Privacy Policy
Last updated: 9 August 2026
Widweb is operated by Sarp Egemen, 20 Avenue Albert Einstein, 69621 Villeurbanne, France (the “data controller” for the personal data described here). This policy explains what we collect, why, and the rights you have — written to satisfy the GDPR without burying you in legalese. Short version: we collect the minimum needed to run a website builder, we don’t run ads, and we never sell your data.
1. What we collect
- Account data. Your email address, name, and — if you sign in with Google — your basic Google profile. Authentication is handled by Firebase Authentication.
- Your content. The sites, pages, and images you create. That’s the product; we store it to serve it.
- Billing data. Your subscription status and invoices. Card details are collected and stored by Stripe, never by us.
- Technical logs. IP address, browser type, and request logs, kept briefly for security, debugging, and abuse prevention.
2. Visitors to published sites
Sites published with Widweb are static and set no Widweb cookies. If a site includes a contact form, the submission is processed by us on behalf of the site’s owner (who is the controller for it): we run spam checks, email the submission to the owner, and retain it only for a limited period for delivery and abuse prevention. Questions about a specific site’s data should go to that site’s owner.
3. Why we process it
- To provide the service you signed up for (contract).
- To bill paid subscriptions and keep required records (contract, legal obligation).
- To secure the service and prevent abuse (legitimate interest).
- To send service emails — receipts, security notices, changes that affect you (contract). We don’t send marketing email without your consent.
No advertising, no profiling, no sale of personal data.
4. Who processes data for us
We run on established infrastructure providers, each bound by its own data-processing terms, with EU transfers covered by their standard contractual clauses or Data Privacy Framework certification:
| Provider | Purpose | Where |
|---|---|---|
| Google (Firebase, Google Cloud) | Sign-in, databases, and the services that run Widweb | EU / US |
| Vercel | Hosting for the dashboard, editor, and published sites | EU / US |
| Cloudflare | Content delivery network and media storage | EU / US |
| Stripe | Payment processing — card details go directly to Stripe | EU / US |
| Resend | Transactional email (receipts, notifications, form submissions) | EU |
5. How long we keep it
Account data and content: for as long as your account exists, then deleted within 90 days of account closure (including backups). Billing records: up to 10 years, as French commercial and tax law requires. Technical logs: around 30 days. Form submissions: until the site owner deletes them or their account closes.
6. Your rights
Under the GDPR you can ask for access, correction, deletion, portability, or restriction of your personal data, and object to processing based on legitimate interest. Email support@widweb.com from your account address and we will respond within 30 days. You can also complain to your local data-protection authority (in France, the CNIL).
7. Security
Traffic is encrypted in transit, access to production data is restricted, and payment card data never touches our systems. No internet service can promise perfect security, but the architecture is deliberately minimal about what it collects in the first place.
8. Children
Widweb is not directed at children under 16, and we don’t knowingly collect their data.
9. Changes
If this policy changes materially we will notify your account email. See also our Terms of Service and Cookie Notice.