Privacy Policy

The primary version of the document is in English. Texts in other languages are provided for convenience; in case of discrepancies, the primary version shall prevail, except where mandatory provisions require interpretation in the language of the consumer.

1. Who processes your data

Data Controller in the context of Regulation (EU) 2016/679 (GDPR):

Further – "we", "service". We do not appoint a Data Protection Officer (DPO): the scale of data processing does not require it.

2. Two different roles

This is the key distinction, from which everything else depends.

Regarding the data associated with your account – we are the controller. Email address, name, session data, payment information: we determine how and for what purpose this data is processed, and we are responsible for this before you.

Regarding the content of your websites: you are the controller, and we are the processor. We store and provide files according to your instructions, without determining the purposes of their processing. If the published website contains personal data of third parties – texts about employees, customer reviews, photographs, a contact form – you are responsible for providing the legal basis for their processing. Our obligations as a processor are set out in the Data Processing Agreement (DPA): it is part of the Terms of Service and applies automatically, without a separate request.

The published website is accessible to anyone on the internet. We cannot restrict the number of people who view it.

3. We collect very little, and here is what we do not collect

The service is structured in such a way that it requires very few personal data. Websites that are published are, by their nature, publicly accessible, and all that is required for operation is to know the account holder and whether a subscription has been paid.

Therefore, we do not collect:

• information about your website visitors. We do not track visits, do not use counters, and do not maintain request logs. Website infrastructure-level monitoring is disabled: visitor requests are not stored anywhere. If you require statistics, you are responsible for providing them yourself, and you are responsible for obtaining consent for their use.
• passwords. Access is via Google or a one-time code; we do not require passwords.
• Payment details. Stripe is the only party that can view the card.
• the content of your websites for analytical purposes. We do not read files, index them, or use them to train models;
• advertising data without your consent. Without your consent to advertising, no advertising tags or signals are used. With it, we only measure our advertising on Google: whether it led to a registration or a payment (Section 4.5). We do not profile you or track you across other websites.

Analytics of visits to our own pages and measurement of our advertising do exist, and they work only with your consent: before you consent, the tracking code is not loaded at all. What exactly is collected is described in Section 4.5; how to opt out, in Section 11.

The IP address and browser string are recorded once, upon creating a login session, and are only needed so that you can distinguish your sessions from one another. They are not collected during normal use of the service.

The rate limiting of code requests to email is implemented such that the IP address is not stored. A counter is maintained based on an irreversible value calculated from the address using our secret. The original IP address cannot be recovered from this value, and the counters are deleted after their expiration period.

4. What data do we collect

4.1. Account and Login

Via Google. Google provides us with the following information: email address, name, link to profile picture, email verification status, and your Google account's permanent identifier. We do not see or obtain your Google password.

Using a one-time code. We only receive the email address. The code is stored as an irreversible hash and is deleted after use or expiration.

4.2. Automatically upon use

• IP address and browser string (User-Agent) – are recorded once, at the time of session creation; subsequent requests do not collect this information.
• Login time, last activity time, and session end time
• Publication History: Time, Result, Website Identifier, and Error Text if Publication Failed

4.3. Content of your websites

Files that you or an AI agent acting on your behalf upload for publication: HTML, CSS, JavaScript, images, fonts, and other static files. We do not analyze their content, index it, or use it for any purpose other than hosting it on the internet at your request. We do not use the content of your websites to train models.

4.4. Payment information

Payment card details are processed by Stripe. We do not receive, view, or store them. In our own records, we retain the customer and subscription identifiers in Stripe, as well as payment amounts, currency, status, and dates – this is required for accounting purposes.

The free period is provided once per email address, including after deleting an account and registering again with the same address (Section 1.1 of the Purchase Policy). Therefore, when the free period begins, we store a record of it — a hash of your email address, calculated with a secret key, without the address itself. The address cannot be recovered from this hash. The record is kept for 24 months and is not erased when the account is deleted — otherwise the period could be obtained again.

While the account has no subscription, we ask Stripe once whether customers with your email address have had subscriptions, and we store only the answer — yes or no: it determines whether the dashboard shows access to the invoices of previous subscriptions. The answer is erased when the account is deleted.

4.5. Analytics of our pages and advertising measurement

Google Analytics is active on the landing page, in the personal account, on the blog and on the legal pages. It collects anonymized information about visits: pages viewed, approximate location based on IP address, device and browser type, traffic source, and key actions such as login initiation, code request via email, registration, viewing prices and starting checkout.

Events we report ourselves. The browser does not see the first publication of a website or a payment: your AI agent publishes the website, and Stripe confirms the payment. If you have consented to analytics, the personal account tells us the identifier Google Analytics uses to distinguish visitors (the _ga cookie), and we send two events to Google Analytics under that identifier: the first publication of a website, and a payment — amount, currency, plan or domain, and invoice number. If you withdraw your consent, the identifier is erased on your next visit to the personal account, and these events stop.

