WindowsitesBuild my free site

Privacy Policy

Last updated November 4, 2026

Windowsites builds websites for local businesses. This policy explains what personal information we handle, why, who we share it with, how long we keep it, and what you can ask us to do. Windowsites is run by Bear Software, registered with the Dutch Chamber of Commerce (KvK) under number 42017540, VAT number NL005437235B03, Marene 16, 4007 NP Tiel, the Netherlands, which is responsible for this information. Questions or requests: berend@bearsoftware.nl.

The short version

  • We do not sell personal information and do not share it for targeted advertising.
  • Our sites and sample sites use no advertising or tracking cookies.
  • You can ask us at any time to stop contacting you, or to see, correct or delete your information.

1. Businesses we contact

We look for local businesses that do not have a website yet, build a free sample site for them, and email the business to offer it. For that we use:

  • Public business information from Google (through the Google Places service): business name, address, phone number, opening hours, category, rating and number of reviews, and photos. For a sole trader this can include their name. We refresh or delete information from Google within 30 days, as Google requires.
  • A business email address that the business itself published as a way to contact it (for example on its own social media page or business listing). We record where we found it.
  • Our emails and your replies: what we sent and when, and whether you replied, unsubscribed or asked us to stop.

Every email we send says who we are, includes our postal address, and has a one-click unsubscribe link. If you unsubscribe or ask us to stop, we stop right away and keep your address on a do-not-contact list so it does not happen again.

2. Visits to sample sites

On a sample site we count visits so we know whether our offer was seen: number of visits, time on the page, type of device, and the referring website. We do this without cookies and without storing IP addresses; to avoid counting the same visitor twice on one day we use a code derived from the IP address and a key that changes every day, which cannot be turned back into the address.

3. Customers

When you activate a plan we process:

  • Your contact details: name, email address, phone number and business name, to provide the service, send login links and contact you about your account.
  • Billing details: billing address, plan and payment history. Payments are handled by Stripe; we never see or store your full card number.
  • Domain registration details: if we register a domain for you, the registrar and the domain registry need the owner's name, address, email and phone number. Depending on the domain, some of this may appear in public domain records.
  • Your content: the texts, photos and logo you add to your site.
  • Consent records: which version of our terms and which renewal terms you agreed to, and when.
  • Support messages you send us, and notes of phone calls.

4. Visitors of our customers' websites

We host websites for our customers. When someone sends a message through the contact form on such a site, we email it straight to that business and do not keep the message. We keep only the time and a one-way code derived from the sender's IP address, to stop spam. For anything else about that message, the business is responsible; we handle it on their behalf.

Customer sites set no tracking cookies. A map from Google Maps only loads when the visitor clicks to show it; Google may then set cookies. Stock photos are loaded from Unsplash's servers, which receive the visitor's IP address like any website that serves an image.

5. This website and your account

Our servers keep short technical logs (such as IP address, browser and the page requested) to run the service securely and fix errors. We use a cookie only to keep you logged in to your account; we use no analytics or advertising cookies.

6. Who we share information with

We use these service providers, who may only use the information to provide their service to us:

  • Vercel and Fly.io: hosting of this website, the sites we build, and our background jobs (United States).
  • Neon: our database (United States).
  • Cloudflare: file storage for site files and uploaded photos.
  • Google: business information, photos and maps.
  • Anthropic: AI that helps write the first version of a site from public business information, and the change requests you type in your account.
  • Stripe: payments and invoices.
  • Our email delivery provider: sending email.
  • Our domain registrar and the domain registries: registering domains in your name.
  • Unsplash: stock photos (no personal information is sent to them by us).

We may also share information when the law requires it, to protect our rights or the safety of others, or as part of a sale or merger of our business, in which case this policy continues to apply.

7. How long we keep it

  • Sample sites are online for 30 days by default.
  • Businesses that do not respond or are not interested are deleted after at most 90 days without activity.
  • Unsubscribes and objections are kept on a do-not-contact list (only the email address or a one-way code), with a minimal log of what we sent and why, so we can prove we respect the rules.
  • Customer information is kept while your plan runs and afterwards as long as tax law requires (in the Netherlands: 7 years for billing records). When a plan ends, the site goes offline; we keep its content so you can restart, until you ask us to delete it.

8. Your choices and rights

Wherever you live, you can ask us to tell you what personal information we have about you, give you a copy, correct it, delete it, or stop using it to contact you. Email berend@bearsoftware.nl or reply to any of our emails. We answer within 30 days, and we will not treat you differently for making a request. We may need to confirm that a request really comes from you.

California and other US states. Residents of states with a consumer privacy law (such as California, Colorado, Connecticut, Virginia and others) have the rights above under those laws. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. You may use an authorized agent to make a request. If we decline a request, you can appeal by replying to our answer.

The GDPR. Because our business is established in the Netherlands, the EU General Data Protection Regulation applies to the information we process. Our legal bases are: our legitimate interest in offering our service to businesses and in running it securely (sections 1, 2, 4 and 5), performing our contract with you (section 3), and legal obligations such as tax law (section 7). You can object to processing based on legitimate interests at any time, and we will stop contacting you. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

9. Transfers and security

Some providers process information in the United States. For transfers from the EU we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. We protect information with encryption in transit, access control and two-factor login for our staff, and by keeping only what we need.

10. Children

Windowsites is a service for businesses and is not meant for children. We do not knowingly collect information from anyone under 16.

11. Changes

We will update this policy when what we do changes, and change the date at the top. If a change matters to customers, we will email them before it takes effect.

12. Contact

Bear Software, registered with the Dutch Chamber of Commerce (KvK) under number 42017540, VAT number NL005437235B03, Marene 16, 4007 NP Tiel, the Netherlands. Email: berend@bearsoftware.nl.