Privacy Policy

This Privacy Policy explains what personal information 1000x Digital LLC collects, why, who it goes to, how long we keep it, and the choices and rights you have. We have written it to describe what our products and websites actually do.

1. WHO WE ARE AND WHAT THIS POLICY COVERS

1000x Digital LLC is a Michigan limited liability company ("1000x Digital," "we," "us," "our"). Website Builder Studio is a product of 1000x Digital LLC. 1000x Digital LLC is the one legal entity responsible for all of our websites and software platforms.

This policy covers:

• THE PLATFORM: the Website Builder Studio application at app.websitebuilder.studio, and the accounts our customers hold with us (together, the "Service");
• OUR WEBSITE: websitebuilder.studio, including its contact form and the free Compliance Grader; and
• the emails and support conversations we have with you.

It does not cover the other websites of 1000x Digital LLC. Each of them has its own privacy policy, which applies to that website instead of this one, and all are listed at https://1000xdigital.com/legal.

It does not cover the websites our customers build and publish with the Service ("Customer Sites"), except to explain our limited role for them in section 5. Each Customer Site is run by the business that published it, and that business's own privacy policy applies to it.

How to reach us about privacy:
Online: our contact page (please start your message with "Privacy request")
Mail: 1000x Digital LLC, P.O. Box 700012, Plymouth, MI 48170-9998

2. THE SHORT VERSION

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• We do not use your content, your leads or your conversations with our AI assistant to train AI models, and our agreements with our AI providers do not permit them to train their models on the data we send them.
• We store your conversations with the AI assistant in full, so it can remember them and you can go back to them. You can have them deleted.
• When people fill out forms on a Customer Site, we hold their information for that business, on its instructions. The business decides how it is used.
• We place no cookies of our own on Customer Sites. On our own websites, optional analytics run only if you accept them.
• When you delete your account, we delete your account, your sites, your leads, your conversations with the assistant and the files in your library from the Service at once. Backup copies and a small set of records are kept, and section 10 says exactly which.
• The Service is offered to businesses with operations in the United States, and we process information in the United States; our hosting provider may also process it in the other countries where it operates data centers.

3. OUR TWO ROLES

WHEN WE DECIDE (WE ARE THE "CONTROLLER" OR "BUSINESS"): for information about our customers and their team members, about visitors to our own websites, and about anyone who contacts us. This policy describes how we handle that information.

WHEN WE ACT FOR A CUSTOMER (WE ARE A "PROCESSOR" OR "SERVICE PROVIDER"): for information about the people who visit a Customer Site or submit a form on it, and for any other personal information a customer puts into the Service about other people (for example, in site content, uploaded files or notes). We process that information only to provide the Service to that customer, under our Terms of Service and our Data Processing Agreement. The customer decides what it collects and how it uses it, and is responsible for telling those people, normally through its own privacy policy. Section 5 explains this further.

4. INFORMATION WE COLLECT AND WHERE IT COMES FROM

A. YOUR ACCOUNT (from you, and from Google if you sign in with Google)

Your email address; your password, which we store only in hashed form, or your Google sign-in; your email-verification status; the account you belong to and your role in it; the email addresses of team members you invite; your time zone and display preferences; and, at sign-up, the confirmation you give that you are authorized to buy for a business with US operations, recorded with its wording, the date and time, and the IP address it came from.

B. BILLING (from you and from Stripe)

Your plan, trial dates, subscription status, payments, refunds and usage credit. Payment card details are entered on Stripe's own checkout page and never reach our servers. Stripe tells us who the customer is (for example, the email and name entered at checkout) and the status of each payment, and our billing page may show the card brand and last four digits that Stripe provides. To make sure a promotional credit is given only once per card, and to see repeat free trials, we keep a one-way coded value derived from the payment card (or, for Stripe Link, from its email address). We cannot turn that value back into a card number or an email address.

C. YOUR BUSINESS AND YOUR SITES (from you)

Your business profile and the details you give us to build from; every site you create and its recent versions; your domains and their connection and certificate status; the services you connect (such as a CRM or a webhook) and the credentials you enter to connect them; optional measurement and verification codes you add to your sites (such as a Google Analytics measurement ID); your usage, spend and site-performance figures; page-view totals for your published pages; and files you upload to your library.

