For your website's visitors, we act as your processor under the data processing agreement. Visitors can read our privacy notice for visitors, as well as your website's own privacy notice at /privacy.
Contact details
S. Digital & CreativeEmail: info@yourhostsophie.com
ICO registration number: ZC280271
What we collect and why
- Your admin account: username, a scrambled (hashed) form of your password that we cannot read, and when you last signed in.
- Your privacy details: the name and email address you give us to appear in your website's privacy notice, and the record of when and by whom the data processing agreement was accepted.
- An activity log of admin changes: what was changed, when, and the IP address and browser used. We use this to keep sites secure and to investigate problems.
- Server logs: your IP address, browser details, the page requested and the time, as for every visitor.
- AI assistant use: if you use the built-in assistant, we keep your conversations with it and a record of its usage and cost. The assistant may read information from your website, including visitor information, to do what you ask.
- Connected apps: if you connect an AI agent or app to your site, we keep its name, the access you gave it and its access tokens.
- Support access: to help with a problem, our platform staff can sign in to your site's admin console as an administrator. We only do this to support you, run the platform or keep it secure, and it is recorded.
- Messages you send us: anything you tell us when you contact us.
The admin console loads fonts from Google Fonts, so your browser sends your IP address to Google when you use it.
Lawful bases
Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. You can find out more on the ICO's website.
| Purpose | Lawful basis |
|---|---|
| Providing the platform and your admin account | Contract |
| Recording acceptance of the data processing agreement | Legal obligation: UK GDPR Article 28 requires a written agreement |
| Server logs, security records and the admin activity log | Legitimate interests: keeping the platform and the websites on it secure |
| The AI assistant and connected apps | Contract: providing features you choose to use |
| Support access | Legitimate interests: helping you and keeping the platform working |
| Replying to messages you send us | Legitimate interests |
How long we keep information
| Information | How long we keep it |
|---|---|
| Admin accounts | While your website is on the platform |
| Server logs | Up to 12 months |
| Admin activity log | 24 months |
| AI assistant conversations and usage records | While your website is on the platform, unless you delete them sooner |
| Connected apps | Until you disconnect them. Access tokens expire after an hour, and refresh tokens after 30 days. |
| Data processing agreement acceptance records | While your website is on the platform, then 6 years |
| Your website's data after it leaves the platform | Deleted after a short recovery period, unless you ask us to return it first |
Our service providers (sub-processors)
We use these providers to run the platform, including your admin account. They also act as sub-processors for your visitors' information, as the data processing agreement sets out.
| Provider | What they do | Where |
|---|---|---|
| Infomaniak (Infomaniak Network SA) | Hosting for the platform, every website, its database and server logs | United Kingdom |
| Google (Gmail) | Sending the platform's emails, such as contact form messages delivered to you | United States |
| OpenAI | We use Large Language Models to power the built-in AI assistant (labelled as "SophieBot" at time of writing). This is only used when a site owner uses it. It may read visitor information on their website to do what they ask. Data sent to these services when generating text is not used for training models. OpenAI may keep it for up to 30 days to monitor for abuse. | United States |
| Anthropic | We use Large Language Models to power the built-in AI assistant (labelled as "SophieBot" at time of writing). This is only used when a site owner uses it. It may read visitor information on their website to do what they ask. Data sent to these services when generating text is not used for training models. Anthropic may keep it for up to 30 days to monitor for abuse. | United States |
| Google Fonts | Fonts for the admin console, and for your website only if you pick a Google font | United States |
We will tell you at least 30 days before we add or replace a sub-processor, so you can object.
Sharing information outside the UK
We host the platform, every website, its database and server logs in the UK. Our hosting provider, Infomaniak, is based in Switzerland, and its staff can access the servers from there to run and support them.
| Organisation | Country | Safeguard |
|---|---|---|
| Infomaniak | Switzerland (access by its staff; the data is hosted in the UK) | UK adequacy regulations (Switzerland) |
| United States | UK Extension to the EU–US Data Privacy Framework | |
| OpenAI | United States | Standard contractual clauses with the UK International Data Transfer Addendum |
| Anthropic | United States | Standard contractual clauses with the UK International Data Transfer Addendum |
Your data protection rights
You have the right to:
- Access: ask for copies of your personal information.
- Rectification: ask us to correct information you think is wrong or incomplete.
- Erasure: ask us to delete your personal information.
- Restriction: ask us to limit how we use your information.
- Object: object to processing that relies on legitimate interests.
- Data portability: ask us to transfer information you gave us to you or to another organisation.
- Withdraw consent: where we rely on your consent, you can withdraw it at any time.
We will respond without undue delay and in any event within one month. To make a request, contact us using the details above.
How to complain
If you have concerns about how we use your personal information, please contact us first using the details above.
If you are still unhappy after raising your concerns with us, you can complain to the Information Commissioner's Office (ICO):
Information Commissioner's OfficeWycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint