Privacy Policy

1Data Controller

2Data We Collect

2.1 Data you provide

• Registration: username, email, password
• Plus service: billing details (name, address, tax ID)
• Domains: registrant data required by ICANN
• Content: text, images and files you upload to your website

2.2 Automatically collected data

• IP address
• Browser and device type
• Date and time of access
• Pages visited within the service

2.3 Use of the editor on your own website

While you edit your website, we record the steps you take inside the editor (opening the editor, creating, renaming or deleting a page, inserting or deleting a section, saving content, switching the design, and the error messages shown to you). The purpose is to find out where people get stuck and fix exactly that.

We deliberately do not store your IP address, your browser or the content you write here: only the type of block (for example "large hero") and the page title as context. This covers your own actions on your own project only, never data about your visitors.

2.4 The reason you give when asking for deletion

When you request the deletion of your website, we ask you to tick why you are leaving (the site did not convince you, it felt awkward to use, you no longer need a website, you built it elsewhere, you were only trying it out, or another reason). A comment is optional. We store that answer together with your username and how many days you were with us.

It serves exactly one purpose: finding out what does not work and fixing it. The comment stays optional; picking a reason is required before the request can be sent.

2.5 AI helper in your panel and editor

Inside the control panel and the editor there is a helper that answers questions about your own website. The replies are generated by an artificial intelligence, not a person, and the helper says so before you type anything.

What you write to it is sent to Anthropic PBC (Claude models, servers in the United States) so it can answer. We also send the state of your own site (for instance whether a section still holds example texts) and your username. Your email address, your IP and your visitors’ data are not sent.

We store the full conversation: what you write, what we send to the model along with it, the helper’s reply and the changes it made to your site, plus the time, your account, the model used and the cost. We use it to improve the helper, our customer support and Palimpalem as a whole, and to check whether another model would answer better. The conversation texts are deleted after 12 months; after that only the cost figure remains, without any text.

You can tell the helper to speak up less often, and your account remembers that.

2.6 AI assistant when you create your site

When you build your site with the Palimpalem assistant, what you type in that chat and the photos you upload are sent to Anthropic PBC (Claude models, servers in the United States) to suggest a name and set up your first texts, sections and colours. The replies are generated by artificial intelligence.

If you turn the voice on, the text of the assistant’s reply is sent to OpenAI (servers in the United States) to be read aloud. Only that text, nothing else.

Here too we keep the complete conversation, with the time, the model used and the cost, for the same purpose and period as in section 2.5: the texts are deleted after 12 months, or earlier if you delete your account. We keep no copy of your photos in that record, since they are already on your site.

2.7 Measuring our ads and protection against abuse

If you reach Palimpalem from one of our ads, we store which campaign you came from (the link parameters, such as utm_campaign) and the steps you take on the creation page: opening it, tapping the field, creating the draft, tapping “Save my website free”, signing up and paying. We store this on our own server, without cookies and without your IP, to know which ads work. These records are deleted after 12 months.

If the ad is from Meta (Facebook or Instagram), the link carries a click identifier added by Meta (fbclid). When you create a draft, tap “Save my website free”, sign up or pay, our server sends Meta Platforms Ireland Ltd. that identifier, the type of step, the time, the page address and your browser type (user agent), and for a payment its amount. We do not send your email, your name or your IP, and we do not load any Meta pixel or script in your browser. The identifier is pseudonymous: Meta can link it to the click on its ad. Legal basis: our legitimate interest in measuring and improving our advertising (Art. 6(1)(f) GDPR). You can object at any time as described in section 6. If you open the page without fbclid in the address, nothing is sent.

To protect free website creation against automated abuse we use Google reCAPTCHA v3 (Google Ireland Ltd.). reCAPTCHA analyses technical data from your browser and your use of the page and sends it to Google. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Google’s privacy policy and terms apply.

If you dictate by voice, your browser’s speech recognition turns it into text. If your browser has none (for example inside the Instagram app), the recording is sent to OpenAI only to turn it into text. We do not keep the audio.

3Purposes and Legal Basis

4Recipients of the Data

The following providers process data on behalf of Palimpalem as data processors:

5International Transfers

The vast majority of our providers are located within the European Economic Area (EEA). When transferring data outside the EEA is necessary, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decision for the destination country

6Your Rights

As a data subject, you have the following rights:

• Access — to know what personal data we process about you
• Rectification — to correct inaccurate or incomplete data
• Erasure — to request the deletion of your data ("right to be forgotten")
• Objection — to object to the processing of your data
• Restriction — to request that processing be restricted in certain circumstances
• Portability — to receive your data in a structured, commonly used format

7Right to Complain

If you believe that the processing of your data does not comply with regulations, you may file a complaint with the competent supervisory authority:

8Data Security

We apply technical and organisational measures to protect your data:

• Encrypted connections (HTTPS/SSL/TLS) across the entire site
• Passwords stored with bcrypt hashing
• Daily encrypted backups
• Restricted access to personal data (least-privilege principle)
• Servers physically located in Germany (EU)
• Continuous security monitoring and intrusion protection

9Minors

Use of Palimpalem is reserved for people aged 14 or older (minimum age for digital consent in Spain under LOPDGDD). Minors under 14 need express authorisation from their legal guardians, who must register on their behalf and accept the terms of service.

10Cookies

Palimpalem uses only strictly necessary cookies for the operation of the service. We do not use analytics, advertising or third-party cookies. For more information, see our Cookie Policy.

11Modifications

We reserve the right to modify this Privacy Policy to adapt it to legislative or jurisprudential developments. We will notify you of any significant changes via the registered email address or a notice in the Control Centre.

12Related Documents