D. YOUR CONVERSATIONS WITH THE AI ASSISTANT, AND VOICE INPUT (from you)

We store every message you send the AI assistant and every reply it sends you, in full. If you tell the assistant about your revenue, your clients, your staff or your plans, that text is stored. Files you attach to a message are sent to our AI provider so the assistant can answer you. Ideas and suggestions you share with the assistant may be passed to our team to improve the Service. VOICE INPUT: when you speak instead of typing, your audio is sent to our hosting provider's speech-to-text service and turned into text. We do not store the audio or the transcript as a recording; the text becomes your message, and we record only that a transcription happened.

E. SUPPORT REQUESTS AND FEATURE IDEAS (from you)

What you write to us through the Service, by email or through a contact form, the email address you write from, and our replies. Each request made in the Service receives a reference number.

F. DEVICE AND USAGE INFORMATION (collected automatically)

When you use the Service or our websites, our hosting provider receives technical information that every website receives, such as your IP address, browser type, the pages requested and the time. Our website and the Service also load web fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address and browser information under Google's own privacy policy. We use IP addresses for security, spam prevention and limits on how often a form can be sent. We record events in your account (such as sign-ins, site builds, publishes and plan changes) so the Service works and so our billing and compliance history is accurate. Cookies and similar technologies are described in section 9 and in our Cookie Policy.

G. OUR WEBSITE (from you, and automatically)

CONTACT FORMS: what you type, such as your name, email address, phone number, company and message. On websitebuilder.studio, the form is delivered through our own platform: your message is recorded in the Service as a support request with a reference number and, unless our spam checks hold it, our team is notified by email and you normally receive an automatic email confirming that we received it. No outside form service receives it. The form uses Cloudflare's bot check, which runs in your browser when you use the form to tell people from automated programs.

COMPLIANCE GRADER: the website address you ask us to check and your email address. We fetch the public page at that address, check it (an AI provider helps review the page's text), show you the report, email it to you, and send a copy to our team so we can follow up about the report.

ANALYTICS: if you accept them, Microsoft Clarity and Google Analytics record how visitors use our pages. See section 9 and our Cookie Policy.

WE DO NOT COLLECT, and ask you not to give us, sensitive information such as health information, government identification numbers, financial account numbers or precise geolocation. We do not buy personal information from data brokers.

5. VISITORS TO OUR CUSTOMERS' SITES AND THE PEOPLE WHO CONTACT THEM

This section is for the members of the public who visit a Customer Site, and for our customers, who are responsible for those visitors' information.

5.1 WHAT WE HOLD FOR THE BUSINESS. When someone submits a form on a Customer Site, we store everything they typed (every field the business chose to put on its form), which site it came from and when it arrived, and any status and notes the business adds. We email the business a notification, and, if the business has turned them on, we send the person an automatic reply and follow-up emails on the business's behalf. If the business has connected another service (such as a CRM, a spreadsheet, a messaging tool, SMS through its own account, or a webhook), the submission is sent there at the business's instruction and is then governed by the business's own agreement with that service. If the business asks our AI assistant about its inquiries, the relevant inquiry details are sent to our AI provider to answer the business.

5.2 SPAM AND ABUSE CHECKS. To protect forms from bots, a Customer Site's form may use Cloudflare's bot check, and the visitor's IP address is used for spam and rate-limit checks. We keep that IP address for no more than 24 hours, and we do not store it with the inquiry.

5.3 PAGE VIEWS. We count page views on our server as totals per hour, with no IP address and no per-visitor record. We place no cookies of our own on Customer Sites and build no profile of their visitors. Each Customer Site shows a short privacy notice; if the visitor dismisses it, that choice is remembered in the visitor's own browser storage, not in a cookie. A business that serves international visitors can turn on a consent banner, and the visitor's choice is remembered the same way.

5.4 WEB FONTS AND TOOLS THE BUSINESS ADDS. Customer Sites load web fonts from Google Fonts, so the visitor's browser contacts Google. A business may also add its own Google Analytics measurement ID, a video, a booking calendar, a map, other web fonts or other embedded content. The visitor's browser then contacts that company directly, and that company may set its own cookies. Those tools are the business's choice and are covered by the business's own privacy policy.

5.5 THE BUSINESS DECIDES. We do not market to a business's leads, we do not sell them, and we do not share them between accounts. The business decides what its forms ask and what it does with the answers, and it must publish its own privacy policy telling its visitors so.

5.6 IF YOU ARE A VISITOR AND WANT TO EXERCISE A PRIVACY RIGHT, please contact the business whose site you used; it is the one that decides what happens to your information. If you contact us instead, we will pass your request to that business within 10 business days, tell you we have done so, and help the business act on it. Passing on a request is not a response to it; the business responds.

