Privacy policy
Who we are
My Webby is a product of RevUp Online Ltd, the data controller for the personal data described in this policy. All personal data is hosted in the EU (Hetzner, Frankfurt) and stays in the UK/EU. To contact us about your data or to make a request, use our contact page.
My Webby customers collect personal data from their own customers (leads and booking contacts) through the CRM. For that data, My Webby is a data processor and the customer is the data controller, governed by the Data Processing Agreement accepted at signup.
What data we collect and why
For platform users (customers and their team):
| Data | Legal basis | Retention |
|---|---|---|
| Name, email, password hash | Contract | Subscription + 30 days post-closure |
| Business name, address, phone | Contract | Subscription + 30 days post-closure |
| Payment card data | Contract | Never stored — Stripe only |
| Billing history, invoices | Legal obligation (tax) | 7 years |
| Subscription status and tier | Contract | Subscription + 7 years |
| IP address, login timestamps | Legitimate interest (security) | 90 days |
| Uploaded assets (logo, images) | Contract | Subscription + 30 days |
| Onboarding content (brief) | Contract | Subscription + 30 days |
| Support communications | Legitimate interest | 2 years |
For preview leads (before signup): name, email, phone and business details, processed under legitimate interest and deleted after 90 days if you do not sign up.
Your rights
Under GDPR you have the right to access, erase, port, rectify, object to, and restrict the processing of your personal data.
- Access: export all your data from your portal under Account settings — delivered within 72 hours.
- Erasure: request account deletion in the portal. Personal data is deleted within 30 days; billing records are anonymised, not deleted, to meet the 7-year tax obligation.
- Portability: export leads and bookings as CSV at any time, and your site content as part of the full data export.
- Rectification: edit your name, email, phone and business details in the portal at any time.
- Object: unsubscribe from marketing emails at any time, and withdraw analytics consent through cookie settings.
Who we share data with
We use the following processors, each under a Data Processing Agreement:
| Processor | Data shared |
|---|---|
| Stripe | Billing data, subscription status |
| Hetzner | All data (hosting, EU-based) |
| Cloudflare | IP addresses, request metadata (CDN) |
| Anthropic (Claude API) | Onboarding content, SEO content prompts |
| MXroute | Email addresses, mailbox credentials |
| Namecheap | Domain registration details |
Cookies
We use essential and, with your consent, analytics cookies. See our cookie policy for the full detail and how to withdraw consent.
Complaints
If you have a concern about how we handle your data, you can make a complaint to the Information Commissioner's Office (ICO), the UK data protection regulator.
Changes to this policy
We may update this policy from time to time. The latest version is always published on this page.