Summary

• Who we are. Webmarlin (webmarlin.com, webmarlin.ai) is operated by HEAVENAPPS, INC., a Delaware corporation.
• What we collect. Your account details, billing records (Stripe holds your card), the content you put on your websites, and the AI chats you have with us. For the websites you build, we also store your visitors' form submissions and your shop orders.
• Two roles. For your own account, we decide how your data is used (we are the controller). For the people who visit your sites, fill in your forms or buy in your shop, we act on your instructions (we are your processor; see Section 13).
• No selling. We do not sell personal information. We do not share it for cross-context behavioural advertising.
• Visitor counting. Published sites set one first-party cookie, wmr_vid. It holds a random identifier and is used only to count visits against the site's plan. It carries no advertising and no profiling.
• Deletion. Email us to delete your account. We delete or anonymise account data within 30 days. Your sites go offline at once, and their content is deleted after 90 days (Section 9).
• Your rights. You may have rights to access, correct, delete or port your data, and to object. California (Section 11) and EU/UK (Section 12) residents have specific rights.
• Contact. [email protected]

1. Who we are and what this policy covers

1.1 "Webmarlin", "we", "us" and "our" mean HEAVENAPPS, INC., a Delaware corporation. Our address is 3524 Silverside Rd, Ste 35B, Wilmington, DE 19810, USA.

1.2 This policy covers:

• the Webmarlin website builder and console;
• the webmarlin.ai assistant;
• our APIs and our MCP / AI-assistant connections;
• domain registration;
• the hosting of websites built with Webmarlin (the "Service").

1.3 This policy does not cover how our customers use the personal data of their own visitors. Each Webmarlin website is run by its owner (our customer), and the owner is responsible for that site's privacy notice. Section 13 explains our role for that data.

2. Information we collect about account holders

2.1 Account data. When you register, we collect:

• your email address and password;
• your first and last name;
• optionally, a phone number;
• your account preferences.

We never store your password in readable form, only a one-way hash. If you sign in with Google, we receive your email address, first name and last name from Google. We do not receive your Google password.

2.2 Security data. If you turn on two-factor authentication, we store the following:

2.3 Billing data. Payments are processed by Stripe. We never see or store your full card number. We store:

• your Stripe customer ID;
• your subscriptions: plan, billing cycle, status, period dates, trial end date and cancellation status;
• your transactions: amount, currency, tax, status and a link to the Stripe invoice.

Stripe collects and holds your billing address and calculates tax. When we show your saved cards, we read the card brand and last four digits live from Stripe; we do not keep them.

2.4 Domain registration data. If you register a domain through us, we collect the registrant contact details required by domain registries. These are your name, email, phone, postal address and country. We store them and pass them to our domain registration partner. Registries may publish WHOIS data unless you turn on WHOIS privacy, which is off by default.

2.5 Website content. We store what you create and upload:

• pages, blog posts, products, settings and custom code;
• images, videos and files, including the processed versions we generate.

2.6 AI usage. When you use AI features in the console, we send the relevant site information to an AI model provider (Section 6). That can include your site brief, page content, SEO text and your instructions. We keep usage records: provider, model, token counts, timing and errors. We do not keep the prompt text in those records. We also keep a ledger of AI credits you receive, buy and spend.

2.7 webmarlin.ai conversations. When you use webmarlin.ai, we store:

• your conversation history (your messages and the assistant's visible replies, steps and results);
• the reference links you share;
• the working context the assistant needs to resume a conversation.

Files you attach are stored for up to 30 days and then deleted automatically. Section 9 covers how long conversations are kept.

2.8 MCP and connected AI assistants. When you connect an AI assistant (for example through MCP), we issue access tokens.

• Access tokens are signed and time-limited.
• Refresh tokens are stored only as one-way hashes.

We keep an audit log of actions taken through connected agents: the tool used, the website, the outcome and the request arguments. This lets you and us see what an agent did.

2.9 Communications. We keep the emails and support messages you send us. We also send service emails, such as verification, security, billing, domain renewal reminders and form notifications.

2.10 Technical and log data. Our servers record technical logs, including:

• IP address;
• requested URL;
• referrer;
• browser user agent;
• timestamps;
• errors.

We use these logs to run, secure and debug the Service.

3. Information we process on behalf of our customers (site visitors)

When people visit a website built on Webmarlin, we process the following for the site owner:

3.1 Visit counting. We set a first-party cookie, wmr_vid (see Section 5).

• It contains a random 128-bit identifier. It is not linked to a name, email or IP address.
• We use it only to count a visitor once per 6 hours against the site's monthly visit quota.
• The identifier is held only in short-lived counters (about 6 hours). We store only the monthly total.
• Bots and system requests are not counted.
• We do not use IP addresses to count visits.