6. HOW WE USE INFORMATION

We use the information described in section 4 to:

• create and run your account, sign you in securely and let your team share the account;
• build, check, publish and host your sites, run the AI assistant, deliver your leads and send the emails you turn on;
• take payments, apply plans, trials and usage credit, prevent a promotional credit from being claimed more than once, and see repeat free trials;
• answer your questions and support requests, and respond to contact forms and Compliance Grader requests;
• send you service emails about your account, your billing, your sites and changes to our terms (if we send marketing emails, each one will include a way to unsubscribe);
• keep the Service and our websites secure, and detect and prevent spam, fraud and abuse;
• understand how our websites are used and improve them and the Service, using the analytics you accept and the usage of the Service;
• keep accurate business, billing and compliance records; and
• comply with the law, enforce our terms and protect our rights and the rights of others.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

7. AI AND YOUR INFORMATION

• The Service uses AI models provided by other companies: one family of models writes and edits site content and powers the AI assistant, another generates images from text descriptions, and our hosting provider turns voice input into text. The current providers, and what each one receives, are named on our subprocessor list (section 8).
• We do not use your content, your leads, your conversations or your usage data to train AI models, ours or anyone else's. Our agreements with our AI providers do not permit them to train their models on the data we send them.
• Our AI providers may keep the data we send them for a limited period under their own terms (generally up to 30 days, and longer only where content is flagged for a safety review or the law requires it), and then delete it.
• The assistant also draws on shared knowledge about how the Service works, the published standards it checks against and our own policies. That shared knowledge is written or approved by us; no entry becomes available to the assistant until a person at 1000x Digital approves it, individually or as part of a reviewed batch. We never put your content, anything you or the assistant wrote in your account, or anything that identifies you or your business into material shown to other customers.
• AI output can be wrong. You review your site's content before it is published.

8. WHO WE DISCLOSE INFORMATION TO

SERVICE PROVIDERS. We use a small number of companies to run the Service and our website: hosting, databases, file storage, content delivery and bot protection; AI models; payment processing; email delivery; sign-in with Google; and, on our website, the analytics you accept. Apart from the analytics providers, which handle information as section 9 describes, and our support mailbox, which is a standard Google mailbox not yet covered by data processing terms, they process the information for us under data processing terms. The companies that process our customers' data for us, and what each one does, are listed on our subprocessor list at https://app.websitebuilder.studio/subprocessors. We give customers at least 30 days' notice before we add or replace one.

PEOPLE ON YOUR ACCOUNT. Team members you invite can see your account's sites, leads and other information, according to their role.

SERVICES YOU CONNECT. When you connect another service, we send it the information you tell us to send. That service is not our service provider; its own terms and privacy policy apply.

OUR TEAM. People at 1000x Digital who operate the Service can access account information, including conversations with the assistant, when needed to provide support, investigate a problem, keep the Service secure or comply with the law.

LEGAL REASONS. We may disclose information if the law, a court order or a valid legal process requires it, or where it is reasonably necessary to protect the Service, our customers, the public or our rights. Unless the law prevents us, we will tell the affected customer.

BUSINESS TRANSFER. If our business, or part of it, is sold, merged or reorganized, information may pass to the new owner, who must continue to handle it as this policy describes.

WE DO NOT SELL personal information, and we do not SHARE it for cross-context behavioral advertising, as those terms are defined in US state privacy laws. We have not done so in the past 12 months. We do not disclose personal information to third parties for their own direct marketing purposes. We do not knowingly sell or share the personal information of anyone under 16.

9. COOKIES AND SIMILAR TECHNOLOGIES

The application uses only the cookies needed to sign you in, protect your account and checkout, and remember a display preference. Our website uses optional analytics (Microsoft Clarity and Google Analytics) only if you click "Accept" in the cookie banner; if you click "Decline", or if your browser sends a Global Privacy Control signal, they do not load. You can change your choice at any time with the "Cookie settings" link at the foot of each page of those websites. Microsoft Clarity can record how you move through a page (clicks, scrolling and mouse movement) to produce session replays and heatmaps; it is set to hide what you type into forms. Because these tools are provided by Microsoft and Google, those companies may collect information about your activity on our website over time and across other websites under their own privacy policies. We run no advertising or retargeting pixels. Full details, including each cookie, are in our Cookie Policy at /cookies on this website.

