Privacy Policy

Last updated: 19 October 2026

This Privacy Policy explains how JW Digital ("we", "us") collects and uses your personal data when you use JW Builder (the "Service"), and your rights under UK data protection law. For the purposes of the UK GDPR, the data controller is JW Digital Services Ltd, company number 15243830, 266 Altrincham Road, Manchester M22 4AA.

1. Data we collect

• Account data — your name, email address, and a securely hashed version of your password (we never store your password in plain text).
• Billing data — if you subscribe to Pro, payments are processed by Stripe. We do not store your card details; we store your Stripe customer and subscription identifiers and your plan status.
• Technical data — your IP address and request metadata, used for security, abuse prevention (rate limiting), and diagnostics.
• Content — the sites and content you create using the Service.
• Connected accounts. If you connect a Gmail mailbox, Google Analytics or Google Search Console, the information described in section 4.
• AI help. If your business uses AI help, we keep a record of each request (when, which part of the product, how much it cost and whether it worked), but not what was written. AI-written wording you keep becomes part of your website. A copy of each AI rewrite is kept for 7 days so a lost answer can be recovered.

2. How and why we use your data

• To provide the Service and your account — lawful basis: performance of a contract.
• To process subscriptions and payments — lawful basis: performance of a contract.
• To secure the Service, prevent abuse, and keep records — lawful basis: our legitimate interests and legal obligations.
• To send service and verification emails — lawful basis: performance of a contract.
• To show and send your email, and show your Analytics and Search Console figures, when you connect those accounts. Lawful basis: performance of a contract.
• To suggest wording for your website with AI help, when your business switches it on. Lawful basis: performance of a contract.

3. Who we share it with

We share personal data with service providers who process it on our behalf, under appropriate agreements:

• Stripe — payment processing;
• Neon — database hosting;
• Vercel — application hosting;
• Cloudflare — storage and delivery of images and files you upload;
• Google (Gmail): sending our own service emails, such as sign-up and password emails.
• Anthropic: AI help with wording, only for businesses that switch it on. It receives what you type into the assistant or the AI setup, and the website wording being changed, processes it in the United States, and keeps it for up to 30 days (longer only where its policies allow, for example to look into misuse or to meet a legal duty). It does not use it to train its models.

We do not sell your personal data. Where a provider is located outside the UK/EEA, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

4. Information from your Google account

You can connect a Gmail mailbox, Google Analytics or Google Search Console to JW Builder. Each is optional. You choose to connect it, on Google's own screen, and you can disconnect it at any time.

Gmail. When you connect a Gmail mailbox, we ask Google for permission to read your email and to send email from your address, and for your name and email address. We use this to show your email in JW Builder's inbox and to let you answer it there.

• What we bring in. Copies of the messages in your mailbox from the 90 days before you connect it, and new messages from then on (we check for them every half hour, or when you ask). We leave out drafts, spam, deleted messages and chats. For each message we keep who it is from and to, the subject, the date, the text of the message (up to 50,000 characters) and the names, types and sizes of its attachments. We do not keep attachment files. When you open one, we fetch it from Gmail at that moment.
• What we send. Only the emails you or your team write in JW Builder, and, if an owner or admin of your business chooses, its business emails such as quotes, invoices and booking messages. They go from your own address, and we keep a copy with the rest of the conversation. If you forward an email with attachments, we copy those files to send them, and delete our copy once Gmail has it, or after 30 days at most.
• What we never do. We never change, move, label or delete anything in your mailbox.
• Who can see it. The person who connected the mailbox, and anyone in the business they choose to share it with.

Google Analytics. If you connect Google Analytics, we ask for permission to read your Analytics data. We read the list of your Analytics accounts and properties so you can choose one, and then the daily visits, users and page views for your website, to show on its dashboard. Only owners and admins of your business can see them.

Google Search Console. If you connect Google Search Console, we ask for permission to read your Search Console data. We read the list of your properties so you can choose one, and then the clicks, searches and positions for your website, with its top searches and pages, to show on its SEO screens. Everyone on your business's team who can open those screens can see them.

We read Analytics and Search Console figures only when you open those screens, and keep the latest copy so they load quickly.

How we look after it. The keys Google gives us to reach your account are encrypted before we store them, and never sent to your browser. Your email and figures are kept in our database, hosted in London, and handled by the hosting providers in section 3 only to run the service.

What we never do with it.

• We use it only for the features described above.
• We never use it for advertising, and we never sell it.
• We never send it to an AI service, and we never use it to develop, improve or train AI or machine learning models.
• Nobody at JW Digital reads it, unless you ask us to (for example, to look into a problem you report), it is needed to keep the service secure, or the law requires it.

Disconnecting and deleting.

• You can disconnect any of these in JW Builder at any time. We then stop reading your account, ask Google to cancel our access, and delete the keys. For Analytics and Search Console we also delete the figures we kept.
• Emails already brought into JW Builder stay with your business's records after you disconnect, so its conversation history is not lost. They are deleted when the website is deleted. If you want them deleted sooner, contact us (section 11) and we will delete them within 30 days.
• If the person who connected a mailbox leaves your business, the connection ends in the same way, and the emails already brought in stay with the business.
• You can also remove JW Builder's access in your Google Account at any time, at myaccount.google.com/permissions.

JW Builder's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Visitors to sites built with the Service

Sites created with JW Builder belong to the customers who build them. If you send an enquiry through one of those sites, your name, contact details, and message go to that site's owner — for that data the site owner is the data controller and we store it on their behalf as their processor, under our Data Processing Addendum. Alongside the enquiry we record the sending IP address and browser identifier, which the site owner can see and which are used to protect the form from abuse. Enquiries are deleted automatically 12 months after they are received, or earlier if the site owner deletes them or closes their account.

To exercise your data protection rights over an enquiry, contact the business you sent it to — they control it. If you cannot reach them, contact us and we will help. Published sites set no advertising cookies, and no tracking cookies unless the business has turned on Google Analytics and the visitor agrees to it.

6. Retention

We keep your data for as long as your account is active. When you delete your account, we delete your account data and content and cancel any subscription; we may retain limited records where required for legal, accounting, or fraud-prevention purposes. What we keep from a connected Google account is kept as section 4 describes.

Copies of deleted data, including data removed at someone's request, stay in our backups after it leaves the service: for up to 14 weeks in our database backups, and in our file backups until our monthly clear-out, between 30 and about 60 days after the deletion. We keep backups only to recover the service after a failure.

7. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. You can exercise many of these directly in your account settings, or by contacting us. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use a strictly necessary session cookie to keep you signed in. We do not currently use advertising or third-party tracking cookies.

9. Security

We protect your data with measures including encryption in transit, encryption of the keys to accounts you connect, password hashing, and access controls. No system is perfectly secure, but we work to protect your information and to notify you and the ICO of any breach where required.

10. Changes

We may update this policy from time to time. We will update the date above and, where changes are significant, notify you.

11. Contact

For any privacy question or to exercise your rights, contact us via jw-digital.co.uk/contact.