Your data, handled properly.
We build sites and systems that handle real business data, so we treat yours the way you would. Here is exactly where it goes, who touches it, and the rights you keep.
Where your site and its data live
Sites are hosted on Vercel with EU edge regions available, and we set EU-region processing before we build when a project needs it. The systems we attach to a site (quote calculators, booking flows, follow-up automation) run on our own backend and store the minimum a given flow needs: the enquiry itself, and nothing more. Call bookings run through Cal.com in its EU region.
Sub-processors
For a standard site: Vercel (hosting), Resend (transactional email), Cal.com EU (bookings), and whatever you already use and ask us to connect, such as your CRM, mailbox or CMS. You get the full list for your build in writing before launch, and you keep ownership of every account and API key. We do not add a processor to your stack without telling you.
GDPR and your rights
For data your site collects from your customers, you are the data controller and we act as your processor. A Data Processing Agreement is available on request and signed before any live data is touched. Access, correction and deletion requests are honoured, and we purge project data on offboarding. For data this website collects about you, see our Privacy Policy.
Confidentiality and NDA
A mutual NDA is standard on every engagement, signed before we receive anything, at no charge. For agencies: we never contact your client, your work is not published in our portfolio or on our socials, and your relationship stays yours. This is a term in our Terms of Service, not a courtesy.
Security practices
Least-privilege API keys scoped to each integration, secrets in environment variables rather than in code or repositories, HTTPS only, and access revoked the day a project ends. Delivered sites, code and IP transfer to you on full payment, with the domain in your name throughout.
Contracts and invoicing
You contract and are invoiced through Webex LLC, registered in Montana, USA. Contracts are in English. EU, EEA and UK clients are covered by Dutch governing law and Amsterdam jurisdiction, and we work EU business hours so you are never waiting on a different timezone for an answer.
Have a specific question about data handling or need a DPA before we start?