Privacy policy

mywebcms is run by [Legal name of the business], [Registered business address] (“we”, “us”). This policy covers the mywebcms dashboard, its APIs and this website. It is part of our terms of service.

Under India’s Digital Personal Data Protection Act, 2023, we are the data fiduciary for your account data. Where the EU or UK GDPR applies, we are its controller.

mywebcms handles two kinds of personal data:

• Your account data: the details of you and your team that we need to run mywebcms. We decide how it is used, as this policy explains.
• Your websites’ data: the content you publish and what your websites collect from their visitors, such as leads from forms and page views. The website’s owner (you, or your client) decides what is collected and why. We process it only to run that website for them.

If you visited a website built on mywebcms and want to ask about your details, contact that website’s owner. If you write to us instead, we pass your request on to them.

• Account: your name, email address and, if you add them, a photo and job title. Your password is stored only as a secure hash.
• Sign-in: your two-step verification settings and passkeys, which hold no fingerprint or face data: that never leaves your device. If you sign in with Google, Google gives us your name, email address and photo.
• Organizations and teams: the organizations and websites you belong to, your access to each, and the email addresses of the people you invite.
• Billing: the business name, address and GSTIN you give us for invoices, and the payments you make. Card and bank details stay with the payment provider.
• Security: for each device you sign in on, the browser, operating system, IP address and an approximate location, and a history of sign-ins and account changes, so you can spot anything unexpected.
• Your work: what you and your team do in mywebcms, such as edits, Releases, comments and tasks, recorded with who made them. Calls from AI agents connected through MCP are logged with the member and tool used.
• Messages: what you write to us, for example to ask for support or a refund.

• To provide mywebcms: sign you in, show you the websites you can open and deliver your content through your API keys. This is needed for our contract with you.
• To keep accounts and websites safe: detect unusual sign-ins, limit abuse of the APIs and forms, and investigate problems. This is our legitimate interest, and yours.
• To send account emails: sign-in codes, invitations, security notices and notices about your plan or these policies. These are not marketing, so they cannot be turned off.
• To bill you and keep the records tax law requires.
• To answer your messages.

We do not sell personal data, show advertising, or build profiles of you. If we ever want to send you news about mywebcms, we will ask first, and every such email will let you stop them.

• Content: pages, sections, items and media. You control it, and it is public only where you publish it.
• Leads: what visitors type into your forms, with the page, item, referrer and campaign tags they came from. Leads from the Development environment are test data, deleted after 30 days.
• Analytics: page views, counted without cookies. The visitor's IP address and full browser details are used once to make a daily code that changes every day, then thrown away. Admin gives you a paragraph about it for your own privacy notice.
• Spam protection: if you turn on a CAPTCHA (Cloudflare Turnstile, Google reCAPTCHA or hCaptcha) for a form, that provider processes the visitor's data under its own terms.

As the website’s owner, you are responsible for telling your visitors how their details are used, in your own privacy notice, and for answering their requests. We help you do that: leads can be found, exported and deleted from admin. A data processing agreement is available on request at varunsalat@gmail.com.

A website can keep its content in its own PostgreSQL database and its files in its own S3-compatible bucket. Once a website moves to its own database, its content, history, media records, forms, leads and analytics are stored only there: we keep no copy and no backup, and looking after that data is the website owner’s responsibility. Accounts, organizations, access and settings always stay with mywebcms.

When someone on your team starts an AI import, the screenshots, page address and page text they choose are sent to an AI provider to propose sections and fields. Nothing is sent unless a person starts it.

• With mywebcms AI, the provider is Google (Gemini), on its paid service, which does not use what is sent to improve its products.
• With your website's own AI key (Google, OpenAI or Anthropic), the content goes to your own account with that provider, under your agreement with it.
• We record who ran each import, for which feature and how much it used, never the prompts. Your own AI key is encrypted, and nobody, including our staff, can read it back.

We use service providers to run mywebcms. They process personal data only on our instructions, under contracts that require them to protect it:

• hosting and managed PostgreSQL providers, for the servers and databases mywebcms runs on;
• Upstash, for caching, rate limits and background jobs;
• an S3-compatible storage provider, for media files;
• Resend, to send account emails;
• Google, for Sign in with Google and Gemini (mywebcms AI), and for the page speed checks of search visibility, which send only a website's public address;
• our payment provider, once online billing is available.

We also share personal data when the law requires it, to protect people or mywebcms from harm, or as part of a merger or sale of the business, in which case this policy keeps applying to it. We never sell it.

Our providers may store or process data outside India, including in the United States and the European Union. We only use providers that protect it to the standard this policy describes, and we follow any restrictions the Government of India places on transfers to particular countries.

• Account data: while your account is open.
• When you delete your account, your name, email address, photo and job title are removed at once, and so are your passwords, passkeys, two-step settings, sessions and access. What you made in mywebcms stays, marked as by a “Deleted user”, so your team keeps its history. The sign-in history of a deleted account is kept for security and fraud prevention.
• Content, leads and analytics of a website: until its owner deletes them or the website, except as below.
• Analytics page views: 30 days (7 in Development), after which only daily totals are kept, for 2 years.
• Test leads from Development: 30 days.
• MCP activity logs: 90 days.
• Invoices and payment records: as long as tax law requires.
• Backups: deleted data can remain in encrypted backups for up to [N days], until they expire.

• Everything is sent over HTTPS, and passwords are stored only as secure hashes.
• Two-step verification and passkeys protect sign-ins, and you can sign out any device from your account.
• Each website's data is kept apart from every other website's, by the database itself as well as by our code.
• Secrets you give us, such as storage, database, CAPTCHA and AI keys, are encrypted.
• Staff access to production data is limited and logged.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities without undue delay, as the law requires.

• This website sets no cookies and runs no third-party analytics or advertising. It keeps your theme and currency choice in your browser's local storage, which never leaves your device.
• The dashboard uses cookies only to keep you signed in and secure. They are needed for it to work, so there is nothing to opt out of.
• The analytics script your websites can use sets no cookies and stores nothing on visitors' devices.

You can:

• see the personal data we hold about you and how we use it;
• correct or update it; most of it you can change yourself in your account settings;
• delete your account, from your account settings, or ask us to erase your data;
• withdraw any consent you gave us, at any time;
• under Indian law, nominate someone to use these rights for you if you die or cannot use them;
• where the GDPR applies, also object to or restrict how we use your data, and get a copy in a portable format.

Write to varunsalat@gmail.com from your account’s email address. We may ask you to confirm it is you. We reply within 30 days.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India or, where the GDPR applies, to your local data protection authority.

mywebcms is for people aged 18 and over. We do not knowingly collect personal data from children. If you think a child has given us their details, tell us and we will delete them.

We may update this policy. For changes that matter, we email the organization owners before they take effect. The date at the top of this page shows the latest version.

Questions, requests and complaints about your personal data go to our grievance officer, [Name of the grievance officer]: write to varunsalat@gmail.com, or to [Legal name of the business], [Registered business address].