3.2 Form submissions. When a visitor submits a form, we store:

• the fields they entered and any files they upload;
• their IP address, browser user agent, referring page, page URL and submission time.

The site owner can see these in the console and export them as CSV. We send the site owner notification emails, including a digest on paid plans. If the site owner configures a webhook, we deliver submissions to it.

On eligible paid plans, submissions may be checked for spam by an AI model. For that check we send the field text and the file names, sizes and types. We do not send the visitor's IP address or user agent.

3.3 Shop orders. For sites with a shop, Stripe processes the payment on the site owner's own Stripe account; the site owner is the merchant. We store the order record:

• the buyer's email, name and shipping address;
• the items, amounts and payment status.

The shopping cart is kept in the visitor's browser, not in a cookie.

3.4 Server logs. Requests to published sites are logged with the visitor's IP address, user agent and requested URL. These logs are kept for up to 30 days (Section 9).

3.5 Third-party tools the site owner adds. Site owners can switch on plugins and embeds that load third-party services. These include:

• analytics (Google Analytics, Google Tag Manager, Adobe, Amplitude, Segment, Yandex Metrica and others);
• advertising and marketing pixels (Facebook Pixel, Google Ads, AdSense, Taboola and others);
• performance monitoring (New Relic, Dynatrace);
• embedded videos, maps and social posts;
• reCAPTCHA and custom code.

These providers collect data under their own policies. The site owner chooses them and is responsible for them, including any consent they require.

4. How we use information and our legal bases

We do not use your site content or your visitors' data to train AI models.

5. Cookies and similar technologies

5.1 On websites built with Webmarlin (set by our platform):

Consent banner. When a site owner enables it with consent required, analytics and marketing plugins are blocked until the visitor accepts. Two exceptions:

• Some plugins (New Relic, Dynatrace) are classed as necessary and are not blocked.
• Consent blocking does not apply to AMP pages.

Fonts. Many site designs load fonts from Google Fonts, which shares the visitor's IP address with Google.

5.2 In the Webmarlin console and webmarlin.ai.

• Console. The console keeps your sign-in token and preferences in your browser's local storage, and sets a cookie for the editor preview theme. Payment screens load Stripe.js.
• webmarlin.ai. It uses three cookies:
  • wmai_sid: sign-in session, 30 days, HttpOnly;
  • wmai_login: sign-in security check, 10 minutes;
  • wmai_prompt_login: 30 days.
• Guest mode. If guest mode is on, webmarlin.ai also sets a wmai_gid cookie and uses a hashed device signal to limit abuse.
• Fonts. Both the console and webmarlin.ai load Google Fonts.
• Advertising and analytics. We do not use advertising or analytics trackers in the console or on webmarlin.ai.

6. Service providers and sub-processors

We share personal data only with providers that help us run the Service, under contracts that limit their use of it. A current list of sub-processors is available to customers on request at [email protected].

We don't publish the names of these providers here, to protect the security of our infrastructure. We disclose them below by category instead. The only names below are providers you deal with directly, because the interaction is visible to you: Stripe, whose own pages and systems hold your card data, and, if you choose it, "Sign in with Google".

Other points about this list:

• We will update it before adding a new category of sub-processor that handles customer personal data.
• We may also disclose information:
  • to comply with law or valid legal process;
  • to protect rights, safety and the integrity of the Service;
  • in a merger, acquisition or sale of assets, subject to this policy.

7. International transfers

We are based in the United States. Our servers and the primary storage for your data are also located in the United States. Some of our other providers process data outside your country as well, including in the United States.

Where EU/UK law requires it, we rely on:

• the European Commission's Standard Contractual Clauses and the UK Addendum; or
• the EU–US / UK–US Data Privacy Framework, where a provider is certified.

8. Security

We protect data with the following measures:

• encryption in transit (HTTPS/TLS);
• hashed passwords and hashed refresh and recovery tokens;
• an encrypted 2FA secret;
• private networking between servers;
• short-lived, signed download links for private files;
• access limits for staff.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

9. Retention and deletion

9.1 General rule. We keep personal data only as long as we need it for the purposes above, or as the law requires.

9.2 How to request deletion. There is no self-serve account deletion yet. Email [email protected] from the address on your account and we will verify the request. You can:

• delete individual pages, posts, form submissions and webmarlin.ai conversations yourself at any time;
• archive a website.

9.3 What happens after a deletion request.

• Account and personal data. Your account and personal data are deleted or anonymised within 30 days.

• Websites.

  • They are unpublished immediately.
  • Their content is then kept in restricted-access storage for 90 days, for handling abuse, fraud, chargebacks and legal claims, and then deleted.
  • Only authorised staff can access it during that time, and only for those purposes.

