Privacy Policy
Last updated October 16, 2026
The short version. We collect what we need to build and run your website: your email, your site’s public content, payment details (handled by Stripe, not us), and the messages your customers send through your site. We don’t sell anyone’s data. With your consent, our own website uses Google Analytics, Google Ads and the Meta Pixel to measure visits and our ads.
What we collect
- When you start a rebuild or sign in: your email address and your website address. Sign-in is by an emailed link or code; we have no passwords to lose.
- Your public website: the pages, text, images and business details (name, address, phone, hours, services) that anyone can see on it. We copy them to rebuild your site.
- Payments: Stripe processes your card. We receive your name, email, billing country and the status of your payments, never your full card number.
- Your customers’ messages: when someone fills in the contact form on a site we host, we store what they wrote, the details they gave (such as name, phone and email) and their IP address (to block spam), and we forward it to the business.
- Technical data: our servers log requests (IP address, browser, pages requested) to keep the service running and secure. We set the cookies needed to keep you signed in and to remember your cookie choice. If you accept our cookie banner, webfactory.to also loads Google Analytics 4, Google Ads conversion tracking and the Meta (Facebook) Pixel, which set cookies and send Google and Meta information about your visit (pages viewed, device, approximate location, and the ad or link that brought you here) so we can measure traffic and the ads we run. If you decline, Google tags run in a cookieless, consent-denied mode and the Meta Pixel isn’t loaded. You can change your choice by clearing the
wf_consentcookie. When you start a rebuild we pass the campaign tags from the link you arrived on (UTM parameters, Google and Meta click IDs) to Stripe with your order so we know which ad worked. The websites we build for you don’t carry these trackers.
How we use it
- To build, host and update your website, and to show you its progress.
- To deliver contact-form messages to the business they were meant for.
- To bill you, sign you in, and email you about your site and your account.
- To improve our design system. We learn from the sites we build and the feedback on them.
- To show before-and-after examples on webfactory.to (you can ask us to remove yours).
We don’t sell personal information or share it for advertising.
Businesses we contact first
We and our outreach partners may rebuild a business’s public website and contact the business, using contact details published on its website, to offer it the new site. If you don’t want to hear from us, reply or email [email protected] and we’ll stop and, if you ask, delete the rebuild.
Who helps us
We use a small number of service providers, each only for its job:
- Stripe: payments and billing.
- Cloudflare: delivering sites securely and quickly, and the security certificates for your domain.
- AgentMail: sending our email (sign-in codes, notifications and forwarded contact-form messages).
- Anthropic: AI models that help analyse and rebuild website content.
- Google Fonts: some pages load fonts from Google, which sees the visitor’s IP address.
Sites and data are stored on our own servers in the United States. We may disclose information if the law requires it, or to a buyer if WebFactory is ever sold, under this same policy.
How long we keep it
- Account, site and billing records: while your plan is active and afterwards for as long as needed for accounting and legal reasons.
- Contact-form messages: while the site is active with us. You can ask us to delete them sooner.
- Sign-in links and codes expire after 15 minutes and can be used only once.
- Server logs and backups are kept for a limited time (backups for 14 days).
Your choices and rights
You can ask us to show you, correct, export or delete the personal information we hold about you, or to stop contacting you. Email [email protected] from the address on your account. Depending on where you live (for example California or the EU/UK), you may have further rights under local law; we’ll honour them. We’ll answer within 30 days.
If you sent a message through a site we host and want it deleted, email us with the site’s name and we’ll take care of it with the business.
Security
Payment, email and domain credentials are held by a separate internal service that isn’t reachable from the internet. Sign-in links and codes are stored only in hashed form. Everything is served over HTTPS. No system is perfect; if something goes wrong that affects you, we’ll tell you.
Children
WebFactory is for businesses. It isn’t meant for anyone under 16.
Changes
If we change this policy in a way that matters, we’ll update the date at the top and email customers with an active plan.