Loading
Last updated: September 7, 2026
When you use the contact form, we collect your name, email address, phone number if you provide one, business name, which service tier you're interested in, and the message you send. If you email or call us directly, we collect whatever you send us there too.
Business lookup: if you use our site-building tool's business-search field, your query is sent to the Google Places API to help you find and confirm your business and its city. We keep only the resulting Google Place ID; we don't durably store the address, phone, or category text Google returns.
Account access: to claim or edit your site, we email you a one-time sign-in link. We store your email address and a signed, revocable session credential. There's no password to store, and no third-party sign-in option to grant access.
Domain registrant data: if you register a custom domain through DebugDad, we collect the name, email, address, and phone ICANN requires of a registrant and pass it to our domain-registration provider. It is not publicly listed in WHOIS by default.
Payment data: payments are processed entirely by Stripe. Your card number goes directly to Stripe; we never see or store it, only your Stripe customer and subscription IDs.
To reply to your inquiry and prepare a proposal, and, if you use our site-building tool, to generate your site (the AI uses the business details you submit as its source material), deliver and support it, manage your subscription and billing, register and manage a custom domain on a paid plan, and comply with legal obligations like tax records or a valid legal request.
We don't use your information for advertising, build behavioral profiles about you, or make automated decisions that materially affect you. We don't sell it.
If your published site has a working contact form, visitors can send you their name, email, and a message; we store and deliver those on your behalf. That data is yours to manage, not ours.
The optional visitor-analytics feature on hosted sites never stores an IP address, a browser's user agent string, or any query-string parameters. A visitor is counted as unique using a hash that's salted and rotated daily, so no individual visit can be reconstructed. If the salt is ever unset, the collector refuses to record anything rather than falling back to weaker tracking.
A signed session cookie keeps you logged in after you use a sign-in link; it carries no tracking payload and expires when your session ends. We use Vercel Web Analytics on this site to see aggregate traffic; it doesn't use cookies or store IP addresses. We don't run Google Analytics, the Meta Pixel, ad-network tags, or any third-party ad-tracking cookie, here or inside the sites we build for customers.
Your data is stored in Supabase, encrypted at rest, with connections encrypted in transit. The platform runs on Vercel; payments are processed on Stripe's PCI-compliant infrastructure. We restrict access to what the systems and people running the service need, and we'll notify you promptly if we become aware of a breach affecting you.
Only the providers the service genuinely can't run without: Stripe (payments), Brevo (transactional email: sign-in links, receipts, renewal notices), Supabase (database), Anthropic (the business details you submit, to generate your site), Vercel (hosting and, on a paid plan, custom domain registration), Upstash (briefly, to rate-limit abusive requests), Pexels (stock photography for generated sites), Telegram (an operator notification when you submit the contact form, so a real person sees it quickly), and Google Places (business lookup during intake, described above). No data brokers, no ad networks, no selling or renting your information.
We keep your information for as long as you have an account with us. Form submissions are kept for as long as the site that collected them exists. You can ask us to access, correct, delete, or export your personal data by emailing contact@debugdad.com with the subject line "Privacy Request", and we'll respond within 45 days. We don't sell personal data, and we won't treat you differently for exercising any of these rights.
Our service is for businesses and isn't directed at children under 13. We don't knowingly collect personal information from anyone under 13.
If we change this policy, we'll post the update here with a new date. For significant changes, we'll try to notify you by email in advance.