Version: privacy-v11 · In force from: 13 October 2026
GetSuperWeb is the trading name of GetSuperWeb Technology, an individual establishment (sole establishment) in Dubai, UAE, licensed under Dubai Trader License no. 1658924 (Department of Economy and Tourism, Dubai). GetSuperWeb Technology is responsible for your personal data (the "controller" under the UAE Personal Data Protection Law, Federal Decree-Law 45/2021, the "PDPL").
Our team runs day-to-day operations: we review proposals, record payments and refunds, register domains and answer emails. If the person who runs operations is unavailable, the licence holder is responsible for restoring our systems, producing exports and recovering websites; no other person is given access for this.
Contact for anything in this notice: hello@getsuperweb.com
This notice covers our emails to businesses, our design proposals, the free-preview request form on our website, the offer page, your GetSuperWeb account, website previews, the websites we run for clients, email at your domain, and visitors to our website and to client websites (section 8.1).
Who we write to. We send unrequested emails only to businesses we have verified as legal persons (an LLC, FZ-LLC, FZCO, PJSC or a branch), from their trade-licence listing or the legal details on their own website. We never send them to sole traders or to businesses whose legal form we could not verify.
What we use
What we do with it
Our legal basis: Business information about a company that names no individual is not personal data. Where an item does relate to a person, we use only what they published themselves (PDPL Art. 4(2)), and only to send this proposal and to honour any objection (Art. 17). Some of this processing takes place outside the UAE (section 10). For these emails we have found no case in the PDPL's transfer rules that clearly applies, so we keep the data involved to the minimum described here and accept that remaining risk (section 10).
How long the proposal is available:
What happens to the data after that date:
Saying no: reply STOP and we will not email you again. Our system recognises a STOP reply automatically, normally within an hour, records it and stops all our providers from emailing you. To do this, our workflow service (n8n) receives from lemlist a short preview of each reply; it is used only to recognise a STOP and is not stored: we keep only lemlist's reference for the reply, our reference for you, and whether it was a STOP. Replies are also read by a person on our team, so a STOP our system does not recognise is still honoured. If you are not a client, STOP means we never email you again. STOP does not delete your data by itself. Ask for deletion if you want that too (section 12).
On getsuperweb.com you can ask us to build a free preview of a website for your business.
What we collect: your business name, a link to where your business already appears online (for example your Google Maps listing or Instagram), your email address, your WhatsApp number if you give it, which kind of website you are asking about (our standard plan, or a bespoke project), the time of your request, how many times you sent it, which version of this notice was shown with the form, and your agreement to the box described below, with its time. If the email address has asked us never to contact it again, we do not store the request.
What we do with it:
Abuse protection: to limit how often the form can be sent, we keep a coded form of the sender's IP address (a keyed hash that cannot be turned back into the address) with the day; it is deleted within 3 days.
How long we keep it: if your request never becomes a proposal, we blank your business name, link, email and WhatsApp number 30 days after your last request. If we build a proposal, the rules in section 3 apply to it.
Our legal basis:
On the proposal page you choose a plan and accept the offer.
We record:
The order also keeps a copy of the business information your proposal was built from, so your website starts from exactly what you saw. We also open your first billing period, which shows as unpaid until you pay (section 5). If, before you pay, you accept the same offer again with another email address, we replace the email address on your order with the new one, and the name with the name you then give, unless a payment is in progress at that moment; in that case your order keeps the earlier email address and name.
Our legal basis:
We do not record your IP address with your acceptance. Our hosting provider, Cloudflare, sees it when it delivers the page (section 8).
After your payment is confirmed, we create an account for your business and email an invitation to the address you used when you accepted. The person with that address is the account owner.
Signing in. Our sign-in provider, Clerk, handles sign-in. You enter your email address and Clerk emails you a one-time code; there is no password. Clerk keeps your login: your email address and the record of your sign-ins. When you sign in, Clerk also records your IP address, your browser and device type, and the approximate city and country worked out from your IP address, to secure your sign-in. We do not receive your codes. When you sign in, we receive from Clerk a confirmation that it is you, with your Clerk user ID. The first time you sign in, we also ask Clerk for your email address and whether Clerk verified it, so that we can link your login to your business.