10. HOW LONG WE KEEP INFORMATION

WHILE YOUR ACCOUNT EXISTS. We keep your account information, business profile, sites, leads, conversations with the assistant, library files and connected services until you delete them or delete your account. Nothing is deleted automatically when a subscription ends: after a cancellation takes effect, your account may stay available in a download-only mode (your leads, and your sites where section 12 allows) until you resubscribe or delete it. You can delete a lead, a site or your conversations at any time, or ask us to remove a specific conversation.

WHEN YOU DELETE YOUR ACCOUNT. Once you confirm it is really you, we delete your account, your sites, your leads, your conversations with the assistant and the files in your library from the Service at once, cancel any subscription, and email you a confirmation. If a file cannot be erased at that moment, we finish erasing it automatically within hours.

WHAT WE KEEP AFTER DELETION, AND WHY:

• BACKUPS. Protected backup copies are kept and are used only to recover the Service after a failure. Information you delete from the Service can remain in backup copies made before the deletion. It is not put back into use except to recover the Service after a failure, and it stays protected for as long as it is kept.
• A PERMANENT LOG OF ACCOUNT EVENTS, such as sign-ups, payments, plan changes and publishes, so our billing and compliance history cannot be changed afterward. It holds none of your site content and none of your leads. It does include the record of your sign-up confirmation (its wording, time and IP address), the email addresses of team members you invited, the names of files in your library, the domain names you connected, and the reason you gave for deleting your account, if you gave one.
• THE ONE-WAY CODED CARD VALUE described in section 4B, so a promotional credit cannot be claimed twice with the same card.
• SUPPORT REQUESTS AND FEATURE IDEAS you sent us, with the email address you sent them from, so we keep a record of what we were asked and how we answered. Ask us and we will delete them, unless we must keep them for a legal reason.
• PAYMENT AND TAX RECORDS, kept by us and by Stripe for as long as tax and accounting laws require.
• EMAIL OPT-OUT AND FORM RECORDS: a coded value of your email address, with the site and the date, so we can honor an unsubscribe.
• SHORT-LIVED SECURITY RECORDS: IP addresses used for spam and rate-limit checks are kept for no more than 24 hours; request logs kept by our hosting provider expire on their own after a limited period.

OUR WEBSITE. Contact-form messages are kept in the Service as support requests, with their reference numbers. We do not delete them on a fixed schedule: we keep them for as long as we need them to respond and to keep a record of our correspondence. Ask us and we will delete your message, unless we must keep it for a legal reason. Backup copies are handled as described above. Compliance Grader requests (the address checked, your email address and the results) are kept until you ask us to delete them. Analytics data is kept by Microsoft and Google under the retention settings of their services.

We do not currently delete information on a fixed schedule other than as described above, except that we keep the 20 most recent saved versions of each site and automatically remove a domain claim that was never verified. We may keep information longer where the law, a court order or a legal hold requires it.

11. HOW WE PROTECT INFORMATION

We use administrative, technical and physical measures designed to protect personal information. Information is encrypted in transit and is stored with our hosting provider, which encrypts it at rest. Every customer's records are kept separate from every other customer's. Passwords are stored only in hashed form, card details never reach our servers, and access to production data is limited to the people who operate the Service. No service can promise perfect security. If a security incident affects your personal information, we will notify you as the law requires, and we will tell our customers about incidents affecting the data we hold for them.

12. YOUR CHOICES AND YOUR RIGHTS

IN THE SERVICE: you can see and change your account details, export your leads, download your sites (after 45 days of paid subscription, as our Terms of Service describe), cancel at any time from the Billing page, and delete your account at any time from the Account page.

YOUR RIGHTS. Depending on where you live, the law may give you the right to: know what personal information we hold about you and how we use and disclose it; get a copy of it in a portable form; correct it; delete it; opt out of its sale, of sharing for cross-context behavioral advertising, of targeted advertising and of profiling with significant effects (we do none of these); limit the use of sensitive personal information (we use it only as permitted; see section 13); and appeal if we decline your request. We will honor these requests from any person, whatever state they live in, to the extent we can do so under the law.

HOW TO MAKE A REQUEST: use our contact page and start your message with "Privacy request", or write to 1000x Digital LLC, P.O. Box 700012, Plymouth, MI 48170-9998. Tell us what you are asking for and how we can reach you.

VERIFICATION. To protect you, we verify a request before we act on it, normally by confirming it from the email address on your account or by matching information we already hold. We ask only for what we need to verify you, and we use it only for that.

AUTHORIZED AGENTS. You may use an authorized agent. We may ask the agent for your signed permission and ask you to confirm your identity directly, unless the agent holds a valid power of attorney.

