Privacy Policy

PreviewSend (“PreviewSend”, “we”, “us”, or “our”) provides a hosting service for small static and AI-generated websites: you upload a site, we give you a stable link, and you can update that link over time. This Privacy Policy explains what personal data we collect when you use PreviewSend at https://previewsend.comand the related applications and APIs (together, the “Service”), why we collect it, and the choices and rights you have.

For the purposes of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, PreviewSend is the data controller of the personal data described in this policy. You can reach us about anything in this policy at leon@previewsend.com.

This policy covers personal data we process as a controller about our account holders, their authorised users, billing contacts, and visitors to our marketing site. It does not govern the content you upload or the data you collect from visitors to the websites you host with us — for that, see “Content you host with us” below, where you are the controller and we act as your processor.

Information you give us.

• Account data — the email address you sign up with, and (if you set one) a password. If you sign in with Google or GitHub, we receive your email address and basic profile identifier from that provider instead of a password.
• Trial eligibility data - a keyed one-way identifier derived from your normalised email address, used only to keep introductory trials limited to one per owner.
• Workspace data — workspace and project names, team members you invite, and roles you assign.
• Billing data — your plan, and the billing details required to charge you. Card numbers are entered directly with our payment processor (Stripe) and are never stored on our servers; we keep only a customer reference, plan, and payment status.
• Content you upload — the website files (HTML, CSS, JavaScript, images, and other assets), versions, custom-domain settings, and any reviewer comments or approvals associated with your projects.
• Communications — messages you send us through the contact form, by email, or in support requests, including your name, email, and the contents of your message.

Information we collect automatically.

• Usage and log data — IP address, browser and device type, pages and features used, timestamps, referring URLs, and aggregate visit counts for your hosted sites (used to enforce plan limits and detect abuse).
• Essential cookies- session and authentication cookies that keep account holders signed in, remember an account-free reviewer’s display name, and preserve a named approver’s authority after they exchange an approver link. See “Cookies”.

Information from third parties. When you authenticate with Google or GitHub we receive the data described above from that provider; when you pay, Stripe confirms the outcome of the transaction to us.

We use personal data to:

• provide, operate, and maintain the Service and your account;
• host, process, store, and serve the websites and content you upload;
• process payments, manage subscriptions, and send billing and renewal notices;
• send service and transactional messages (for example sign-in, password reset, team invites, and notifications that a version is ready);
• respond to your enquiries and provide support;
• enforce plan limits and our Acceptable Use Policy, and keep the Service secure by preventing fraud, abuse, and other harmful activity;
• understand and improve the Service in aggregate; and
• generate an optional revision plan from reviewer names and comment content when the workspace owner requests that feature;
• comply with our legal obligations and enforce our agreements.

We do not use your account data or uploaded content to build advertising profiles, and we do not sell personal data.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to create your account and deliver the Service you have signed up for, including hosting your content and processing payment.
• Legitimate interests — to secure the Service, prevent abuse, enforce limits, communicate about the Service, and improve it, where those interests are not overridden by your rights.
• Legal obligation — to keep tax and accounting records and to respond to lawful requests.
• Consent — where we ask for it (for example any optional communications); you can withdraw consent at any time.

We keep cookies to a minimum. We use a small number of strictly necessary cookies. These include an authentication cookie that keeps account holders signed in and protects against cross-site request forgery, an HttpOnly reviewer identity cookie that remembers an account-free reviewer’s display name for up to 180 days, and an HttpOnly approver capability cookie that preserves a named approver’s authority for up to 14 days. The approver cookie is restricted to the approval flow. These cookies are required for the relevant Service features to function and cannot be switched off through the app.

We do not use third-party advertising or cross-site tracking cookies. We use analytics tools to understand how the Service is used (see “Product analytics” below); they operate server-side or through cookieless page-view measurement, and do not place advertising or cross-site tracking cookies — or any persistent analytics identifier — in your browser. You can clear or block cookies in your browser, but the signed-in parts of the Service will not work without the essential cookie.

To understand how the Service is used and to prioritise improvements, we use PostHog as a product-analytics provider. We capture a small set of server-side product events — for example account creation, project creation, version uploads, preview views, and reviewer comments or approvals. We also record anonymous, cookieless page views on our own website (previewsend.com) via PostHog and Cloudflare Web Analytics; these use no cookies and no persistent identifiers, and are never collected on our customers’ hosted preview sites.

