1. Controller and scope

The controller responsible for this service is:

Vilgot Moeschlin
Email: vilgot@moeschlin.com

This policy covers visitors, account holders, customers, and people who use sites hosted through Tervane.

2. Data we collect

Account: email, authentication identifiers, profile details supplied by an OAuth provider, and account settings.
Projects and content: prompts, messages, generated code, images, project files, uploads, published-site content, versions, domains, and records submitted to hosted sites.
Billing: plan, transaction and subscription status, and Stripe customer identifiers. Stripe receives payment and billing details.
Usage and support: generation usage, feature activity, support communications, and feedback.
Technical: IP address, request metadata, device/browser information, security logs, performance data, and cookieless analytics.

3. Purposes and legal bases

PurposeEU/UK legal basis

Provide accounts, generation, hosting, billing, downloads, and supportContract

Secure the service, prevent fraud and abuse, diagnose failures, and improve reliabilityLegitimate interests

Keep tax, accounting, and compliance recordsLegal obligation

Optional non-essential cookies or marketing, if introducedConsent

Where processing is required to provide the service, refusing required data may prevent account or feature use. We do not use solely automated decisions that produce legal or similarly significant effects.

4. How data is shared

We disclose data only as needed to operate the service, comply with law, protect rights, or complete a corporate transaction. Current processor categories include:

Supabase: authentication, database, and file storage.
Stripe: payments, subscriptions, connected merchant accounts, fraud prevention, and billing portal.
OpenAI: AI generation and revision; prompts and relevant project context are sent to its API. When a hosted site uses managed content moderation, the submitted text is sent for classification; our runtime ledger stores its hash and bounded classification, not the submitted text.
Resend: managed transactional email and delivery-event processing when a project enables email.
GitHub: repository creation and outbound project sync when you provide a GitHub token.
Vercel: hosting, delivery, security, performance insights, cookieless analytics, and isolated generation builds.
Google: optional Google sign-in.

Do not put sensitive personal data, secrets, or confidential regulated data in prompts unless the service has explicitly agreed to handle it.

5. International transfers

Providers may process data outside your country, including in the United States. Where required, we rely on adequacy decisions, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism. Request details at vilgot@moeschlin.com.

6. Retention

Account and project data is generally kept while your account is active. Account deletion removes account-controlled project data and cancels active subscriptions, subject to backups, fraud/security records, legal holds, and records that must be retained for tax, accounting, or dispute purposes. Operational logs are retained only as long as reasonably necessary for their purpose. Before production, the company must publish verified retention periods.

7. Security

We use access controls, authentication, transport encryption, service-provider safeguards, and monitoring appropriate to the data and risk. No online service can guarantee absolute security. You are responsible for protecting your credentials and exported or published content.

8. Your rights

Depending on location, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; and appeal or complain to your local data-protection authority. We may verify identity and may retain data where law permits. Submit requests to vilgot@moeschlin.com. EU/EEA users may contact their national supervisory authority.

9. United States state notices

In the preceding 12 months, the categories collected may include identifiers, customer records, commercial information, internet/network activity, and inferences from use. They are used and disclosed for the business purposes described above. We do not sell personal information or share it for cross-context behavioral advertising, and we do not knowingly do so for people under 16. If that changes, we will provide required opt-outs. Applicable state residents may have rights to know/access, correct, delete, obtain a portable copy, opt out of certain processing, limit certain sensitive-data uses, and receive non-discriminatory treatment.

10. Children

The service is not directed to children under 13 and we do not knowingly collect their personal data. Users who cannot legally agree to these terms in their country may use the service only with a parent or guardian. Contact us to report a child's data.

11. Hosted sites and your responsibilities

Customers decide what their generated sites collect and are generally responsible for their own notices, legal bases, consent, and data-subject requests. Depending on the feature, we may act as their processor/service provider. Publishing a generated privacy page does not make a customer's site compliant.

12. Changes and contact

We may update this notice and will change the date above. Material changes will be announced where required. Questions and requests: vilgot@moeschlin.com.