1.Overview
This policy explains what personal data TZ Sites collects when you use our website, proposals, dashboard and hosting, how we use it and the choices you have. We collect as little as we need to run the Service, and we never sell personal data.
2.Data we store
- Account data: your name, email address, a securely hashed password, email verification status, and two-factor authentication settings if you enable them.
- Contact information: what you send through our contact form (name, email, business name, current website, budget and message) and our correspondence with you.
- Site content: the text, menus, hours, prices and other content of your website, including drafts and published versions.
- Uploads: images, logos and files you upload for your site.
- Billing records: your Stripe customer reference, what you bought and payment status. Card details are held by Stripe, never by us.
- Logs: security and audit logs of actions in your account, with hashed IP addresses (we do not store your raw IP address) and browser user-agent.
3.How we use it
- To reply to your request and prepare your proposal.
- To provide your account, dashboard, website and hosting.
- To take payments and keep financial records.
- To keep the Service secure, prevent abuse and investigate problems.
- To send essential service emails, such as email verification, sign-in codes, receipts and changes to your service.
4.Who processes it
We share data only with providers that help us run the Service, under agreements that require them to protect it:
- Stripe: payment processing, subscriptions, invoices and the billing portal.
- Cloudflare: content delivery network (CDN), secure tunnel to our servers, Turnstile bot protection on forms, and email delivery.
If you choose to connect an AI assistant such as Claude to your account, the content you ask it to read or change is shared with that provider under its own terms.
6.How long we keep it
We keep account and site data while you have an account with us, and for a reasonable period afterwards to handle your files, domain transfer and any questions. Billing records are kept as long as the law requires. Contact form submissions that don't become projects are deleted or anonymised when no longer needed.
7.Security
Every account requires a verified email address, and two-factor authentication is available. Passwords are hashed, IP addresses in logs are hashed, traffic is encrypted in transit, and access to client data is limited to staff who need it.
8.Your rights and privacy requests
Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to or restrict how we use it. You can download your website files at any time from your dashboard.
To make a privacy request, email [email protected] with the subject “Privacy request”. We may need to confirm your identity first. You can also complain to your local data protection authority.
9.Children
The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data.
10.Changes to this policy
If we make material changes, we will tell you by email or in your dashboard. The date at the top shows when this policy last changed.