Privacy Policy

[Company legal name], [registered address] (“Frontdesign”, “we”, “us”) is the controller of the personal data described in this policy, which we process when you visit our website or use the Frontdesign Service. This policy should be read with our Terms of Service.

For any privacy question or request, write to support@frontdesign.app. Data protection officer: [DPO contact, if appointed]. Representative in the EU or the UK: [representative, if required].

Frontdesign currently runs in demo mode. Your account, projects, prompts, images, conversations and credit history are stored only in your browser, using local storage and IndexedDB, and are not sent to our servers. No AI provider and no payment provider receives your data, and nothing is charged. Clearing your browser's site data deletes this information. The rest of this policy describes how data will be processed once accounts, payments and AI generation run on our servers.

• Account data: name, email address, sign-in method (email or Google), email verification status and profile picture if you add one. Passwords are stored only as salted hashes by our authentication provider.
• Your content: prompts, inspiration images and screenshots, reference URLs, chat messages, page documents and their versions, exported files and publishing settings.
• Credits and billing: credit balance, reservations and transactions, purchase history, payment status and the references sent by our payment provider. We never receive or store full card numbers.
• Usage and technical data: AI usage measured for each task (model, tokens, cost, duration and status), log data such as IP address, browser, device, pages visited and timestamps, error reports and security events.
• Support: the messages you send us and our replies.

We use personal data only for the following purposes, each with a legal basis under the GDPR:

• Provide the Service. Create your account, generate and edit pages, keep versions, export and publish.Legal basis: Performance of our contract with you.
• Credits and billing. Process purchases, keep the credit ledger and reservations, prevent double charges, issue receipts.Legal basis: Performance of the contract and our legal obligations (accounting and tax).
• Security and abuse prevention. Protect accounts, detect fraud and misuse, enforce the acceptable use rules.Legal basis: Our legitimate interest in keeping the Service and its users safe.
• Improve the Service. Measure performance, costs and quality of generations using aggregated usage data.Legal basis: Our legitimate interest in improving the Service. Your content is never used to train AI models.
• Communicate with you. Service emails such as verification, receipts and important changes; product news if you opt in.Legal basis: Performance of the contract; your consent for product news, which you can withdraw at any time.
• Comply with the law. Answer lawful requests from authorities and keep the records the law requires.Legal basis: Our legal obligations.

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.

• To generate and edit pages, we send your prompt, the relevant content of your page and the attachments you provide to our AI provider, Anthropic, which processes them on our behalf to return a result. Under our agreement, the provider does not use this data to train its models.
• When you add a reference URL, we may retrieve the public page at that address, within the limits of access and applicable rights, to take inspiration from its structure and style. Retrieved content is treated as untrusted and is not copied into your page.
• Neither we nor our providers use your content to train AI models.

We do not sell or rent your personal data. We share it only with:

• service providers that process it on our instructions, under contracts with confidentiality and security obligations: hosting and database [hosting provider], authentication [auth provider], AI (Anthropic), payments [payment provider], transactional email [email provider] and error monitoring [monitoring provider];
• authorities, when the law requires it;
• a successor, in case of a merger or acquisition, after informing you.

Template images are loaded from Unsplash, which receives your IP address when your browser displays them, like any image hosted by a third party.

Some of our providers are located outside your country, including in the United States. When personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission, with additional safeguards where needed.

• Account data: while your account is open, then deleted within 30 days of closure.
• Projects, versions and uploads: until you delete them or close your account; copies in backups are erased within 90 days.
• Billing records and credit ledger: as long as accounting and tax laws require, up to 10 years.
• Logs and security events: up to 12 months.
• Prompts typed before sign-up: kept in your browser for up to 24 hours, then discarded.
• Support messages: up to 3 years after our last exchange.

We only use storage that the Service needs to work. We do not use advertising cookies or cross-site tracking. If we ever add analytics that require consent, we will ask first and you will be able to change your choice at any time.

• fd-sessionLocal storage · Until you sign outKeeps you signed in on this device.
• themeLocal storage · Until you clear itRemembers the light, dark or system theme.
• fd-pending-promptIndexedDB · 24 hoursKeeps the prompt you typed before signing up, so it survives authentication.
• fd-projects, fd-chat, fd-wallet, fd-demo-seededIndexedDB, local storage · Until you clear themDemo mode: your projects, conversations and demo credits, stored on your device.

You can delete these items from your browser settings at any time. You may then be signed out and lose demo data.

When your pages collect data through forms, you are the controller of that data and Frontdesign acts as your processor when it hosts the page or relays submissions. You must give your visitors the information the law requires, such as a privacy notice, obtain consent where needed and have a lawful basis for the processing. A data processing agreement is available on request: [DPA link].

Pages you export and host elsewhere are outside our control.

Depending on where you live, including under the GDPR in the EEA and the UK, you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing, including objecting to direct marketing at any time;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting processing that happened before;
• lodge a complaint with a data protection authority, such as [lead supervisory authority] or the authority where you live.

Many of these rights can be exercised directly in the Service: edit your profile, download your projects, delete projects or close your account from your settings. Otherwise, write to support@frontdesign.app from the email address of your account. We answer within one month, which may be extended by two months for complex requests, and may need to verify your identity first.

If you live in California or another US state with a privacy law: we do not sell your personal information or share it for cross-context behavioral advertising, and you can exercise your access and deletion rights as described above.

We protect your data with encryption in transit and at rest, least-privilege access controls, isolation of generated code, an audit trail of credit operations, regular backups and checks on uploaded files. No system is perfectly secure: if a breach affects your data, we will notify you and the competent authorities as the law requires.

The Service is not intended for anyone under 18, and we do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it.

We will update this policy as the Service evolves. We will tell you about material changes by email or in the Service before they take effect. The date at the top of this page shows the latest version.

Privacy questions or requests: support@frontdesign.app, or by post to [Company legal name], [registered address].