Privacy Policy

What we store

• Account details — your email address, your name if you give one, a one-way hash of your password (never the password itself), and whether your email has been verified.
• Project intake — your questionnaire answers, any brand assets you upload (logos, colour and type specifications, brand PDFs), and the reference site URLs and notes you provide.
• Payment records — the amount charged and Stripe's own identifiers for the transaction. We never see or store your card details.
• Operational records — the job and token-usage ledger for your build and each revision, the delivery archives generated for you, and an internal audit log of the decisions our staff take on your project (quote issued, build approved, refund issued).

Cookies and referrals

Some of our partners (“affiliates”) share links to this site that end in a referral code. When you open such a link and the code belongs to an active affiliate, we set one cookie named wb_ref. It stores only that affiliate referral code, and nothing else about you. It lasts 30 days, is a first-party cookie (set by this site, not by a third party) and is httpOnly, so scripts running in your browser cannot read it. Its only purpose is to attribute you to the affiliate who referred you if you go on to create an account. We do not use it for advertising or analytics. The session cookie that keeps you signed in is set separately when you log in.

If you create an account while that cookie is present, your account is linked to the affiliate who referred you. The link is made when you confirm your email address, using the referral captured when you signed up or the cookie, and our staff can also correct it. The link stays on your account after the cookie expires. When you pay, the affiliate's commission rate is fixed; once your paid project is delivered, a commission entry is recorded for that affiliate. In their own partner dashboard the affiliate can see the business name of the project, its date, the status of their earning and their commission amount, plus a count of verified referred sign-ups. They cannot see your email address, the price you paid, your questionnaire answers, your uploads or your delivered site.

Separately, when our staff create an affiliate account we send that person an invite email (via Resend) at the address we were given. It contains a link to set a password and nothing else about clients.

Who else processes it

• Anthropic — the build pipeline sends your questionnaire answers and brand material to Anthropic's Claude API to design and code your site.
• Stripe — handles payment entirely, including collecting your card details on its own pages.
• Resend — delivers the transactional emails we send you (verification, quote ready, site ready) and the invite emails we send to affiliates.

We do not sell your data and we do not share it with anyone else.

Where your data is stored

On Online Dimensions' own server infrastructure — a PostgreSQL database for records and a MinIO object store for uploaded assets and generated archives — rather than in a third-party application platform.

Access control

Every read of an uploaded asset or a delivery archive is authorised against the project it belongs to, so one client's uploads and generated site are never reachable by another. Online Dimensions staff can see your project in order to review the build before it reaches you — that human quality check is a deliberate part of the service.

Deletion and data export

Contact Online Dimensions to request deletion or an export of your data and we will handle it manually. There is no self-serve deletion or export flow in the product today, and this policy says so rather than implying one exists.