Privacy policy

Yesod7 is the data controller for the studio. Requests go through the form on this page, or from the email attached to your account. We reply within 30 days.

• Identity from Google sign-in: name, email, profile image, and a stable account id.
• Your briefs, site copy, uploaded images, project files, and published HTML.
• Token balance, ledger, and payment metadata (plan, amount, invoice name). We do not store card numbers.
• Session cookies and a bearer token used only to keep you signed in.
• Security logs (time, path, approximate IP) for a short period, to stop abuse.

To perform the contract: sign-in, generation, hosting, export, billing and support. Legitimate interests: security, fraud prevention, and keeping the studio available. We do not sell personal data and we do not run advertising profiles.

Google (sign-in). The payment provider named on the billing page, when you buy a pack. The model provider that drafts copy and images from your brief (prompts and outputs pass through that provider to produce the site). Hosting for the app and for published sites. Each processor may only use the data to provide that service.

Processors may store data outside your country, including the United States and the European Economic Area. Where GDPR applies we rely on an adequacy decision or standard contractual clauses. Israel currently benefits from an EU adequacy decision for transfers into Israel.

Account and project data last until you delete them, or until the account is closed. Payment records are kept as tax and accounting law requires. Security logs are rotated. Generated sites you export as a ZIP are then under your control.

Subject to the law of your country, you may request access, correction, erasure, restriction, objection, and a portable copy of data you provided. You may lodge a complaint with your supervisory authority (for example a European Data Protection Authority, the UK ICO, or the Israeli Privacy Protection Authority).

Generation in the studio is AI-assisted. It is not a solely automated decision with legal effect about you.

The service is not offered to children under 16. Do not create an account for a younger person.

Only essential cookies (session). Details: Cookie notice.

If a breach is likely to affect your rights, we notify the competent authority without undue delay (GDPR: 72 hours where it applies) and we inform affected users when the law requires it.