Version 2026-09-30 · plain language, no small print. This page describes what Sitewillow actually does with your data and your money.
Sitewillow needs an email address to give you an account, and it stores the website you build. We do not sell your data, we do not track you across other websites, and the statistics we offer are built to work without following individual visitors around.
A message from your contact form is stored in your Sitewillow inbox first, so it can be accessed even if an email notification fails. It contains whatever your visitor filled in. A notification is emailed to your chosen address, or to your account email if no other address is set.
We use account, website, billing and domain information to provide the services you request and perform our agreement with you. We retain records where required by law. We use limited technical information to protect accounts, prevent abuse and operate the service, based on our legitimate interests. Optional setup analytics rely on your consent.
Stripe handles your payment details. We store references to your customer, subscription and payments, your plan, billing period, cancellation status and domain orders. For domain registration, we also store the registrant contact details you submit.
Sitewillow is responsible for how it uses account and service information. If you collect information through your own website, you are responsible for telling your visitors why you collect it and for the content of your forms. We store and deliver those messages on your behalf; contact us about processing arrangements for your website.
Sitewillow's own statistics are deliberately plain: no cookies, no profile, no raw IP address stored, and a browser that sends "do not track" is not counted. What we keep is a page path, a timestamp and a daily visitor code derived from connection information. We do not keep the raw IP address in these statistics or use this code for cross-day profiling. These are privacy-conscious statistics, not a promise that every piece of technical data is anonymous.
The same applies to the pages of sitewillow.com itself. On both, a small script may confirm that a browser window is actually open: it sends the page address and whether the visitor scrolled or tapped, nothing else. It does not run for browsers that send "do not track", and it stores no cookie and no address on the visitor's device.
If you add your own Google Analytics or Meta Pixel code to your site, those are not ours. They load only after a visitor allows them, and from that moment their own terms apply.
If you explicitly allow product analytics, Sitewillow records fixed step names such as viewed, completed or back, plus the entry route, broad device class and chosen setup path. It never sends the answers, business name, contact details or other free text from the setup.
When you are signed in, an event can be linked to your account and your own website; before sign-in those fields stay empty. The server sets the timestamp and replaces the network address with a rotating, non-reversible code. Duplicate events are ignored, requests are rate limited and these process events are removed after at most 90 days. The report is internal and is not part of a site owner's visitor dashboard. Declining leaves the setup fully usable and stores no events.
The application server is in the Netherlands. The providers above may process data in other countries. Applicable processing terms and transfer arrangements depend on the provider and service. Contact us for information about the arrangements used for your data.
While your account is open, we keep your saved work so you can carry on. Cancelling a paid subscription stops paid hosting at the end of the paid period; it does not delete your account, drafts or messages. Contact us to close your account and request deletion.
Ask us to delete everything sooner and we will, as long as we are not legally required to keep an invoice.
You can also ask us to restrict processing and withdraw consent for optional analytics at any time. Email [email protected] and we will normally respond within one month. If a lawful extension is needed, we explain it within that month. If you think we handled it badly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Traffic is encrypted, passwords are hashed, sessions can be revoked from your own security screen and two-factor authentication is available. No system is perfect: if something goes wrong that affects you, we will tell you rather than hope you do not notice.