OUR TIMETABLE. We confirm receipt within 10 business days and respond within 45 days of receiving your request. If we need more time, we may extend that once by up to 45 more days, and we will tell you why within the first 45 days. Requests from visitors to Customer Sites are handled as section 5.6 describes.

APPEALS. If we decline your request, in whole or in part, we will tell you why and how to appeal. To appeal, reply to our decision or use our contact page and start your message with "Privacy appeal". We will respond within 60 days and explain what we decided and why. If you are not satisfied, you may contact your state attorney general.

NO DISCRIMINATION. We will not deny you the Service, charge you a different price or give you a different level of service because you exercised a privacy right.

13. ADDITIONAL INFORMATION FOR US STATE PRIVACY LAWS

Comprehensive consumer privacy laws are in force in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, with more states to follow. Whether a given law applies to us depends on its own thresholds. Wherever you live, we provide the rights in section 12 and the information below, which covers the past 12 months and applies to information about you as our customer, as a member of a customer's team, as a visitor to our website, or as someone who contacts us. It does not cover information we process for our customers as their service provider (section 5).

CATEGORIES OF PERSONAL INFORMATION WE COLLECT

We do not collect precise geolocation, biometric information or characteristics of protected classifications, and we do not draw inferences to build a profile about you.

PURPOSES. We collect and use each category for the purposes in section 6.

SENSITIVE PERSONAL INFORMATION. We use your account log-in only to sign you in and keep your account secure. We do not use or disclose sensitive personal information to infer characteristics about you.

SALE AND SHARING. We do not sell personal information and do not share it for cross-context behavioral advertising, and we did not do so in the past 12 months.

RETENTION. Section 10 explains how long we keep each kind of information.

CALIFORNIA "SHINE THE LIGHT". We do not disclose personal information to third parties for their own direct marketing purposes.

14. GLOBAL PRIVACY CONTROL AND DO NOT TRACK

GLOBAL PRIVACY CONTROL (GPC). If your browser sends a GPC signal, we treat it as a request to opt out of the sale and sharing of your personal information for that browser, and our website does not load optional analytics for that browser. You do not need an account to use it.

DO NOT TRACK. Some browsers offer a "Do Not Track" setting. Because there is no common standard for how to respond to it, our website and the Service do not change their behavior when they receive a Do Not Track signal. We honor GPC as described above. Whether third parties may collect information about your online activities over time and across different websites when you use our websites is explained in section 9.

15. CHILDREN

The Service and our websites are for businesses. They are not directed to children, and you must be at least 18 to open an account. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. If you believe a child has given us personal information, contact us at the address in section 1. Customers may not use the Service to collect personal information from children under 13.

16. WHERE WE OPERATE, AND VISITORS FROM OUTSIDE THE UNITED STATES

The Service is offered only to businesses with operations in the United States, and we and our service providers process information in the United States, and our hosting provider may also process it in the other countries where it operates data centers. Our website can be visited from anywhere. If you are outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

IF YOU ARE IN THE EUROPEAN ECONOMIC AREA, THE UNITED KINGDOM OR SWITZERLAND:

• LEGAL BASES. We process your information to perform a contract with you or take steps at your request (your account and the Service; answering your inquiry); for our legitimate interests in running, securing and improving our website and Service, preventing abuse, and communicating with business contacts, where those interests are not overridden by your rights; with your consent (optional analytics, which you can withdraw at any time through "Cookie settings"); and to comply with legal obligations (for example, tax records).
• TRANSFERS. We are not certified under the EU-US Data Privacy Framework. Where the law requires a transfer mechanism for information sent to us in the United States, we use the European Commission's Standard Contractual Clauses and, for the United Kingdom, the UK International Data Transfer Addendum, as set out in our Data Processing Agreement for our customers.
• YOUR RIGHTS. You may ask for access to, correction of, erasure of, restriction of or a portable copy of your information, object to our processing based on legitimate interests, and withdraw consent at any time without affecting earlier processing. Use the contact details in section 1. You may also complain to your local data protection authority (in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner).

17. CHANGES TO THIS POLICY

We will post any change on this page with a new "Last updated" date. If we make a material change, we will email account holders at least 30 days before it takes effect, and, where the law requires your consent to a change, we will ask for it.

18. CONTACT US

1000x Digital LLC
P.O. Box 700012, Plymouth, MI 48170-9998
Through our contact page

If you are unhappy with how we handled a privacy request, tell us, and a person will look at it again.

Related documents: Terms of Service · Data Processing Agreement · Subprocessors · Cookie Policy