This is a template privacy policy. Replace its terms with ones that match how your business actually handles user data, and have a lawyer review before publishing.
Overview
Northwind Studio ("we", "us") respects your privacy. This policy explains what personal information we collect when you use our website and services, why we collect it, and what choices you have.
What we collect
Information you give us
- Account info: your name, email, password (hashed), and billing address when you create an account or buy a license.
- Support requests: the content of any email or message you send us.
- Payment info: handled entirely by our payment processor (Stripe). We never see your card number.
Information collected automatically
- Server logs (IP address, browser type, pages visited, timestamps)
- Usage analytics (anonymous, via privacy-preserving Plausible)
- Cookies — see the Cookies section
How we use it
We use your information to:
- Provide and maintain the service you're paying for
- Communicate with you about your account, purchases, and important updates
- Improve our product based on aggregate usage patterns
- Detect and prevent fraud and abuse
- Comply with legal obligations
We do not sell your personal information to anyone.
Who we share with
We share data only with service providers who help us run the business:
- Stripe — payment processing
- Postmark — transactional email
- Plausible — anonymous analytics (no cookies, no IP storage)
- Sentry — error monitoring
- AWS — hosting
All providers are bound by contract to use your data only for the services they provide to us. We may also disclose information if required by law.
How long we keep it
We keep your account information as long as your account is active. If you delete your account, we delete the data within 30 days, except where we're required to retain it (tax records: 7 years; transactional emails for fraud detection: 12 months).
Your rights
Depending on your jurisdiction (GDPR / CCPA / etc.), you may have the right to:
- Access the personal data we hold about you
- Request correction or deletion
- Object to processing or request restriction
- Receive your data in a portable format
- Withdraw consent at any time
Email privacy@example.com with any request. We respond within 30 days.
Cookies
We use a minimal set of cookies:
- Essential — session, auth, CSRF protection. Required, no consent needed.
- Functional — remember your preferences (theme, language). Set only if you've opted in.
We do not use advertising cookies. Our analytics provider (Plausible) does not set cookies at all.
Security
We use industry-standard practices to protect your data: TLS in transit, AES-256 at rest, principle-of-least-privilege access controls, regular security reviews, and a vulnerability disclosure program. No system is 100% secure, but we take it seriously.
Children
AraSites is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have, please contact us so we can delete it.
International transfers
If you're outside the United States, your data may be transferred to and processed in the US. We use Standard Contractual Clauses (or equivalent) where required.
Changes to this policy
If we make material changes, we'll notify you by email or in-app at least 30 days before they take effect. The "last updated" date at the top reflects the current version.
Contact
Questions about privacy? privacy@example.com
For GDPR / EU representation: Northwind Studio EU Representative, c/o Mailbox 24, 1000 Brussels.
By using AraSites, you agree to this policy. If you don't agree, please don't use the service.