumer Privacy Act), we automatically treat that as an opt-out and do not show the banner. You may also control cookies through your browser settings — disabling certain cookies may affect Site functionality.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specifically:

• Customer account and order information: Retained for the duration of our business relationship and as required for tax and legal compliance.
• Analytics data: Retained in aggregated or anonymized form and may be kept indefinitely.
• Marketing communications: We retain your email address until you unsubscribe.
• Prospect business-contact information: Retained while relevant to outreach. If you opt out or ask us to stop, we keep the minimum necessary to honor your request and keep you suppressed from future outreach.

6. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information from unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete information.
• Deletion: You may request that we delete your personal information, subject to certain legal exceptions.
• Opt-Out of Marketing: You may unsubscribe from marketing emails at any time by clicking the “unsubscribe” link in any email or by contacting us.

To exercise any of these rights, contact us at legal@webspin.com.

7.1 Deleting a business preview and its data

If we designed a sample website for your business and contacted you about it (see Section 1.4), every outreach email includes a removal link. That link lets you take the preview down and, if you choose “delete all data,” request erasure of everything we hold about your business — the preview, the research we gathered, your business-contact details, and the associated records in the third-party services we use (such as our email outreach platform). You can also make this request by emailing legal@webspin.com.

When you request full deletion, we stop serving the preview and stop all outreach immediately, and we permanently delete the data within a short review window (currently 7 days — a brief window we keep to reverse a mistaken or fraudulent request before the deletion is irreversible). We honor deletion requests except where we are required or permitted to retain certain records — in particular, if you have purchased from us we retain transaction records as required for tax and accounting, with other personal information removed, and we keep the minimum information necessary to keep you suppressed from future outreach. As noted in Section 6, data may also persist briefly in encrypted backups before those backups age out.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell your personal information. To exercise your CCPA/CPRA rights, contact us at legal@webspin.com.

7.3 International Users

If you are located outside the United States, please be aware that your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Site or our services, you consent to this transfer. If you are located in the European Economic Area or United Kingdom and believe we have processed your personal data in violation of applicable data protection law, you have the right to lodge a complaint with your local data protection authority.

8. Children’s Privacy

The Site and our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.

9. Third-Party Links

The Site may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised “Last Updated” date at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the Site after any changes constitutes your acceptance of the updated Privacy Policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

Webspin LLC
Email: legal@webspin.com
Address: 5900 Balcones Drive #31281, Austin, TX 78731