Privacy Policy

FullStop is a service that designs, builds, and operates websites for businesses using automated, AI-driven workflows. For data you provide to us as an account holder, we act as the data controller. For content and visitor data processed on the websites we host for you, we generally act as a data processor on your behalf, and you are responsible for the privacy practices of the site you publish.

We collect the following categories of information:

• Account information — your name, email address, and a securely hashed password when you create an account.
• Business and project information — details you provide so we can build your site, such as your business name, industry, descriptions, goals, brand preferences, and any text or images you submit. Some of this is processed by our AI providers to generate your content.
• Sites and deployments — the websites we generate for you, their configuration, any custom domains you connect, and administrative credentials we create for your generated site.
• Usage information — limited operational data such as the number of builds and deployments on your account, and technical logs (e.g. timestamps, error messages) needed to operate and secure the Service.
• Communications — messages you send us and emails we send you (such as password resets and deployment notifications).
• Cookies — a strictly necessary session cookie used to keep you signed in (see Section 6).

We do not currently process payments or collect payment-card details through the Service. We do not use third-party advertising or analytics trackers, and we do not sell your personal information.

• To create, build, deploy, host, and maintain your website.
• To operate, secure, troubleshoot, and improve the Service.
• To authenticate you and keep your account secure.
• To communicate with you about your account, builds, security, and support requests.
• To comply with legal obligations and enforce our terms.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you requested); legitimate interests (to secure, maintain, and improve the Service); consent (where required, which you may withdraw at any time); and legal obligation (to comply with applicable law).

We share personal information only with service providers (sub-processors) that help us run the Service, and only as needed for them to perform their function. These include:

• Anthropic — AI processing to generate your website strategy, copy, and layouts from the information you provide.
• Cloudflare — DNS and content delivery / network protection for our platform and connected domains.
• Resend and our own mail infrastructure — to send transactional email (e.g. password resets, notifications).
• Unsplash and Pexels — to source stock imagery used in generated sites.

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a business transfer (e.g. merger or acquisition). We do not sell or rent your personal information.

We use a single strictly necessary cookie (named payload-token) to keep you signed in to your account. It is essential to the Service and cannot be disabled while you are logged in. We do not use advertising, marketing, or third-party analytics cookies on our platform. Websites you build and publish may use their own cookies, which are your responsibility as that site’s operator.

We retain account and project information for as long as your account is active and as needed to provide the Service. If you delete your account or ask us to delete your data, we will remove or anonymize your personal information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Operational logs are kept only as long as needed for security and troubleshooting.

We protect your information using industry-standard measures, including encrypted connections (TLS), hashed passwords, scoped access controls, and isolation between tenant sites. No method of transmission or storage is perfectly secure, but we work to protect your information and to promptly address vulnerabilities we discover.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. EEA/UK users may also lodge a complaint with their local data protection authority. California residents have rights under the CCPA/CPRA, including the right to know, delete, and opt out of “sale” or “sharing” of personal information — note that we do not sell or share personal information for cross-context behavioral advertising.

To exercise any of these rights, email us at [email protected]. We will respond within the timeframe required by applicable law.

We and our service providers may process your information in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards (such as standard contractual clauses) where required by law.

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

Sites you generate and publish are operated by you. You are the controller of any personal data collected from visitors to those sites (for example, through contact forms), and you are responsible for providing your own privacy notice and complying with applicable laws. We process that visitor data only as your processor, to host and operate your site.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Effective” date above and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.

If you have questions or requests about this Privacy Policy or your personal information, contact us at [email protected].