Privacy policy

Account data: name, email (when you sign in with Google), phone number (when you sign in by SMS).

Project data: your brief (business, services, products, business contact details, reference websites), uploaded files (logo, photos, product lists) and the generated websites.

Payment data: purchase and credit history. Card details are processed only by Stripe; we never see or store them.

Technical data: IP address, browser type, chosen language, security and error logs.

To provide your account, generate and host websites and process payments — performance of a contract (Art. 6(1)(b) GDPR).

For invoicing and accounting records — legal obligation (Art. 6(1)(c)).

For security, abuse prevention (e.g. limiting AI requests per IP address) and improving the platform — legitimate interest (Art. 6(1)(f)).

For marketing messages — only with your consent, which you can withdraw at any time (Art. 6(1)(a)).

We use providers that process data on our behalf, only for the purposes above: Supabase (database and authentication, servers in Frankfurt, EU), Vercel (platform hosting), Stripe (payments), Google (sign-in and image/video generation), OpenAI and Anthropic (copy and website generation), ClausWeb (domains and hosting) and the SMS provider for sign-in codes.

For generation we send AI providers only the brief, not your account data. In the configuration we use (paid API services) they do not use the data to train their models.

Some providers are outside the European Economic Area (for example in the USA). Transfers rely on the EU–US Data Privacy Framework adequacy decision or the European Commission's standard contractual clauses.

We do not sell personal data.

Account and project data while your account is active. After the account is closed we delete it within 30 days, except invoicing records, which the law requires us to keep for 10 years. Technical logs are kept for up to 12 months.

You have the right of access, rectification, erasure, restriction, data portability and objection, and you may withdraw consent at any time.

Write to office@webooster.ro; we reply within one month. You may also complain to the Romanian supervisory authority (ANSPDCP, dataprotection.ro) or the authority in your country.

Data is transmitted encrypted (HTTPS), access is restricted per user and uploaded files are kept in private storage.