What we keep about your account: your email address, your role (owner), your Clerk user ID, when you joined and when you first opened the account. If you delete your Clerk login, Clerk tells us and we remove your access at once.
What you do in the account: you check and correct your website, upload photos, ask for changes before and after go-live, choose your web address, approve your website, set up email at your domain, see your billing and invoices, download your starter logo and, on Business, your brand pack, and (as owner) update your card, stop or resume automatic renewal, cancel your plan, set mailbox passwords or ask us to move your domain. Sections 5 to 8 describe the data involved.
How we learn from corrections. We count, without linking them to you or your order, how often kinds of corrections happen, to improve the service. In the same way, we count when accounts are first opened and the days they are used, and cancellations and endings with their refund amount or reason. These counts never hold the words you wrote, your contact details, images or links. For about a week (7 days, removed at our next daily clean-up) each count carries a coded reference so that it is not counted twice; after that the reference is removed. A count keeps its date and time and, for a cancellation or an ending, the amounts involved and the date the minimum term would have ended.
Our legal basis: the contract (PDPL Art. 4(9)).
Immediately after you accept, we take you to the secure checkout page of our payment provider, Stripe, to make your first payment; you enter your card details there, not on our pages. If that page cannot be opened, or you leave it, you can pay on your GetSuperWeb pay page. It stays available until you pay, for at least 90 days after you accept, unless before then your order is closed at your request or under Client Terms section 13, or your data is deleted at your request (Client Terms, section 3.5). Stripe saves your card so that your later monthly or yearly payments, and any one-off charge you accept (such as an extra edit), can be charged automatically without you being present (Client Terms, section 3.3). When you update your card in your account, you enter the new card on a Stripe page in the same way. Our systems never receive or store your full card number or security code; Stripe shows us only the limited payment details listed below.
Stripe. Under Stripe's Services Agreement we contract with Stripe Payments Europe, Limited (Ireland); Stripe states that Stripe Technology Company, Limited (Ireland) has primary responsibility for processing personal data outside the Americas. Stripe processes your payment on our behalf, and it also uses payment data as its own responsibility, for purposes it decides such as preventing fraud and meeting its legal duties (including anti-money-laundering checks), under its own privacy policy. To create your checkout, we send Stripe our order number, the billing period, the plan and amount, our internal payment and refund references, and your email address (filled in for you; you can change it on Stripe's page, and your GetSuperWeb account stays linked to the email you gave us). Stripe creates a customer record for you, which holds your saved card. For automatic payments, we ask Stripe to charge the saved card and send the same kind of references. We also write your current renewal choice (automatic renewal on or stopped, or cancelled) and a reference to your current card into that Stripe customer record, so that your instructions can be recovered if our own records have to be restored. For each payment, Stripe shows us, as the merchant: the email and name entered on its page, the payment amount and time, the card brand, the card's country and its last four digits, and Stripe's fraud assessment. If your bank asks you to confirm a payment, or a payment is disputed with your bank (a chargeback), Stripe tells us the status and the amount.
How we confirm a payment: our system asks Stripe for the payment's status and records the payment against your billing period automatically, with Stripe's payment reference, once Stripe confirms it was paid. Your account then shows the period as paid. A payment counts only once. If you pay twice for a period that is already paid, or after your service has ended, we record that payment as owed back and refund it to your card.
What we keep (billing records):
Invoices: We make each invoice, including for automatic payments and one-off charges, by hand in Zoho Invoice, in Arabic and English, and Zoho Invoice emails it to you. Zoho Invoice receives what an invoice needs: your business name and email address, the plan, the service period, our order number, the amount, and Stripe's payment reference. For a refund, it also receives the credit note with the refund amount and the refund reference.
Our legal basis: the contract (PDPL Art. 4(9)), and our legal duty to keep business records (section 11).
After you sign in, your website is already filled in from your proposal. You correct what is wrong and add what is missing. While you fill in the setup steps, your browser keeps an unsent copy of what you typed in its session storage for this tab (not on our servers) for up to 12 hours, so reloading the page does not lose it. It is deleted when you submit, sign out or close the tab, and it never includes your confirmations.
