Privacy Policy

1. Who this applies to

This policy covers two groups: users (people who create a BonPages account and build sites) and visitors(people who view sites published with BonPages). For account data, BonPages is the data controller. For data collected through a user's own forms, the user is the controller and BonPages acts as a processor on their behalf (see section 9).

2. Information we collect

Account information

• Your email address (used for sign-in via one-time code) and, if you use Google sign-in, your name and profile image from Google.
• Your display name and any profile details you add.
• Subscription and billing status (plan, renewal date, and a customer reference held by our payment processor — we do not store full card numbers).

Content you create

• The sites, pages, blocks, text, settings, and uploaded files (images/videos) you add. Uploads are stored with our file-storage provider.
• Custom domains you connect and the related verification records.

Support & communications

• Messages you send us by email or in-app chat, and our responses.

Technical & log data

• Standard server logs such as IP address, request times, and error data, used for security, debugging, and rate-limiting.

3. Visitor analytics on published pages

When someone visits a page published with BonPages, we collect privacy- friendly, aggregated analytics for the page owner. This is designed to avoid identifying individuals:

• Cookieless visitor estimate. We derive a salted, daily-rotating hashfrom the visitor's IP and user-agent to estimate unique visitors. It cannot be reversed to an IP or person and changes every day.
• First-party anonymous ID.A random identifier stored in the visitor's browser localStorage (key bp_anon) lets us measure sessions, bounce rate, and new vs. returning visitors. It is not a cookie, is not shared across sites, and contains no personal information.
• Approximate location (country, region, city, and coarse latitude/longitude/timezone) derived from network signals at our hosting provider — not precise GPS.
• Device, browser, and OS inferred from the user-agent; the referrer and any UTM campaign parameters in the visited URL; and the pages and links viewed.

We do not use third-party advertising or cross-site tracking cookies, and we do not build advertising profiles of visitors.

4. How we use information

• To provide, operate, and secure the Service and your account.
• To authenticate you (send sign-in codes, Google login).
• To process subscriptions and payments.
• To render your published pages and generate share/social previews.
• To show you analytics about your own pages.
• To send essential service emails (e.g., sign-in codes, billing, a welcome message, and form-submission notifications you enable).
• To provide support and respond to your requests.
• To prevent abuse, fraud, and security incidents, and to comply with law.

5. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: contract (to provide the Service you sign up for), legitimate interests (to secure the Service and provide privacy-friendly aggregate analytics), legal obligation (e.g., tax and accounting), and consent where required.

6. Cookies & local storage

We use a small number of strictly necessary technologies: a session cookie to keep you signed in, and the first-party bp_anon value in localStorage for analytics described above. We do not use advertising or cross-site tracking cookies.

7. How we share information

We do not sell your personal information. We share data only with service providers (“sub-processors”) that help us run BonPages, under agreements that limit their use of it:

• Hosting & database — to run the application and store your data.
• File storage — to store images and videos you upload.
• Authentication — Google, if you choose Google sign-in.
• Payments — Dodo Payments, to process subscriptions.
• Email delivery — Resend, to send transactional emails.
• Support chat — our chat provider, for in-app support.

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of BonPages, our users, or the public. If BonPages is involved in a merger or acquisition, data may be transferred as part of that transaction, subject to this policy.

8. Data retention

We keep account and content data for as long as your account is active. When you delete content or close your account, we delete the associated data within a reasonable period, except where we must retain certain records (e.g., billing/tax) or for limited backups. Aggregated analytics that cannot identify a person may be retained longer.

9. Data you collect from your visitors

If you use forms, you decide what to collect and why, and you are the controller of that data. BonPages stores and forwards submissions to you as a processor. You are responsible for providing your visitors with any required privacy notice and for handling their requests. We act on your documented instructions and help where we reasonably can.

10. Security

We use industry-standard measures to protect data, including encryption in transit (HTTPS/SSL), access controls, and salted/hashed identifiers for analytics. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.

11. International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for international transfers.

12. Your rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. You can update much of your data in the app, and you can exercise other rights by contacting us. We will respond within the timeframe required by law. Visitors who want to exercise rights over data collected through a specific BonPages site should contact that site's owner; we will assist them as the processor.

13. Children

BonPages is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll update the “Last updated” date and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the updated policy.

15. Contact

For privacy questions or requests, email ady@bonpages.com or use the in-app chat.