Your information, kept small.

Your name, business name, email and phone; your answers to the questionnaire and the link to the folder you share; your requests and our messages; your payment history (amounts and dates); and a record of what you agreed to when you started (the version of our terms, the boxes you ticked, the prices you were shown, and when).

Name, email and business name are needed to start. Everything else is up to you, but the questionnaire's required answers are what we build your site from: without them we can't start.

Card details are handled by Stripe, our payment provider. We never see or store your card number.

Your portal uses one cookie that keeps you signed in (for up to 14 days, or until you sign out), and nothing else. Of your private link we keep only a fingerprint that cannot be turned back into the link. If you turn on two-step sign-in, we keep the key for your codes encrypted, and your recovery codes only in a form that cannot be read back. To stop password guessing, we keep a scrambled form of your internet address for up to an hour after a failed sign-in.

This website itself sets no tracking or advertising cookies. While you fill in the questionnaire, your draft is saved in your browser and, when you open it from your portal, in your portal record, until you send it.

To build your site, reply to you, do your requests, send invoices and receipts, and remind you about things like domain renewals. We don't sell your information or use it for anyone else's marketing.

Only the services we use to do the work, and only what each needs:

• Vercel (USA): hosts this website and your portal; portal records are stored in its Sydney region.
• GitHub (USA): holds your site's code, and makes the download of your site.
• Stripe (USA): card payments, once switched on.
• Our email provider: the emails we send you. [email provider, once chosen]
• Cloudflare (USA): domains, and hosting for sites you host yourself.
• Google (USA): only if you use Google Ads or Search Console with us.
• AI providers, only if you use our AI services: [AI providers, once chosen].

Most of them are overseas. [how sending information overseas meets Privacy Act principle 12, after legal review]

Enquiries and leads from your website (for example from a contact form or an AI front desk) belong to you. We process them on your behalf, only to deliver them to you and to keep the service running, and we don't use them for anything else.

Your visitors need to know who collects their details and why. Any site we build with a form or an AI front desk gets a short privacy statement for visitors, naming your business and saying that Weble and the services above process their details for you; keep it accurate as your business changes.

Your portal record (questionnaire, messages, requests) is kept while you are a customer and for 12 months after you leave or your project closes, so we can help if you come back; then we delete it, including the downloads of your site we hold and the working copy of your questionnaire on the computer we build your site on (we check every month for records that are due). Until that copy is confirmed deleted, we keep a note of your customer number, business name, the deletion date and which of our computers held a copy (with a check code for each, so only that computer can confirm), to make sure it happens; nothing else from the record. Your website itself (its code, texts and photos, in its repository and on its hosting) is separate from the portal record: it stays while we host or look after it, and when you leave, you get a download of it and we delete our copy when you ask. Invoices and payment records are kept for 7 years, as New Zealand tax law requires. Copies held by the services above follow their own deletion schedules.

You can ask for a copy of your information, or ask us to correct or delete it. Write to us from your portal or to [contact email]. We check it is you (through your portal, or the email address we have for you) before sharing or changing anything, and reply within 20 working days. If we correct something, we pass the correction on to the services above that hold a copy. If we don't agree a correction is needed, we keep your statement with the record.

Visitors to a site we look after can ask that business; we help it answer.

If you're not happy with how we handle it, you can complain to the Privacy Commissioner at privacy.org.nz.

If information we hold is lost, or seen by someone who shouldn't see it, we act straight away to contain it and assess the harm. If it is likely to cause serious harm, we tell the Privacy Commissioner and the people affected as soon as we practicably can, as the Privacy Act 2020 requires. If it involves your site or your visitors, we tell you too, and work with you on what your visitors need to know.