We collect:
What appears publicly on your website: your business name, legal or trading name, licence details you gave us, business address (if you gave one) and the public contact details your buttons open. Your website shows them in its footer, on its buttons and in its Contact section.
Our legal basis: the contract (PDPL Art. 4(9)). For transfers outside the UAE, see section 4.
If the domain owner is someone else. If the person who will own the domain is not the person who accepted the offer, the business gives us only that person's name and email. We use them to email that person a link of their own (the business does not receive it), and store them with the business's order (section 10 says where). On that page the person sees the exact address and our registrar and its agreement, enters their own phone number and address, and agrees or declines. We keep what they enter with a record of their agreement, and give their details to our registrar only after they agree. If their name or email, the address, the registrar or its agreement changes, we ask them again, and details they entered for the earlier request are deleted. If they decline, the details they entered are deleted. If they decline before registration, nothing is registered with them as owner and we re-plan the owner with the business. If they withdraw after the address was registered with them, we work with the business to change the owner at the registrar. If they have not agreed 2 days after we emailed them, or if they decline, we tell the business by email, naming them.
Our legal basis: the contract (PDPL Art. 4(9)). For transfers outside the UAE, see section 4.
Our legal basis: the contract (PDPL Art. 4(9)). For transfers outside the UAE, see section 4.
Before and after your website goes live, you can correct details directly in your account. Those direct corrections do not go to the AI. You can also write what you want changed ("Tell us what to change", and after go-live "Make a change" and "Missing something?"), and attach photos.
Here is what happens to a written request: 1. Before you send it, you confirm that no person is shown or named in it, or that the people shown or named have agreed, including to processing outside the UAE. 2. We store it with your order, exactly as you wrote it, with any photos you attached. 3. Before any of it goes to our AI service (Anthropic), we reduce it to what the change needs:
4. The AI also receives your website's business-level details (such as the business name, area, opening hours, and your products or services with their prices and descriptions) and its current texts, reduced in the same way. 5. If your request names or is about a person (for example a member of your staff or family), if it cannot be reduced safely, or if you choose "Ask us to handle this", a person handles it, without the AI. 6. The AI returns suggested changes. Our system checks them. It puts a real email, phone number or address back only where you asked for it to appear on your website. 7. You see the suggested changes in your account and choose which to accept. Nothing on your website changes until you confirm. 8. If a request cannot be prepared automatically, or if you ask for a person, a person on our team sees your request on our protected admin page. Our internal alerts carry only a reference number and the kind of event, never your words. When that person applies or declines your change, the command they send through our internal chat (Telegram) carries only what the change needs, never your request as you wrote it (section 9). 9. When your website changes, we make a new preview. A preview that only reflects details you confirmed yourself (such as contact details, opening hours, prices, removals or replaced photos) is shown to you straight away. Other previews are checked by a person on our team before you see them. For a design change (another Look, your brand colour, section order or visibility), we propose one change, a person on our team checks its preview, and you see it and approve it. 10. After go-live, each change is prepared on top of your current live website and shown as a private preview with the number of edits it uses; nothing is published until you approve it. If a change goes beyond your allowance, a person on our team sets a price for it, which we show in your account and email to you, and which you accept or decline in your account (Client Terms, section 8.5).
The account asks you not to enter private details in these boxes, such as a home address, an ID or passport number, or a personal phone number. Please use the fields provided for your business and domain-owner details.
Our legal basis: the contract (PDPL Art. 4(9)). For transfers outside the UAE, see section 4; for people shown or named, see section 10.
This part is for people who visit a website that we run for one of our clients (the business named on that website). Each such website has a "Privacy" link to this section.
