Privacy Policy
Last updated: 2026-07-16
This page is a structural placeholder pending legal counsel review. It describes current data practices in plain language and will be expanded as GDPR alignment work continues (see internal GDPR compliance plan).
1. Who we are
Webbild ("we", "us") operates a multi-tenant publishing and commerce platform. Depending on the data in question, Webbild acts either as:
- Controller for your Webbild platform account (name, email, login activity), or
- Processor for data collected by a tenant site you visit or purchase from (that site's owner is the controller for their customers and visitors).
2. Data we collect
Depending on how you use Webbild, we process:
- Account data: name, email, password (hashed), optional phone/bio/avatar.
- Security data: login activity, session and authentication tokens.
- Order data (if you buy from a tenant site): name, email, phone, delivery address.
- Newsletter data (if you subscribe): email address and subscription status.
- Analytics data: pseudonymous visitor/session identifiers and aggregated engagement metrics.
- Content you upload: media files and associated metadata.
3. Legal basis for processing
We process account and order data to perform our contract with you. We process security data (such as login history) based on our legitimate interest in keeping accounts safe. Marketing and analytics data that require consent are processed only after you opt in.
4. How long we keep your data
We keep data only as long as necessary for the purpose it was collected for, or as required by law (for example, accounting records). Detailed retention periods are documented internally and will be summarized here as that work is finalized.
5. Your rights
Subject to applicable law, you have the right to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. You can exercise most of these rights directly from your account settings, or by contacting us at info@webbild.com.
6. Subprocessors
To operate the platform, Webbild engages the following subprocessors (and similar infrastructure providers). Categories align with our Data Processing Agreement for tenant owners. A more detailed internal matrix may follow in ops docs; this list is the public L1 inventory.
| Provider | Purpose | Typical data |
|---|---|---|
| Hetzner / Coolify hosting | Application hosting and deployment | Platform and tenant application data in transit/at rest on servers |
| Cloudflare (CDN / DNS / R2) | Edge delivery, DNS, and object storage for media | Request metadata; uploaded media and related metadata |
| Redis | Queues, cache, and background job coordination | Job payloads and transient operational data (may include IDs/emails in queue jobs) |
| Resend | Transactional email delivery | Recipient email and message content for system emails |
| Stripe | Payment processing for tenant shop orders | Customer and payment metadata as required to complete checkout |
| Google / GitHub OAuth | Optional platform sign-in | Account identifiers and profile fields provided by the OAuth provider |
| OpenAI (via Webbild AI service) | Optional AI-assisted content features | Prompts and generated text you submit through AI features |
Tenant owners who need a signed DPA accept it when creating a site (version 2026-07-17). See /dpa.
7. International data transfers
Some subprocessors (for example Cloudflare, Stripe, Google, GitHub, or OpenAI) may process data outside the European Economic Area. Where this applies, we rely on appropriate safeguards under applicable data protection law (such as Standard Contractual Clauses or equivalent mechanisms offered by the provider). Further transfer detail may be expanded in internal ops documentation.
8. Cookies
For details on cookies and similar technologies, see our Cookie Policy.
9. Contact
For privacy questions or to exercise your rights, contact info@webbild.com.