Privacy Policy
This draft explains what the HTML Hosts marketing site collects, and what the hosted-website service is expected to collect when it is on. The legal entity name is [to be inserted by counsel].
1. Who this covers
It covers visitors to htmlhosts.com, people who send the contact form, and, when the product is live, the business that buys a site and the people who call or write through that site. It is not a notice for a customer's own patients or clients beyond what we need to pass a message along.
2. What this marketing site collects
Contact form
If you request a preview, we store your name, business name, city and state, email, and any phone number or message you add. We store it so a person here can reply. The form does not add you to a mailing list and does not send the message to an outside marketing tool.
Logs
The web server records the usual log line: IP address, browser, the page requested, and the time. We use that for security and to fix errors. We do not sell log data.
What this site does not use
This marketing site does not load third-party analytics, advertising pixels, chat widgets, or fonts from another company. Fonts are files we host. There is no account on this site. Sign-in goes to app.htmlhosts.com, which is a separate host.
3. What the product is expected to collect
When a business goes live, the app is expected to hold the account email, the business facts you approve for the site, billing references from the payment provider, and messages sent through the site's form. Card numbers are entered on the payment provider's page. We are not supposed to store the full card number.
A preview can show public business facts. It should not invent reviews. If you want a preview taken down, use our contact form.
4. Why we use it
- To answer you and, if it is a fit, to build a preview.
- To host the site you pay for and to make the edits you ask for.
- To bill the $129 setup and the $89 monthly price through the payment provider.
- To keep the service secure, to prevent abuse, and to meet law.
We do not sell personal information. We do not share it for cross-context behavioral advertising. Counsel must confirm which state privacy laws apply to that sentence before launch. We do not use your contact form to train a public model.
5. Service providers
This is a planned list, not a signed data-processing inventory. Counsel has to approve the real subprocessors, regions, and contracts before launch.
- The operator of this Django application, which stores contact-form messages.
- Cloudflare, if it proxies htmlhosts.com or serves a customer site at the edge.
- The payment provider (Stripe is the planned provider) when a customer pays on the go-live page. The marketing form does not contact Stripe.
- An email provider, only if we later turn on outbound mail. It is off for this form. Replies require a separate, authorized process.
6. How long we keep it
These periods are candidates from our internal privacy notes, not statutes, and the product does not yet delete on a timer. Counsel and engineering have to turn them into a real job before launch.
- Contact-form messages: candidate 90 days after we reply, unless a longer period is needed for a dispute.
- Security logs: candidate 90 days in ordinary search, longer only where an investigation requires it.
- A live customer's site content: for the subscription, plus a candidate export window after it ends. The cancellation draft describes the export.
- Billing records: counsel sets the period required for tax and disputes.
7. Your requests
Use our contact form to ask for access, correction, or deletion. We will verify the request in a way that fits the risk, and we will not send someone else's records. We may keep a small record that we completed the request, and we may keep what the law requires us to keep. Backups may hold a copy until they expire. Counsel must set the deadline we promise.
8. Children
The service is for businesses, not for children. We do not knowingly collect personal information from a child under 13. If we learn that we have, we will delete it.
9. Security
We use access control, encryption in transit on the public site, and a hosting setup described in our operations notes. No method is perfect. A breach notice, if one is required, is decided by counsel from the facts. This draft does not promise a universal 72-hour clock.
10. Changes
When counsel approves a privacy notice, the effective date on that notice is the one that counts. This draft date is not an effective date.