1. Controller
3XAYA LTD (Sitewig), company no. 17437429 (England and Wales), 128 City Road, London EC1V 2NX, United Kingdom. Email: kontakt@sitewig.com.
Enquiries from the EU and EEA about data protection can be sent to kontakt@sitewig.com.
This policy explains how we process personal data as controller about customers, users of the control panel, webmail and the Sitewig Mail app, visitors to sitewig.com, people who contact us and people who report abuse.
When we host websites, email and DNS for customers, we process the customer's data as processor under our Data Processing Agreement; the customer is the controller of that data.
2. What we process, why, and on what basis
| Purpose | Data | Legal basis (GDPR / UK GDPR) | Retention |
|---|---|---|---|
| Creating and running your account and providing the services | Name, email, address, phone, company, VAT number, login data, service history | Art. 6(1)(b) contract | While the account exists + 3 years (limitation) |
| Domain registration | Registrant data required by registries (name, address, email, phone, company/organisation number where required) and identity verification under registry rules | Art. 6(1)(b) and (c) (registry rules, NIS2 Art. 28) | Life of the domain + the period registry rules require |
| Payment and invoicing | Billing and payment details, card country and last 4 digits (card data is processed by Stripe) | Art. 6(1)(b) and (c) | 10 years for invoices and OSS transaction records (Art. 369k VAT Directive); other accounting records at least 6 years (UK) / 5 years (DK) |
| Evidence of VAT country and business status | IP country and billing country at purchase; result of VAT number checks (VIES / Brønnøysund) | Art. 6(1)(c) (VAT rules, Reg. 282/2011 Arts. 18 and 24b) | 10 years |
| Consumer rights | Withdrawals, cancellations, acknowledgements (time and content), consents given when ordering | Art. 6(1)(b), (c) and (f) (evidence) | Term of contract + 5 years |
| Support | Correspondence and call notes | Art. 6(1)(b) and (f) | 3 years after the case closes |
| Security, abuse handling and operations | IP addresses, logs, login attempts, abuse reports | Art. 6(1)(f) legitimate interest; Art. 6(1)(c) NIS2 and DSA | Logs 90 days (security logs up to 12 months); abuse cases 3 years |
| Fraud prevention | Payment risk data (Stripe Radar) | Art. 6(1)(f) | Per Stripe's rules |
| Service emails (receipts, renewal reminders, security) | Art. 6(1)(b) and (c) | While the account exists | |
| Newsletter and marketing | Email, name | Art. 6(1)(a) consent (or "soft opt-in" for existing customers where permitted) | Until you unsubscribe |
| Statistics on sitewig.com | See the Cookie Policy | Consent where required | See the Cookie Policy |
| Legal claims and requests from authorities | Relevant data | Art. 6(1)(c) and (f) | As long as necessary |
We do not make automated decisions with legal effect under Art. 22, except automated fraud screening of payments, where you can request human review.
AI assistant in webmail
Sitewig Webmail has an optional AI assistant that can help you write emails and summarise unread mail. It is off by default for each mailbox and is only used when the mailbox user turns it on and accepts a short consent text.
- Provider: Anthropic, PBC (Claude API, model Claude Haiku), USA.
- Data sent: Only the text you ask the assistant to work on: your draft or the text you have selected, or the subject, sender and a short snippet of unread messages when you ask for a summary.
- Purpose: Processing the text and returning the result to you.
- Retention: Data is processed only to deliver the response. Anthropic retains data only under its API data retention terms (short-term, for abuse monitoring). Anthropic does not use API data to train models.
- Our logs: Sitewig's logs for the assistant contain only counts, never content.
- Transfers: See sections 3 and 4.
The Sitewig Mail app (iPhone and iPad)
Sitewig Mail is our email app for iPhone and iPad. You can add Sitewig mailboxes and external IMAP accounts (e.g. Gmail, iCloud or Yahoo). We process the data below only to provide the app (Art. 6(1)(b) contract); for Sitewig mailboxes, email content is processed as part of our hosted email (see section 1).
- Sign-in: Your email address and password are sent to Sitewig's servers to sign you in. The app does not store your password; it keeps only an encrypted session in the iOS Keychain. For external accounts, the password and server settings are kept only inside that encrypted session token, never in a database or in logs. A session expires after 90 days without use.
