Privacy policy
What we collect, and why.
We collect what we need to build and run your website, and nothing beyond it. We do not sell data, and we do not share it for advertising.
Last updated 6 August 2026
Who is responsible for your data
WebHostGB is the data controller for the personal data described here. If you want to exercise any of the rights below, or you have a complaint, write to hello@webhostgb.com and a person will respond.
If you are not satisfied with our response, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk.
What we collect
Account details: your email address and, if you give one, your display name. We use email addresses as the sign-in method, so we always hold one for an active account.
Business information: everything you tell us about your business in order for us to build your website -- what you do, your services, your service area, your opening hours, your contact details, and any text, logos or photographs you upload.
Billing information: your subscription status, billing period and Stripe customer reference. We do not receive, see or store your card number. Stripe holds that.
Support correspondence: the content of tickets you raise and messages you send us.
Technical data: your IP address and browser information in server logs, and analytics data if you have consented to analytics cookies.
Why we use it, and our lawful basis
To provide the service you have asked for -- designing, building, hosting and updating your website, and taking payment for it. Our lawful basis is performance of a contract.
To contact you about your website: that a draft is ready, that it has gone live, that a change has been made, or that a payment has failed. Our lawful basis is performance of a contract.
To keep the service secure, prevent abuse and diagnose faults. Our lawful basis is our legitimate interest in running a secure service.
To understand how the marketing site is used, where you have consented to analytics cookies. Our lawful basis is consent, which you can withdraw at any time.
To meet our legal obligations, including keeping financial records. Our lawful basis is legal obligation.
Who we share it with
We use a small number of processors to run the service. Each receives only what it needs, and none of them may use your data for their own purposes.
Stripe processes payments and holds your card details. Cloudflare registers and manages domains, provides DNS, and delivers your website. Postmark sends the transactional emails we send you, including sign-in codes. Anthropic or OpenAI provides the automated content generation used while producing your website, depending on the provider selected by our administrators; the business information you give us for that purpose is sent to the selected provider's API. Pexels supplies stock photography, and receives only search terms, not your data.
Google Analytics receives usage data about the marketing site, but only if you have consented to analytics cookies.
We do not sell personal data, and we do not share it with advertisers or data brokers. We may disclose data if we are legally required to.
Where your data is held
Our servers and database are located in the United Kingdom.
Some of the processors above operate outside the UK, including in the United States. Where data is transferred outside the UK, that transfer is covered by an adequacy decision or by standard contractual clauses, which are the mechanisms UK data protection law provides for this.
How long we keep it
Account and website data is kept for as long as your account is active, and for a reasonable period afterwards so that a returning customer's site can be restored.
Sign-in codes are deleted after two days, and expired sessions are removed automatically. Records of emails we have sent you are deleted thirty days after sending.
Financial records are kept for six years, as UK tax law requires.
You can ask us to delete your account and its data at any time, and we will do so except where we are legally required to keep something.
Your rights
You have the right to ask for a copy of the personal data we hold about you; to have inaccurate data corrected; to have data erased; to restrict or object to how we use it; and to receive it in a portable format.
Where we rely on consent -- which is only for analytics cookies -- you can withdraw it at any time without affecting anything done beforehand.
To exercise any of these, email hello@webhostgb.com. We will respond within one month. We do not charge for this.
Your own website's visitors
The websites we build for you are static pages. They do not set tracking cookies, and they do not collect visitor data unless you have asked us to add something that does.
If your website has a contact form, submissions are sent to your email address. If you ask us to add analytics or any third-party tool to your site, you become responsible for telling your own visitors about it in your own privacy policy.
Security
Traffic is encrypted in transit with TLS. Sign-in uses one-time codes rather than passwords, so there is no password of yours for us to leak. Sessions are held in secure, HTTP-only cookies. Access to production data is limited to the people who need it.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will tell you and the ICO within the timeframes the law requires.
Changes to this policy
If we make a material change we will email you. The version on this page is the current one.
Questions about any of this
If anything here is unclear, or you want something explained in plain English before you commit, write to hello@webhostgb.com. We would much rather answer a question now than have you agree to something you did not follow.