Data Processing Terms

These Data Processing Terms are part of our Terms of Service. They apply when a website we host for you collects personal information from your visitors and customers ("visitor data"), for example through contact forms, shop orders or donations.

Who is responsible for visitor data?

You decide why and how visitor data is used, so you are the business responsible for it (sometimes called the "controller"). We process it on your behalf as your service provider (sometimes called the "processor").

What do we do with visitor data?

• We use visitor data only to provide the service to you: storing form messages and orders, showing them in your dashboard, sending order emails in your business's name and keeping your site secure.
• We do not sell visitor data, share it for cross context behavioral advertising, or use it for our own marketing.
• We do not combine it with other information or use it outside our business relationship with you, except as the law allows for service providers.
• We follow your reasonable instructions, given through your dashboard or by email.

Who else handles visitor data?

We use the providers listed in our Privacy Policy, such as Supabase for storage, Vercel for hosting, Resend for email and Stripe for payments (which go to your own Stripe account), under written terms that protect the data. We remain responsible for them, and we update that list when we add a provider.

How is visitor data protected?

Everyone on our team who can access visitor data must keep it confidential. We use encryption in transit, access controls and providers with strong security programs. If we learn of a security incident affecting your visitor data, we will tell you without undue delay and share what we know, to help you meet your own obligations.

What if a visitor asks about their information?

A visitor who wants to see, correct or delete their information should contact you. We will help you respond, for example by finding or deleting their messages or orders.

What are your responsibilities?

• Tell your visitors how you collect and use their information, for example with a privacy policy on your site.
• Collect only what you need, and have a lawful reason to collect it.
• Do not ask visitors for sensitive information, such as government ID numbers, card numbers, passwords or health details, through your site's forms.
• Respond to your visitors' requests about their information.

What happens when service ends?

When your hosting ends, we delete visitor data on our normal schedule, unless the law requires us to keep it. Copy anything you need from your dashboard before your hosting ends.

Questions

Questions about how we handle visitor data can be sent to hello@stitchweb.design. We will answer reasonable questions about our safeguards.