- Email and attachments: Messages and attachments are fetched and sent via Sitewig's servers, also for external accounts, where our server connects to your provider on your behalf.
- Notifications: For Sitewig mailboxes only, the app registers a device push token with our mail servers so that new-mail notifications can be delivered via Apple Push Notification service (Apple Inc., USA). Depending on your preview setting (full, sender only or none), a notification contains the sender, subject and a short snippet. The token and the setting are deleted when you remove the account in the app, or when Apple reports the token as invalid. External accounts do not use push; the app checks for new mail in the background.
- Sender pictures: Sender pictures in notifications are fetched by our servers from Gravatar via Sitewig's image proxy. The signed link contains only a one-way hash, never the sender's address, and your device never contacts Gravatar directly.
- Only on your device: Recent recipients for address suggestions, your signature and the app's settings are stored only on the device.
- Face ID and Touch ID: App lock is handled entirely by iOS. The app only learns whether unlocking succeeded; no biometric data leaves the device.
- Camera, photos, microphone and files: Used only when you attach a photo, video or file, record a video or save an image to Photos, and only with your permission in iOS.
- Remote images: Blocked by default to stop tracking pixels. If you choose to load them, they are fetched from the sender's servers, which can then see your IP address and that the message was opened.
- No tracking: The app has no advertising, no tracking and no analytics or crash-reporting tools. We do not use app data for advertising or share it with data brokers.
- App Store privacy details: We have declared to Apple: Email Address, Emails or Text Messages, Photos or Videos and Device ID, used only for App Functionality, linked to you and not used for tracking.
- Removing an account: Settings → the account → Remove Account deletes the push token from our servers, ends the session and removes the account's session, cache and settings from the device. Your email on the server is not affected; a Sitewig mailbox itself is deleted in the control panel. For other deletion requests, write to kontakt@sitewig.com (see section 5).
Build without an account (/build)
When you type what you want to build on the home page or on /build, NinaAI makes a draft of your website before you have an account.
- What we store: Your description, the changes you ask for and the draft of the site. The description may contain personal data if you write it yourself (for example a name or address).
- Purpose and legal basis: To make and keep the draft you asked for (Art. 6(1)(b), steps prior to a contract), and to prevent abuse and limit costs (Art. 6(1)(f) legitimate interest).
- In your browser: The draft and a secret key (claim token) are kept in your browser's local storage (localStorage), so you can carry on where you left off. We also keep a random device ID, used only to prevent abuse, not for tracking or marketing. No cookies are used.
- On our side: The draft and the description are stored on our servers in the EU. The claim token is stored only as a one-way hash, and the IP address and device ID only as a hash with a secret key. When you press "Save and publish", we store a hash of your email address so the link in the sign-in email also works on another device (for one hour at most).
- Claim token: The key gives access to the draft from your browser until you save it to your account. After that, only you can see it when you are signed in.
- How long: A draft that is not saved to an account is deleted after 30 days. If you save it to your account without ordering, it is deleted no later than 90 days afterwards. If it becomes your website, it follows your account. Usage counts (for example "draft shown") without personal data are deleted after 90 days. You can delete the draft yourself with "×" next to "Continue your site" on the home page.
- AI: The description and your change requests are sent to Anthropic, PBC (Claude API) to make the draft. See sections 3 and 4.
- Marketing: The box "Send me tips for my new website" is optional and not pre-ticked. It is stored only as your consent to newsletters and marketing (see the table above), and you can unsubscribe at any time.
Email and reminders when building without an account
- What we store: If you ask for a link to your site, or enter your email when you create an account from /build, we store the email address with the draft. If you tick the box for reminders, we also store your consent, the time and the wording you agreed to. The box is optional and not pre-ticked.
- Purpose and legal basis: To send the link you asked for (Art. 6(1)(b)). Reminders and tips about your site are only sent with your consent (Art. 6(1)(a) and the rules on electronic marketing), and you can withdraw it at any time.
- Reminders: At most four emails: after 1, 3 and 7 days and 5 days before the draft is deleted. They stop when you create an account, unsubscribe, if the email can't be delivered, or when the draft is deleted.
- Unsubscribing: Every reminder has an unsubscribe link. When you unsubscribe, we delete your email address straight away.
