Privacy Policy

WITWEB SOLUTIONS(“we”, “us”) operates HTML Email Builder. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the rights you have over it, wherever you are.

Last updated: 28 September 2026.

Who is responsible

WITWEB SOLUTIONS, based in Australia, is the “controller” (GDPR), the “APP entity” (Australian Privacy Act 1988) and the “business” (CCPA) responsible for your information. You can reach us about anything in this policy at witweb.com.au.

The short version

You can build and export emails without an account, and then we store nothing about you on our servers.
We never sell your information, and never use your email content for advertising or to train AI models.
Our content pages (not the editor) show Google ads. Where the law requires it, nothing loads until you agree; everywhere, you can say no in one click, and we honour Global Privacy Control.
You can download or delete your saved data yourself, at any time, from Your data.

What we collect, why, and our legal basis

Information	Why we use it	Legal basis (GDPR / UK GDPR)
Account details: email address, name and profile picture if you sign in with a social account, held by our authentication provider, Clerk.	To create and secure your account and sign you in.	Performance of a contract (Art. 6(1)(b)).
Eligibility record: that you passed our age check and which version of the Terms you accepted, and when. Your date of birth is not stored.	To show you are old enough to hold an account and agreed to the Terms.	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).
Terms signatures: each time a signed-in user signs the Terms: account, email address, Terms version and a fingerprint of its text, date and time, IP address and browser.	To prove that you agreed to the Terms, and which version.	Legitimate interests (Art. 6(1)(f)) in being able to establish, exercise and defend legal claims.
Content you save: campaigns, their settings, and images you upload.	To save, load and host them for you.	Performance of a contract (Art. 6(1)(b)).
Test-send details: the recipient addresses, subject and optional reply-to you enter when you send a test.	To deliver the test through our email provider, Resend. We do not keep a copy.	Performance of a contract (Art. 6(1)(b)).
Notices you send us: name, contact details and the content of a copyright or content report.	To handle the notice and respond, and to keep a record of it.	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).
Technical data: IP address, browser and device type, processed by our hosting provider and security services (including Cloudflare Turnstile bot protection on sign-up) in server logs.	To deliver the site, keep it secure and prevent abuse.	Legitimate interests (Art. 6(1)(f)) in a working, secure service.
Advertising data: cookies, device identifiers and your IP address, collected by Google on our content pages when advertising runs.	To select, show and measure ads, which fund the free service.	Consent (Art. 6(1)(a)) where the law requires it, including the EEA, UK, Switzerland and Québec; elsewhere, legitimate interests, subject to your opt-out.

We do not collect sensitive information (such as health or biometric data), we do not buy information about you from others, and we make no decisions about you by automated means that have legal or similarly significant effects.

Your email content

You own everything you create. We do not read, mine, sell or repurpose the content of your emails, we do not use it to target advertising, and we do not use it to train AI models. Images you upload are published at a public web address, which is what lets an inbox display them, so do not upload anything you would not publish.

Who we share it with

We share personal information only with the service providers that run the product, under contracts that limit them to processing it on our instructions:

Clerk (United States): authentication and account management.
Supabase (database and image storage): saved campaigns and uploads.
Vercel (United States): hosting and delivery of the site, and Vercel Web Analytics, which counts page views in aggregate without cookies or any identifier that follows you across sites.
Resend (United States): delivering test sends and notice confirmations.
Cloudflare: Turnstile bot protection on sign-up.
Google: advertising on our content pages. Google acts as an independent controller of the data its ad tags collect; see how Google uses information from sites that use its services.

We may also disclose information where the law requires it, to protect rights and safety, or as part of a sale or reorganisation of the service (in which case this policy continues to apply). We do not give advertisers your name, email address, account details or anything you write in the editor.

International transfers

We are in Australia and several of our providers store or process data in the United States and elsewhere. Where information from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) or the provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. For Australian law, we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles (APP 8). You can ask us for a copy of the relevant safeguards.