Google Ads — only with your consent to advertising. If you have also consented to advertising (marketing), Google receives information about your registration and payment so that we can see which of our ads led to them, and may include you in audiences for showing our ads. For accurate matching (enhanced conversions), Google receives a hash of your email address — an irreversible SHA-256 value that Google matches against its own accounts; we do not transmit the address itself. Without consent to advertising, there is neither the hash nor any advertising signals.

Three things you should know about this:

• The counter does not function without your consent. Before you click "Accept" in the banner, its code is not loaded: no requests are sent and no cookies are set. Declining means that analytics will not be used for you.
• This applies only to our own pages. We do not count or track visits to your published websites – see section 3.
• Google does not receive the content of your websites or your access keys. Your email address is sent only as a hash and only with your consent to advertising. We do not transmit your account identifier or information about your websites, other than the fact of the first publication.

4.6. Domain orders

If you purchase a domain through the service, we retain the order: the domain name, the price and currency shown to you, the website the domain is to be connected to, the time and status of the order, and the access key used to place it.

To register the domain in your name, we ask for the details of its owner: name, organization (if any), email address, phone number, and postal address. We store them encrypted only until registration and erase them immediately after it. If the payment fails, the details are erased immediately; if the order is not paid, no later than two days after it was placed.

We pass the owner's details to the domain registrar Cloudflare, Inc. (USA) and, through it, to the registry of the domain zone: without this, the domain cannot be registered. From then on, the registrar and the registry hold them as independent controllers, under their own rules and the rules of ICANN. In the public WHOIS database, the owner's details are hidden.

The transfer to the United States relies on the certification of Cloudflare, Inc. under the EU-U.S. Data Privacy Framework (Article 45 GDPR). The registry of the domain zone may also be located outside the EEA — for example, the registry of the .com zone is in the United States; the registrar transfers the details there because this is necessary to perform the domain registration contract you enter into (Article 49(1)(b) GDPR).

For a registered domain, we retain its name, its registration period, the website it is connected to, and whether the owner has confirmed their email address with the registrar.

4.7. Reports of illegal content

If you report illegal content through the form at aiput.site/report, we receive the address of the page, what is wrong with it, your explanation, your name and email address, and the language of the page from which the report was sent. We need them to review the report, confirm its receipt and tell you the decision, as required by Article 16 of Regulation (EU) 2022/2065 (Digital Services Act). Child sexual abuse material can also be reported without a name and email address.

If a report concerns your website and we take it offline, you receive a statement of reasons: what was done, what was reported, our assessment, the ground, and how to object. We do not disclose to you the name or email address of the person who made the report.

5. Why and on what grounds

The legitimate interest in the rows on abuse prevention and enquiries is ensuring the proper functioning and security of the service; in the row on the free period, it is providing it only once, as promised; in the row on invoices, it is giving you access to the invoices of previous subscriptions after registering again; in the row on law enforcement requests, it is being able to answer a lawful request about a website that was at that address, even after it has been deleted. You have the right to object to such processing (Section 9).

Analytics and advertising are the only processing performed on the basis of consent. Consent is voluntary, and refusal does not affect the service, and it can be revoked at any time as easily as it was given (Section 11). We are obligated to store a record of this consent to confirm its existence, therefore it has a separate basis.

Your data is used for advertising only with your consent and only as described in Section 4.5. We do not profile you and do not make automated decisions regarding you with legal consequences.

6. How long do we retain your data

The retention periods are managed through daily automated clean-up, rather than manual intervention: upon its occurrence, records are deleted without your request or our involvement.

Upon deletion of your account, a string containing only your internal identifier and a deletion marker will remain, without your address, name, or any other personal information. This is necessary to free your email address – otherwise, it would not be possible to create a new account using the same email address. The record of the free period also remains — a hash of the address, without the address itself (Section 4.4).

We are legally obligated to retain payment records and cannot delete them earlier than required by law, even at your request. This constitutes a direct limitation on the right to deletion (Article 17 of the GDPR).

7. To whom do we transfer data

We do not sell your data or transfer it to third parties for their own purposes. We use the services of third-party processors:

A data processing agreement has been concluded with each party.

The details of the owner of a domain you purchase through the service are received by the registrar as an independent controller – see section 4.6.

When you pay, your details — name, email address, country, payment details, and the purchase — are received by Link, LLC (USA), the merchant of record through which Stripe sells our subscriptions and domains (Stripe Managed Payments). It acts as an independent controller under its own privacy policy; we receive from it only what is described in section 4.4.

The parties with whom you interact directly, we will identify by name. We categorize infrastructure providers; the specific composition may vary, and we do not believe it is appropriate to disclose the details of how the service is built beyond what is necessary. An up-to-date list of processors with names is available upon request at pavel.knx@gmail.com – this is your right under Article 15 of the GDPR, and we cannot refuse it.

We may also disclose information if required by law or in response to a valid request from a duly authorized governmental agency or regulatory body.

