Privacy policy
What we collect, and why.
We collect what we need to build and run your website. We do not sell data. Optional marketing measurement only runs when you agree to it.
Last updated 6 August 2026
Who is responsible for your data
WebHostGB is the data controller for the personal data described here. If you want to exercise any of the rights below, or you have a complaint, write to hello@webhostgb.com and a person will respond.
If you are not satisfied with our response, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk.
What we collect
Account details: your email address and, if you give one, your display name. We use email addresses as the sign-in method, so we always hold one for an active account.
Business information: everything you tell us about your business in order for us to build your website -- what you do, your services, your service area, your opening hours, your contact details, and any text, logos or photographs you upload.
Billing information: your subscription status, billing period and Stripe customer reference. We do not receive, see or store your card number. Stripe holds that.
Support correspondence: the content of tickets you raise and messages you send us.
Marketing enquiries: the details you send through our contact, free website review or partner forms, including your name, email address, business name and a public website address where relevant. If you followed a campaign link, the enquiry also keeps its source, medium, campaign and variant labels so we can tell which activity produced it; these labels do not identify or follow you across the site.
Technical data: your IP address and browser information in server logs, and site or advertising measurement data if you have consented to optional measurement cookies.
Managed website data: enquiries submitted through a customer website, the internal status and follow-up note its owner adds, and the delivery status of review requests. When a review recipient opens our neutral review-request page, we record only the request, time and total number of continue clicks; we do not collect their rating or review text.
Why we use it, and our lawful basis
To provide the service you have asked for -- designing, building, hosting and updating your website, and taking payment for it. Our lawful basis is performance of a contract.
To contact you about your website: that a draft is ready, that it has gone live, that a change has been made, or that a payment has failed. Our lawful basis is performance of a contract.
To keep the service secure, prevent abuse and diagnose faults. Our lawful basis is our legitimate interest in running a secure service.
To answer a contact message, prepare a website review you requested or discuss a referral partnership, and to understand which campaign produced that enquiry. Our lawful basis is taking steps at your request before a possible contract and our legitimate interest in responding to genuine business enquiries and measuring them without building visitor profiles.
To understand how the marketing site is used and which of our adverts lead to enquiries, registrations or purchases, where you have consented to optional measurement. Our lawful basis is consent, which you can withdraw at any time.
To meet our legal obligations, including keeping financial records. Our lawful basis is legal obligation.
Who we share it with
We use a small number of processors to run the service. Each receives only what it needs, and none of them may use your data for their own purposes.
Stripe processes payments and holds your card details. Cloudflare registers and manages domains, provides DNS, and delivers your website. Postmark sends the transactional emails we send you, including sign-in codes. Anthropic or OpenAI provides the automated content generation used while producing your website, depending on the provider selected by our administrators; the business information you give us for that purpose is sent to the selected provider's API. Pexels supplies stock photography, and receives only search terms, not your data.
Google Analytics receives usage data about the marketing site, but only if you have consented to optional measurement cookies. Meta receives page-view and conversion data for advertising attribution on the same basis. Conversion events can include your IP address, browser information and a one-way hash of an email address you submitted; Meta does not receive the plain email address from this integration. Public forms also use Google reCAPTCHA as a strictly necessary security control. It checks interaction and browser information to distinguish people from automated abuse, and it loads only on pages containing a protected form.
We do not sell personal data or share it with data brokers. We may disclose data if we are legally required to.
Where your data is held
Our servers and database are located in the United Kingdom.
Some of the processors above operate outside the UK, including in the United States. Where data is transferred outside the UK, that transfer is covered by an adequacy decision or by standard contractual clauses, which are the mechanisms UK data protection law provides for this.
How long we keep it
Account and website data is kept for as long as your account is active, and for a reasonable period afterwards so that a returning customer's site can be restored.
Sign-in codes are deleted after two days, and expired sessions are removed automatically. Records of emails we have sent you are deleted thirty days after sending.
Financial records are kept for six years, as UK tax law requires.
Contact, website review and partner enquiries are kept only while they remain useful for answering the request and maintaining the resulting business relationship. You can ask us to delete one at any time.
You can ask us to delete your account and its data at any time, and we will do so except where we are legally required to keep something.
Your rights
You have the right to ask for a copy of the personal data we hold about you; to have inaccurate data corrected; to have data erased; to restrict or object to how we use it; and to receive it in a portable format.
Where we rely on consent -- for optional site and advertising measurement -- you can withdraw it at any time without affecting anything done beforehand.
To exercise any of these, email hello@webhostgb.com. We will respond within one month. We do not charge for this.
Your own website's visitors
For personal data submitted by visitors to your customer website, you are the data controller and WebHostGB acts as your processor in providing the managed website service. You remain responsible for an appropriate privacy notice and lawful basis for collecting and using those details.
The websites we build are static pages and our own lightweight action measurement does not set tracking cookies or build visitor profiles. It records anonymous page views and actions such as a phone, email, enquiry or configured external-service click so the website owner can understand whether the site is useful.
If your website has a contact form, submissions are stored securely in your WebHostGB dashboard and notified to your email address. If you enable review requests, the recipient's email address is used to deliver that request and retained with its delivery and link-use record. If you ask us to add any other analytics or third-party tool, you are responsible for telling your own visitors about it in your own privacy policy.
Security
Traffic is encrypted in transit with TLS. Sign-in uses one-time codes rather than passwords, so there is no password of yours for us to leak. Sessions are held in secure, HTTP-only cookies. Access to production data is limited to the people who need it.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will tell you and the ICO within the timeframes the law requires.
Changes to this policy
If we make a material change we will email you. The version on this page is the current one.
Questions about any of this
If anything here is unclear, or you want something explained in plain English before you commit, write to hello@webhostgb.com. We would much rather answer a question now than have you agree to something you did not follow.