Privacy
Privacy policy.
What Libremade stores about you and your website, where it is kept, for how long, and what you can ask of us. Short and plain.
This policy may be updated before launch. Last updated:
Who we are
Libremade is a website builder run by GetSet. For your account and for the service itself, GetSet is the data controller. This page explains what the product processes and why.
What we process
- Account data. Your e-mail address, your name and your sign-in credentials. They are kept with our database provider, Supabase, in the EU (Frankfurt). We use them to create your account, sign you in and write to you about the service.
- Your website and its files. The content you write and the images, documents and other files you upload. The content is kept in the database; the files are stored in Cloudflare R2 and served to your visitors through our content delivery network.
- Photo and PDF metadata. When you upload a photo or a PDF, we strip the hidden metadata from it (for example the place a photo was taken) before it is stored.
- Sign-in protection. To stop password guessing and mass sign-ups, we count attempts. For that we keep keyed hashes of the e-mail address and of the visitor’s network address, not the plain values. Most of these records are deleted within 24 hours; a record that marks a successful sign-in from a known place is kept for up to 30 days.
- Human check. Sign-up and sign-in may use Cloudflare Turnstile to tell people from bots. When it is on, your browser loads Cloudflare’s script and Cloudflare sees the technical data needed for the check.
This website
The Libremade brand site you are reading has no advertising and no analytics trackers. It loads its fonts from our own storage, not from Google. The only things it asks of your browser are its own pages, styles, scripts and fonts.
Who helps us run it
We use a small number of service providers, who process data only on our behalf and for the purpose below:
- Supabase (EU, Frankfurt): the database and sign-in.
- Cloudflare: file storage (R2), the content delivery network and, if enabled, Turnstile.
- Vercel: hosting of the application and this website.
- A transactional e-mail provider, to send you the messages the service needs, such as an account confirmation. It has not been configured yet; we will name it here when it is.
Some of these providers may process data outside the EU; where they do, they rely on the safeguards the law requires, such as standard contractual clauses.
No ads, no selling
We do not show advertising, we do not sell your data and we do not share it with anyone for their own marketing.
Your visitors’ data
If your website collects information about its own visitors, you are the controller of that data and Libremade is the processor: we handle it only to run your website and on your instructions. You are responsible for telling your visitors what you collect and why, and for having a lawful basis for it.
How long we keep it
We keep your account and website for as long as your account exists. When you delete your website or your account, we delete the data, except what the law requires us to keep, and backups are overwritten in their normal cycle. Sign-in protection records are kept for the short periods described above.
Your rights
Under the GDPR you have the right to:
- access the data we hold about you;
- have wrong data corrected;
- have your data erased;
- receive your data in a portable form;
- object to processing based on our legitimate interests;
- complain to a data protection supervisory authority, for example in the country where you live.
To use any of these rights, write to us using the contact below.
Contact
Contact us through your account.