8. Transfer outside the EEA

Certain processors may process data in the United States or other countries outside the EEA. In such cases, we ensure compliance with Chapter V of the GDPR: standard contractual terms (SCC), approved by the European Commission, and/or certification of the recipient under the EU-U.S. Data Privacy Framework. Copies of the guarantees and an up-to-date list of recipients can be obtained at pavel.knx@gmail.com.

Regarding analytics and advertising: Google Analytics and Google Ads transmit data to Google LLC (USA). Google LLC is certified under the EU-U.S. Data Privacy Framework. This transmission only occurs if you have given your consent; by declining, you exclude this as well.

Regarding payments: Link, LLC (USA) receives the buyer's details as the seller — see section 7. The transfer is necessary to perform the purchase you make (Article 49(1)(b) GDPR).

Regarding domains: the domain owner's details are received by the registrar Cloudflare, Inc. (USA), which is certified under the EU-U.S. Data Privacy Framework, and from it by the registry of the domain zone; the grounds are set out in Section 4.6.

9. Your Rights

• Access (Article 15) – to obtain a copy of your data
• Correction (Article 16) – to correct inaccuracies
• Deletion (Article 17) – the right to delete is not absolute: payment records are retained due to legal obligations (Section 6)
• Limitation of Processing (Article 18)
• Portability (Article 20) – obtain data in a machine-readable format
• Objection (Article 21) to processing based on legitimate interests
• Withdrawal of consent (Article 7(3)) – at any time, without affecting the legality of prior processing.

Contact us at pavel.knx@gmail.com. We will respond within 30 days. We may request proof of identity if the request is not made from an address associated with the account.

Right to Complain (Article 77). The supervisory authority of the controller is the Agencia Española de Protección de Datos, Spain, www.aepd.es. If you are located in the EU/EEA, you may also contact the data protection authority in your country of residence.

10. Account Deletion

The account can be deleted in the personal account. Upon deletion:

• Websites are immediately removed from publication;
• the subscription is cancelled immediately, and no further charges will be made;
• website files, publication history and the record of the website (its address and dates) will be deleted within the timeframe specified in Section 6;
• active sessions and access keys are revoked, and the key value itself is erased;
• domain orders that did not result in a registered domain are deleted; a registered domain remains yours until the end of the paid period, but is no longer linked to the account and is not renewed;
• Payment records are retained for the period specified by law.

You do not need to cancel the subscription separately before deleting the account. The terms of cancellation and refund for unused periods are described in the Purchase Policy.

11. Cookies

Cookies on our website come in three types: technically necessary, which are always set, and analytical and advertising cookies, which are set only after your consent — each type with its own.

Technically required

Consent is not required: the service will not function without them.

The cookie banner is included in this list for a reason: if we had not saved your preferences, we would not have been able to implement them, and we would have asked you again each time you visited the site.

Analytical data – only with consent

Without your consent, it does not function. The counter code does not simply remain inactive – it does not load at all: there are no requests to Google, no cookies. By clicking "Decline", you leave the service in this state permanently, and it has no impact on its operation.

Advertising – only with consent to marketing

How to change a decision

The banner appears upon the first visit and offers "Accept" and "Decline" – these options are equivalent, and declining is as simple as accepting. You can change your decision at any time: in the bottom right corner of any page, there is a privacy settings icon that opens the same choice. Withdrawal of consent applies to the future and does not negate the lawfulness of processing prior to it (Article 7(3) GDPR).

Advertising cookies are set only with your consent to marketing; without it, there are neither such cookies nor advertising signals to Google. We do not track you across other websites.

Your published websites may contain their own cookies, and you are responsible for them and for obtaining consent for their use.

12. Safety

Measures under Article 32 of the GDPR:

• encryption during transmission – HTTPS/TLS on all connections;
• encryption at rest at the infrastructure level provided by the vendor;
• Login via OAuth 2.0 / OpenID Connect and one-time codes – we do not obtain or store your password;
• Credentials are protected by additional security measures at the application level;
• resource ownership check upon each request – access to someone else's website is not possible using your key;
• user data isolation;
• Rate limiting and protection against automated abuse.

No system is absolutely secure. In the event of a breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours (Article 33) and, in cases of high risk, you (Article 34).

13. A single standard for all countries

We apply a single standard of personal data protection to all users, regardless of their location. This standard is based on GDPR: the legal grounds, the rights of subjects, the retention periods, and the requirements for processors, as well as the guarantees of transfer, as outlined in sections 2–12, all apply to everyone. If the mandatory laws of your country of residence grant you more rights or shorter retention periods, those laws will apply.

14. Age

This service is not intended for persons under the age of 18. We deliberately do not collect data from children.

15. Changes

We may update this Policy. We will notify you of any material changes by email at least 30 days before the changes take effect. The version and date are indicated at the beginning of this document.

16. Contacts

pavel.knx@gmail.com