Privacy

Last updated: 2026-09-05

Who is behind this service

What we hold

• Your account: the email address you signed up with, your name if you gave one, and a hash of your password — never the password itself.
• Your sites: the address of each WordPress that uses a key of yours, and how much each one has spent.
• Your usage: one row per generation — when, from which site, which kind of request, whether it worked and what it cost. Not the pages themselves.
• Your billing details, if you filled them in, and a record of what you paid.
• The service log: request identifiers, IP addresses and error messages, which is how a fault gets found and how a limit gets enforced.

What we do not hold

We do not keep the pages you build. The text of a request and the section that comes back travel through the service and are not stored: what stays is the row saying a generation happened and what it cost. We do not read your site's database, we do not copy your content, and there is no analytics script, no advertising pixel and no third-party tracker on any page of this site.

Why we hold it

• To run the service you asked for: without an account and a key there is nobody to bill and nothing to authorise. (Performance of a contract.)
• To bill you and keep the accounts a tax authority can ask to see. (Legal obligation.)
• To keep the service standing: rate limits, abuse, and working out why something broke. (Legitimate interest.)
• To send you the emails the service is made of — your key, a password reset, a warning that your credits are running out. There is no marketing list.

How long

• Your account and its usage history: while the account exists, and for 30 days after you ask us to delete it.
• Payment records: as long as tax law requires, which in most of Europe is ten years. These outlive a deletion request, and they have to.
• The service log: 30 days.

Who else sees it

Only what the service cannot work without, and never for anyone else's purposes. Nothing is sold, and nothing is handed to an advertiser.

• The model provider that performs the generation. It receives the request and the information about your site the request needs — not your account, and not your payment details.
• The mail server that delivers our emails, which necessarily sees the address they go to.
• The company hosting the machines this service runs on.

Cookies

Three, and none of them watches you. There is no consent banner because there is nothing to consent to: all three are strictly necessary, which is the one case the law does not ask about.

• The sign-in cookie: a random token that says you are signed in. It lasts 30 days and it is deleted when you sign out.
• The language cookie: the two letters of the language you chose. It lasts a year.
• The form token, which is what stops another site submitting a form as you.

What you can ask for

A copy of everything we hold about you, a correction, a deletion, or that we stop. Write to the address below and you get an answer within 30 days. Most of it you can do yourself from your account: your details, your keys, your sites. If you think we have handled this badly you can complain to your country's data protection authority.