• Longer retention. We keep specific data longer only when a particular matter requires it, and delete it when that matter closes. Such matters are:

  • an active abuse or fraud investigation;
  • a legal hold or dispute;
  • a request from a lawful authority.

• Legal bases. For EU/UK users, we rely on:

  • the exception for establishing, exercising or defending legal claims (GDPR Art. 17(3)(e));
  • where applicable, compliance with a legal obligation (Art. 17(3)(b));
  • our legitimate interest in preventing fraud and abuse.

  For California residents, we rely on the matching CCPA exceptions: detecting security incidents and protecting against fraud or illegal activity, complying with legal obligations, and exercising or defending legal claims.

• Invoices and payment records. These are kept as tax and accounting law requires, typically 7 years. Stripe keeps its own payment records under its own policy.

• Domains. Domains you registered stay registered until they expire unless you transfer them. Registry and registrar records follow their own rules.

10. Your choices and rights

Depending on where you live, you may have the right to:

• access your personal data and get a copy of it;
• correct it;
• delete it;
• restrict or object to processing;
• receive it in a portable format;
• withdraw consent.

You can update most account details in Account settings. For anything else, email [email protected]. We will respond within the time the law requires (usually 30 days in the EU/UK, 45 days in California). We may need to verify your identity first. We will not discriminate against you for exercising your rights.

If you are a visitor to a website built on Webmarlin, please contact that site's owner first. They control your data. We will help them respond.

11. California privacy rights (CCPA/CPRA)

11.1 Categories collected in the last 12 months:

Sources, purposes and recipients are set out in Sections 2, 4 and 6. Retention is set out in Section 9.

11.2 No sale or sharing. We do not sell personal information. We do not "share" it for cross-context behavioural advertising, and have not done so in the past 12 months. We do not knowingly collect personal information of consumers under 16.

11.3 Your rights. You have the right to:

• know what personal information we collect, use and disclose;
• delete it;
• correct it;
• opt out of sale or sharing (we do neither);
• limit the use of sensitive personal information (we use it only as permitted);
• be free from discrimination for exercising these rights.

You or an authorised agent can make a request at [email protected]. We will verify requests by matching the email on the account.

11.4 Service provider role. For the personal data of our customers' visitors, we act as a service provider/contractor to the customer. We do not sell or share that data, or use it outside our direct business relationship with the customer.

12. EU and UK visitors and users (GDPR / UK GDPR)

12.1 Controller. HEAVENAPPS, INC. is the controller of account-holder data, and of data we process for our own security and billing purposes.

12.2 Processor. For the personal data of visitors to our customers' websites (form submissions, shop orders, visit counting and site logs), the customer is the controller and we are the processor. Section 13 applies.

12.3 Complaints. You may lodge a complaint with your local data protection authority. In the UK that is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

12.4 Automated decisions. We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Two automated checks exist, and neither has such an effect:

• Spam filtering of form submissions flags entries for the site owner to review.
• AI moderation of guest webmarlin.ai prompts may block a prompt.

13. Data Processing Statement for customers

This section is our data processing terms for personal data we process on your behalf ("Customer Personal Data"). It covers:

• your site visitors;
• form submitters;
• shop buyers;
• people named in your content.

1. Roles. You are the controller; we are your processor (or "service provider" under the CCPA).
2. Instructions. We process Customer Personal Data only to provide the Service as described in our Terms and your configuration, or as required by law.
3. Confidentiality. Our staff and contractors who access Customer Personal Data are bound by confidentiality.
4. Security. We apply the measures in Section 8.
5. Sub-processors. You authorise the sub-processors in Section 6. We will give notice of new sub-processors that process Customer Personal Data, and you may object within 14 days. We impose data-protection terms on sub-processors that are no less protective than these.
6. Assistance. We help you answer data-subject requests, for example through console export and deletion of form submissions, and help with security and impact assessments where reasonable.
7. Breach notification. We notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
8. Deletion and return. You can export form submissions as CSV at any time. When your account is deleted, Customer Personal Data is deleted as described in Section 9.3.
9. Transfers. Governed by Section 7.
10. Audits. We make available information reasonably necessary to demonstrate compliance, through a written questionnaire available once a year.

Your responsibilities as a customer.

• Publish your own privacy notice on your site. New sites get an empty "Privacy Policy" draft page for this.
• Have a lawful basis for the data you collect.
• Enable the consent banner and configure plugins as your visitors' law requires.
• Do not collect special-category data or children's data through forms unless you are permitted to.

14. Children

The Service is not directed to children under 18. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy. When we make material changes, we will notify account holders by email or in the console before the change takes effect, and update the date at the top.

16. Contact

HEAVENAPPS, INC. (Webmarlin) 3524 Silverside Rd, Ste 35B Wilmington, DE 19810, USA Email: [email protected]