We use the following providers. We never sell your data.
| Provider | What they do for us | What they receive |
|---|---|---|
| Cloudflare | Hosts our pages, proposals, the request form, your account, previews and client websites, through its global network. Stores our database and files. Re-saves your photos (section 6.1). Renders preview images of proposals and websites. Protects our admin pages with a sign-in (Cloudflare Access). Connects client domains to our hosting. | Everything we hold in sections 3–8 (database and uploaded files), and technical data (such as IP addresses) of anyone who opens our pages, your account or client sites, or taps a button on a client site. |
| Clerk | Signs you in to your account (section 4-bis). | Your email address, the one-time codes it sends you, the record of your sign-ins, and per sign-in your IP address, browser, device type and approximate location. |
| Anthropic | AI service that writes proposal text, our first emails, and suggested changes from your requests. | Business-level facts only (sections 3 and 3-ter). For change requests: your request, your website's details and texts, reduced as described in section 7, and a photo only if your request is about it. |
| n8n | Runs our automated workflows. | For each step, only the reference numbers and the data that the next step needs; for our first emails, also a short preview of each reply, used only to recognise a STOP (section 3). Workflow runs are not saved, including failed runs (section 11). |
| Telegram | Internal alerts to our team, and the commands our team sends to handle requests by hand. Customers never deal with us on Telegram. | Alerts: reference numbers, the kind of event and, for payments, the amount, date and status (for example a card decline or a dispute); never names, contact details or your words. Commands: reference numbers and only what the action needs. For a change we make for you, that is the new content the change sets, which can include a website text, a catalogue item or price, opening hours, a contact detail (such as a phone number, an email address, an Instagram or Telegram username, another contact link, or the business name or address) or a name you asked us to show; for a request we decline, the short reason we give you; for an urgent removal, the explanation we send you of what we removed and why; for a proposal, a link to the business's public Google Maps listing with a one-line reason, or a corrected text of one of our emails to the business; for other records (payments, refunds, renewals, domains, exports, claims), a payment or provider reference and a short note without contact details. We never forward your request as you wrote it. Telegram handles these messages under its own privacy policy. |
| Zoho | Our customer mailbox hello@getsuperweb.com, and Zoho Invoice, where we make your invoices. | Emails we send you (account invitation, previews, billing and domain messages, messages about your change requests, monthly website reports, exports) and emails you send us. Zoho Invoice: the details on your invoices and credit notes (section 5). |
| Google (Google Workspace) | The mailboxes on trysuperweb.com that our first emails come from. Replies are handled there; lemlist also reads them and passes a short preview of each to our workflow service, which recognises a STOP automatically (section 3). | Your business email address, our emails to you, and your replies. |
| lemlist | Sends and schedules our first emails, and records unsubscribes. Gives our workflow service a short preview of each reply, so that a STOP is recognised automatically (section 3). Open and click tracking are switched off. | Your business email address and the business name, the short personalised sentences and links used in our emails, your replies, including their text, and your STOP. |
| Stripe | Card payments, saved cards for automatic payments, card updates, refunds and disputes. Processes payments for us, and uses payment data for its own purposes under its own privacy policy (section 5). | What you enter on Stripe's pages, your saved card, each payment and refund, and the order number, period, plan, amount, references, email address and renewal choice we send it (section 5). |
| Our registrar (Porkbun, section 6.2) | Registers and renews your .com in the domain owner's name. Uses registrant data under its own registration agreement and privacy policy. | The domain owner details, the chosen address, and your agreement to its registration agreement. |
| Porkbun (email at your domain) | Provides the forwarding and mailboxes at your domain (section 6.3), as part of its email service. | The addresses at your domain, the inbox you forward to, the mailbox password you set, and the content and details of the emails sent to and from these addresses. |
| Google (Business Profile) | Only on Business, where your offer lists the Google Business Profile help: the platform on which your Business Profile is kept. We work on your profile as a manager you added (section 6.4), through a standard Google Account. Google uses that data under its own terms and privacy policy. | What we enter on your profile as its manager (such as your business details, hours, services, photos and logo), and our manager access. |
| Oracle (Oracle Cloud Infrastructure Object Storage, UAE East (Dubai) region) | Keeps our recovery copies (section 8), once they are running. | Copies of live websites, encrypted copies of customer uploads, and weekly encrypted recovery points of customer data. No prospects' data. |
The .com registry (Verisign) receives only the address names we check for you (section 6.2), never your personal data.
We may also disclose data where UAE law requires it.
Where each provider is, and where it processes data:
The PDPL's transfer rules. The PDPL allows personal data to be sent outside the UAE to countries approved under PDPL Art. 22. We have found no published approval of any country under PDPL Art. 22, and we rely on none. Otherwise, the PDPL allows a transfer only in the cases it lists (PDPL Art. 23). Art. 23(2) leaves the detailed transfer conditions to Executive Regulations, which we have not found issued on the official legislation portal. We will update this section if they are.