- How long: The email address is deleted with the draft after 30 days, straight away when you unsubscribe, or when you save the draft to an account (we then use the account's email).
- Free trial: Without an account you can use AI up to a limited amount. To keep track of it we count usage per device, draft and IP address – only as a hash with a secret key, never the IP address itself. The count is deleted after at most 31 days (Art. 6(1)(f) legitimate interest: preventing abuse and limiting costs).
3. Recipients
We share data only where necessary. We do not sell personal data.
| Recipient | Role | Location / transfer basis |
|---|---|---|
| Hetzner Online GmbH, Gunzenhausen, Germany | Servers, storage, backup, self-hosted mail (Mailu) | Germany and Finland (EU) |
| Supabase Pte. Ltd. (Singapore), data at AWS Frankfurt (eu-central-1) | Account database and login for control panel and webmail (processor) | Data in the EU; possible remote access from outside the EU under EU Standard Contractual Clauses + UK Addendum |
| Stripe Payments Europe, Ltd. (Ireland) and Stripe Payments UK Ltd | Payments: processor for some purposes and independent controller for e.g. fraud prevention and legal compliance | EU/UK; onward transfers to Stripe, Inc. (US) under the EU-US Data Privacy Framework, SCCs and UK Addendum |
| Hosting Concepts B.V. (Openprovider), Rotterdam, Netherlands | Domain registrar | EU |
| Domain registries (e.g. Punktum dk, EURid, Verisign, Nominet, DENIC, AFNIC, Internetstiftelsen, Norid) | Independent controllers of registrant data; may publish data in WHOIS/RDAP under their rules | EU/UK/US (gTLDs) |
| BunnyWay d.o.o. (bunny.net), Ljubljana, Slovenia | CDN for customer websites (Pro/Business): IP addresses and requests | EU company; global edge servers. Transfers to edge servers outside the EU/EEA take place under bunny.net's data processing agreement |
| Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | AI (Claude API) in the website builder (NinaAI), app builder (AYAAI), translation and setup help, and the AI assistant in webmail (only when the user turns it on): processes the content you ask the AI to work on (sub-processor). No other AI providers are used | US; EU Standard Contractual Clauses (2021/914) + UK Addendum |
| Resend, Inc. (US) | Sending transactional email: receipts and reminders, and on behalf of our customers emails to their visitors (contact form, booking, web shop) (sub-processor) | EU-US Data Privacy Framework + SCCs |
| European Commission (VIES) / Brønnøysund Register Centre | Checking business customers' VAT numbers | EU / Norway |
| Accountants and advisers | Bookkeeping and advice | UK/EU |
| Tax authorities (HMRC, the OSS member state of identification, Skatteetaten) and other authorities | Where required by law | – |
4. Transfers outside the UK/EEA
- Our primary data is stored in the EU.
- Transfers between the EU/EEA and the UK rely on mutual adequacy decisions (the EU decision for the UK runs until 27 December 2031).
- Other transfers rely on the EU-US Data Privacy Framework (and UK Extension) where the recipient is certified, otherwise on EU Standard Contractual Clauses (2021/914) with the UK Addendum.
- When a user has turned on the AI assistant in webmail, or uses AI in the website or app builder (NinaAI/AYAAI), the content the AI is to work on is sent to Anthropic, PBC in the US under EU Standard Contractual Clauses (2021/914) with the UK Addendum.
- You can request a copy of the safeguards by writing to us.
5. Your rights
You have the right of access, rectification, erasure, restriction and data portability, the right to object to processing based on legitimate interests and to direct marketing, and the right to withdraw consent at any time. Write to kontakt@sitewig.com. We reply within one month.
6. Complaints
You may complain to the supervisory authority in your country, e.g. Datatilsynet (DK), IMY (SE), Datatilsynet (NO), the Data Protection Commission (IE), CNIL (FR), the competent German state authority, or in the UK the Information Commission (ICO) (ico.org.uk). You are welcome to contact us first.
7. Security
We protect data with, among other things, encryption in transit and at rest, two-factor authentication, need-to-know access control, logging, backups and regular updates. Sitewig is subject to NIS2 as a provider of DNS and domain registration services.
8. Changes
We notify material changes by email or in the control panel. The date at the top shows the latest change (it changes only when the text changes).