These events are tied to a pseudonymous identifier (an internal account, workspace, or reviewer reference) together with limited non-content metadata such as a project slug or page path. We do not send your name, email address, the files you upload, or the contents of your hosted sites to our analytics provider, and we do not use analytics to build advertising profiles. Where the GDPR or UK GDPR applies, we rely on our legitimate interest in understanding and improving the Service. You can ask us to stop processing your data for analytics by contacting leon@previewsend.com.

We do not sell your personal data. We share it only with the service providers (“sub-processors”) that help us run the Service, and only as needed to provide it:

• Cloudflare — hosting, content delivery, edge compute, object storage, DNS, email routing, and security. Privacy policy.
• Hetzner — the server in Germany (EU) that runs our production database. Privacy policy.
• Supabase — authentication and database tooling for account sign-in. Privacy policy.
• Stripe — payment processing and subscription billing. Privacy policy.
• Resend — delivery of transactional and notification email. Privacy policy.
• PostHog — product analytics (see “Product analytics”). Privacy policy.
• OpenRouter - AI model access for the optional revision-plan feature. When the workspace owner requests a revision plan, we send reviewer display names and comment content to OpenRouter so a model can produce the requested changelog and builder prompt. We do not send this content to OpenRouter merely because a reviewer posts a comment. Privacy policy.

These providers are bound by contract to process personal data only on our instructions and to protect it. We may also disclose personal data: (a) to comply with the law or a valid legal request; (b) to protect the rights, safety, and property of PreviewSend, our users, or the public, including to investigate abuse; and (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this policy and will notify you of any change of controller.

Our production database runs in the European Union (Germany), and Cloudflare serves content from a global edge network. Some of our providers (such as Stripe, Resend, PostHog, and OpenRouter) are based in or process data in the United States. Where personal data is transferred outside your country or the European Economic Area, we rely on appropriate safeguards - such as the European Commission’s Standard Contractual Clauses and equivalent UK mechanisms - to protect it. You can contact us for more information about these safeguards.

We keep personal data only for as long as we need it for the purposes described in this policy:

• Account, workspace, and content — for the life of your account. When you delete a project, version, or workspace, or close your account, we delete the associated content from active systems within a reasonable period and from routine backups as those backups expire (typically within 30 days).
• Billing records — for as long as required by tax and accounting law, which may extend beyond the life of your account.
• Trial eligibility - the keyed one-way email identifier is retained after account closure for as long as the introductory trial remains a one-time offer. It cannot be used by itself to contact you or sign you in.
• Logs and security data — for a limited period appropriate to security and abuse prevention.

We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), access controls and least-privilege access to production systems, isolation of customer workspaces, and regular backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authorities of a breach where the law requires.

Depending on where you live, you may have some or all of the following rights over your personal data: to access it; to correct inaccurate data; to delete it; to restrict or object to certain processing; to portability (receive your data in a usable format); and to withdraw consent where we relied on it. Exercising these rights will not lead to discriminatory treatment.

You can exercise many of these directly in the app (for example by editing or deleting projects, or closing your account). For anything else, email leon@previewsend.com and we will respond within the time the law allows. We may need to verify your identity first. If you are in the EEA or UK and believe we have not handled your data properly, you may lodge a complaint with your local data protection authority, though we hope you will contact us first.

If you are a California resident, you have the right to know what personal information we collect and how we use and share it, to request access to and deletion of that information, to correct inaccurate information, and to be free from discrimination for exercising your rights. The categories of personal information we collect and our purposes are described in the sections above.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. To make a request, email leon@previewsend.com. You may use an authorised agent to submit a request on your behalf, subject to verification.

When you upload a website to PreviewSend and we serve it to your visitors, you decide what content and what personal data that site contains and collects. For that data you are the controller and we act as your processor, handling it on your behalf and on your instructions to provide hosting.

You are responsible for having a lawful basis to process your visitors’ data, for providing your own privacy notice on your hosted sites where required, and for responding to your visitors’ requests. If you need a data processing agreement (DPA) for this relationship, contact us.

The Service is not directed to children, and you must be at least 16 years old (or the age of digital consent in your country) to create an account. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or in the app. Your continued use of the Service after an update means you accept the revised policy.

Questions, requests, or complaints about this policy or your personal data can be sent to leon@previewsend.com or through our contact page.