How long we keep it

Account details and eligibility record: until you delete your account.
Saved campaigns and uploaded images: until you delete them or your account. Deleting your account erases both automatically.
Terms signatures: seven years after the last one, which covers the time limits for bringing contract claims. They are kept when you delete your saved data or your account, because they are needed to establish or defend legal claims (GDPR Art. 17(3)(e)); they are included in your data export.
Test sends: we keep no copy; Resend keeps delivery logs for a limited period under its own policy.
Notices: as long as needed to handle them and defend any claim, normally no more than three years.
Server logs: short periods set by our hosting provider, typically days to weeks.
Your cookie choice: six months, then we ask again.

Advertising and your choices

Ads are served by Google AdSense on our home, blog and information pages. They are always labelled, and never appear inside the editor.

EEA, UK, Switzerland and Québec, and anywhere we cannot tell where you are: the ad script does not load, and nothing is set or sent to Google for advertising, until you agree.
Elsewhere: ads run by default and the banner is your notice and opt-out. Saying no switches off advertising cookies and personalisation.
Global Privacy Control: if your browser sends a GPC signal we treat it as an opt-out of selling and sharing, automatically.

You can change your choice at any time: . You can also manage Google ad personalisation in Google Ads Settings and opt out of other vendors at aboutads.info/choices or youronlinechoices.eu. We have switched off the browser Topics advertising API for this site. Details of every cookie are in our Cookie Policy.

Your rights

Depending on where you live, you have some or all of these rights:

Access: get a copy of the information we hold about you.
Portability: receive it in a machine-readable format.
Correction: have inaccurate information fixed.
Deletion: have your information erased.
Restriction and objection: ask us to limit or stop using it, including for advertising.
Withdraw consent: at any time, without affecting what was done before.
Opt out of selling or sharing, and of targeted advertising.
Complain to a data protection authority.

The quickest way to download or delete your data is Your data; account details can be viewed, corrected and deleted under Manage account in the account menu. For anything else, contact witweb.com.au. We will verify the request comes from you, and respond within 30 days (45 days under US state laws), free of charge. You can use an authorised agent where your law allows it. We will not treat you any differently for using a right. If we refuse a request, we will say why and how to appeal.

Complaints.Please contact us first so we can try to resolve it. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au), your EU/EEA data protection authority, the UK Information Commissioner’s Office (ico.org.uk), the Office of the Privacy Commissioner of New Zealand (privacy.org.nz), or your local regulator.

US state privacy notice

This section applies to residents of California and other US states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas and Oregon).

Categories collected in the last 12 months: identifiers (email, IP address, cookie IDs); internet activity on our content pages; and customer records you give us (saved content). Sources: you, your browser, and our providers.
Sold or shared:we do not sell personal information for money. Allowing Google to use cookies for personalised advertising on our content pages may be “sharing” for cross-context behavioural advertising, or a “sale” under some state laws. You can opt out with or by turning on Global Privacy Control.
Sensitive personal information: we do not collect it.
Minors: we do not knowingly sell or share the personal information of anyone under 16.
Retention and your rights: as set out above, including the rights to know, delete, correct and opt out, and to appeal a refusal by replying to our response.

Children

HTML Email Builder is a tool for businesses and marketing professionals and is not directed at children. Accounts are only available to people aged 16 or over, which we check with a neutral age question before an account is created; the date you enter is not stored. We do not knowingly collect personal information from children under 16, and we do not request child-directed ad treatment because the service is not directed at children. If we learn that an account belongs to someone under 16, we close it and delete its data. If you believe a child has given us personal information, contact witweb.com.au and we will delete it.

How we protect information

Data is encrypted in transit (HTTPS/TLS) and at rest by our database provider.
Authentication is handled by Clerk; we never store or see your password, and multi-factor authentication is supported.
The database has row-level security on, and every server request is scoped to your account.
Uploads are checked for their real file type, size-limited and stored under a per-account folder.
Strict security headers, rate limits and bot protection guard against abuse.

No method of transmission or storage is completely secure. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulator as the law requires (including under Australia’s Notifiable Data Breaches scheme and GDPR Arts. 33 and 34).

Changes to this policy

We will update the date at the top when this policy changes. If a change is material, we will tell account holders before it takes effect, and where it needs your consent we will ask for it.

Contact

WITWEB SOLUTIONS, Australia. Email: witweb.com.au.