Privacy policy
Who we are
umsite (umsite.pt) is operated by Giant Nerd Automation Ltd, a company registered in England and Wales under number 15567873, with its registered office at 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom. This company is the controller of your personal data. If you have any questions about your data, write to contacto@umsite.pt.
What data we collect
- In your request: the name of your business, project or association, your field or industry, the description you write, your email address and, if you provide it, your mobile number.
- In the details you add: logo, photos, address, opening hours, the phone number to show on the site and social media.
- When you use the service: change requests, versions of the site, your acceptance of the terms, your (optional) permission for us to show the site as an example, and the domain you choose.
- Technical logs: your IP address, temporarily, to limit abuse.
We don't ask for a tax number. Payment details (card and billing address) are entered on Stripe's payment page and don't pass through us. From Stripe we only receive confirmation of each payment and the status of your plan.
What we use it for
- Building, changing, publishing and maintaining your site.
- Sending you emails about your request: the link to the site, changes, the address and notices.
- Sending occasional suggestions, such as maintenance options, or requests for feedback. You can stop receiving these emails using the link at the end of each one.
- Protecting the service against abuse.
Who we share it with
We use the following providers to deliver our service. Each processes data only for that purpose:
- Supabase: database and file storage.
- Cloudflare: hosting of the sites, domains, protection against bots (Turnstile) and cookie-free visit statistics.
- Resend: sending emails.
- OpenRouter and the language model provider it routes the request to: the business description, details and change requests are sent to generate the site's text and design.
- Render: hosting of our application.
- Pexels: searching for photos in an image library when you don't add your own.
- Stripe (Link): payments. Stripe sells on our behalf as the merchant of record: it collects payment details, charges VAT and sends receipts and invoices. We send it your email and the business name. The data Stripe collects is covered by the privacy policies of Stripe and Link.
- PostHog: usage statistics and anonymous session recording on our pages, hosted in the European Union.
Where the data is kept
Our application's data is kept in the European Union: the database and files at Supabase (Ireland), the application at Render (Frankfurt, Germany) and the images at Cloudflare R2 (Western Europe). PostHog is also hosted in the European Union.
Some providers are US companies and may process data outside the European Union: Resend (emails), OpenRouter and the language model provider, Cloudflare (the sites' global network and bot protection) and Stripe (payments). In those cases, the transfer is made with the safeguards provided for in the GDPR, such as the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.
We are a UK company. The United Kingdom has an adequacy decision from the European Commission, which recognises a level of data protection equivalent to that of the European Union.
Contact forms on our customers' sites
If your site has a contact form, visitors' messages are sent to your inbox and kept in your dashboard for 90 days, so you can still access them if email delivery fails. They are then deleted. For these messages, the site owner is the data controller; we process them on the owner's behalf, only to deliver and display them.
Whoever sends a message receives an automatic email confirming it arrived. That email doesn't repeat what they wrote. Replies to that email go to the site owner.
Cookies
This site and the sites we publish don't use advertising or statistics cookies. Visits are counted with Cloudflare Web Analytics, which doesn't use cookies.
To understand where people have difficulty, we anonymously record browsing on our own pages. The recording doesn't use cookies, doesn't store anything on your device and isn't linked to you; what you type in forms is hidden.
How long we keep the data
- While your site is active, and afterwards for as long as the law requires.
- Abandoned requests are deleted after 90 days (we keep only anonymous counts, with no personal data).
- The waiting list is deleted 30 days after we notify you, or after 12 months.
- Contact form messages are deleted 90 days after they arrive.
Your rights
You can request access to, correction, export or deletion of your data, and object to receiving suggestions by email. Write to contacto@umsite.pt. You can also lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD).