Privacy

Tom Gray, trading as Tin Websites (a sole trader in the UK), is the data controller for the personal data described here. Questions or requests: hello@tinwebsites.com.

• Your preview details: business name, your name, the email and phone you want enquiries sent to, your profession, town, address and postcode if you give them, opening hours, services, the words you write, and any photos, videos or logos you upload.
• Domain owner details: your full name, business name, address, phone, email, and for .uk domains your registrant type and company number if you have one. Domain registries need these to register a domain in your name.
• Billing details: your email, what you bought, your payment history and your Stripe customer reference. Card details go straight to Stripe. We never see or store your full card number.
• Your account activity: change requests, upgrades, cancellation, and the single-use links we email you to manage your site.
• Emails: messages we send you (receipts, manage links, notices) and anything you send us.
• Technical data: IP address, browser and device details, and request logs. Our hosting provider processes these to keep the site secure and stop abuse.

We don't sell your data, and we don't use advertising or analytics cookies. If you build a free preview and don't pay, we may email you twice about that preview, unless you ticked “don't email me” on the form. Each email has a stop link, and using it stops those emails to that address. We don't send any other marketing.

Once your site is live, anything you put on it (business name, phone, email, address, photos) is public, because that's the point of a website. Domain owner details are redacted from public WHOIS lookups where the registry allows.

We use a small number of trusted providers, only for the jobs below:

• Stripe: payments, subscriptions, invoices and fraud checks.
• Cloudflare: hosting your site and storing its data (our billing database is held in Western Europe), security, and domain registration through Cloudflare Registrar.
• Domain registries: the registry for your domain's extension (for example Nominet for .uk) receives your domain owner details, as every registration requires.
• Resend: sending our emails (from its EU region).
• Google Workspace: our email inbox, when you write to us.

Where possible, your data is kept in the UK or EU. Some of these providers are based in the US or may process data there. When that happens, the transfer is protected by UK-approved safeguards, such as the UK-US data bridge or the UK International Data Transfer Addendum. We may also share data where the law requires it.

We only use cookies that are strictly necessary: a short-lived, secure cookie that keeps you signed in for 30 minutes after you open a manage link, and cookies Stripe sets on the checkout to process payments safely and prevent fraud. No tracking, no ads.

• Free previews you don't buy: until you ask us to delete them, and we tidy up old unpaid previews regularly.
• Live sites: for as long as you're subscribed.
• After you cancel: your site content for up to 12 months (so we can help with the handover or bring it back if you return), then it's deleted.
• Billing and tax records: for as long as HMRC requires (currently up to 6 years).
• Emails and logs: no longer than needed for support, security and our records.
• Stop list: if you ask us not to send preview emails, we keep that email address so we don't send them.

You have the right to access your data, get it corrected, get it deleted, restrict or object to how we use it, and receive a copy in a portable format. Some rights have limits (for example, we must keep tax records). To use any of them, email hello@tinwebsites.com. We'll reply within one month, and it's free.

Please talk to us first at hello@tinwebsites.com. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

If we change this notice in a way that matters, we'll update the date at the top and, if you're a customer, email you. See also our terms.