What we collect
Because you gave it to us
| Your email address | to identify your account and contact you |
| Your password | stored only as a bcrypt hash — we cannot read it |
| What you write into the site builder | your descriptions, page content, uploaded images |
| Billing details | held by Stripe, not by us. We store only a customer reference and your plan |
Because using the service produces it
| Sign-in times and IP address | security, and to spot a compromised account |
| Generation history and credit use | so you and we can see what your allowance went on |
| Audit records of significant actions | publishing, deleting, changing a domain |
| The date, version and IP of your terms acceptance | so consent can be demonstrated |
About visitors to your published site
MethaWeb records page views for your analytics panel. This is deliberately minimal: no cookies, no cross-site tracking, no advertising identifiers.
A visitor identifier is hashed with the date so it cannot be followed from one day to the next. Referrer, country, browser, operating system and language are recorded in aggregate only.
What we do not do
- We do not sell your data
- We do not use your site content to train AI models
- We do not show advertising, and we do not embed third-party trackers in your site
Social media publishing (MethaWeb Social)
MethaWeb Social is a companion tool that drafts social media posts and — after you approve them — publishes them to your own connected Instagram and Facebook accounts, on your behalf. It is entirely opt-in: none of the below applies unless you choose to connect an account.
Connecting your accounts
You connect your Instagram (Professional or Business) account and your Facebook Page through Meta's official login. We receive and store an access token for those accounts so we can post for you. That token is encrypted at rest (AES-256-GCM), is never shown to you or anyone else, and is never shared.
What we do with Meta's APIs
We use Meta's Graph APIs for three things only:
- read the basic account identity we need in order to post
- publish the posts you have approved
- read post performance metrics for your own analytics (a later feature)
We publish only content you have explicitly approved — nothing is posted automatically without your approval. We do not sell data obtained through Meta, do not use it to train AI models, and do not share it with anyone except the infrastructure processors already listed in this policy (hosting and the like). Data obtained through Meta is stored on our servers in Germany, like the rest of your data.
Disconnecting and deleting your Meta data
- Disconnect at any time. Removing a connected Instagram or Facebook account deletes the stored access token for that account immediately.
- Request full deletion. To have all data associated with your connected Meta accounts deleted, email privacy@methaweb.com and we will action it within 30 days.
Who else sees it
| Hetzner (Germany) | hosting |
| Cloudflare | DNS, protection, email routing |
| Stripe | payments — they hold your card details, we do not |
| Our AI generation provider | AI generation. Your site description is sent to a third-party AI service to generate your site |
| Unsplash | image search terms. Not your identity |
| Resend | sending email |
| Meta Platforms (Instagram/Facebook) | publishing to your own connected accounts — MethaWeb Social only |
Your prompts go to an AI provider to produce your site — that is unavoidable in a tool of this kind. We do not send your account details along with them.
Where it lives
On servers in Germany, with backups in the same region. Some processors above operate globally.
How long we keep it
| Account and site data | while your account is open |
| After you close it | removed from live systems promptly; backups age out on their own schedule, within 90 days |
| Form submissions | the most recent 500 per site — older ones are dropped automatically |
| Analytics | daily totals only, and a rolling window |
Your rights
You can ask us to show you what we hold, correct it, delete it, or give you a copy in a portable form. Write to privacy@methaweb.com and we will respond within 30 days.
If you are in the UK or EU, you also have the right to complain to your local supervisory authority. We would rather you raised it with us first, but that right is yours regardless.
Security
Passwords are hashed with bcrypt. Traffic is encrypted in transit. Admin access requires two-factor authentication. Accounts are isolated from one another: your drafts, sites, domains and email routing are not visible to other customers.
If we ever suffer a breach affecting your personal data, we will tell you and the relevant authority without undue delay.
Cookies
MethaWeb uses a single sign-in token so you stay logged in. There are no analytics or advertising cookies in the app.
Sites you publish carry no cookies by default. If you add something that does — an embedded video, a third-party widget — that becomes your responsibility to disclose to your visitors.
Contact
See also our Terms of Service.