The basis we use, for each kind of data:
| Whose data | Basis for sending it outside the UAE |
|---|---|
| People who ask for a free preview (section 3-ter) | Your explicit consent in the form, given before you send it (PDPL Art. 23(1)(b)), and the steps you asked us to take towards a contract (Art. 23(1)(d)). Without the consent, the request is not processed. |
| Clients (sections 4–8, including email at your domain and Business services) | Transfers necessary to perform our contract with you, including our contracts with the providers that deliver your service in your interest (Art. 23(1)(d)), limited to what is necessary; and your explicit consent in the transfer box at acceptance (Art. 23(1)(b)). |
| People acting for a client company (the person who accepts; a domain owner who is someone else) | The person who accepts: their own explicit consent in the transfer box (Art. 23(1)(b)). A domain owner who is someone else: their own explicit agreement through a link emailed to them, before their details are given to the registrar; their name and contact details are held by us beforehand only to ask them (on the company's contract, Art. 23(1)(d) for the company; the person's own consent for the registrar transfer). Without their agreement, registration with them as owner does not happen. |
| People shown or named in uploads and change requests | Their agreement, obtained by the client, which the client confirms before submitting (Art. 23(1)(b)). Without the confirmation, the material is not submitted. We remove it on objection. |
| Businesses we email without a request (legal persons only, section 3) | We have found no case in Art. 23 that clearly applies to the personal data that can be involved (for example a person's name in a business mailbox, a reply written by a person, the objection fingerprint, or reference numbers). We keep that data to the minimum described in section 3 and accept this remaining risk. |
| Visitors to our website and client websites (section 8) | We have found no case in Art. 23 that clearly applies to the technical data Cloudflare processes to deliver a page. We keep it to the minimum described in section 8 and accept this remaining risk. |
Safeguards. Cloudflare, Clerk, Anthropic, n8n and Google Workspace process data for us under data-processing terms that form part of the standard terms accepted for the accounts we use, which oblige them to protect personal data. lemlist processes data for us under a data-processing agreement we have signed with it. Oracle will process data for us under its data-processing terms once our recovery copies are running. Zoho offers its data-processing terms separately, for signature; we have asked Zoho for them, and until we have signed them, Zoho processes data for us under its terms of service and privacy policy. These terms are contractual safeguards; we do not claim that they are, by themselves, one of the cases the PDPL lists. Stripe processes payments for us under the data-processing terms of its Services Agreement; for its own purposes (such as fraud prevention) it uses data under its own privacy policy. Our registrar (also for email at your domain), Google for Business Profiles, and Telegram use data under their own terms and privacy notices; we have no separate data-processing terms with them. Telegram does not offer data-processing terms, so our alerts and our team's commands carry only the limited data described in section 9. We keep a record of the processing we carry out outside the UAE (PDPL Art. 7(4)).
| Data | How long |
|---|---|
| Photos taken from a business's own pages for a proposal, and every copy made from them | Deleted 30 days after the date until which the proposal was available (section 3), unless the business became a client; deleted at once when the business declines or objects, or when we withdraw or replace the proposal (if a deletion fails, our daily clean-up completes it). If a backup is restored, they are deleted again. |
| The rest of a proposal and the business information behind it (you never became a client) | Deleted 30 days after the date until which the proposal was available; then your business information, our drafted emails and any linked preview request are blanked (section 3). Our internal reference number and the record's state remain. |
| Abuse protection (free-preview form and account rate limits) | A keyed hash of the form sender's IP address (section 3-ter), or your account reference, with the day and a count; deleted within 3 days. |
| Free-preview request that never became a proposal | Your details are blanked 30 days after your last request (section 3-ter). |
| Your objection (STOP, unsubscribe, deletion request) | A restricted-use matching fingerprint of the address (a keyed hash) and its domain, used only to honour objections. It is personal data. Kept while we may contact businesses again; deleted if we close permanently. Until our email-sending provider confirms your unsubscribe, we also hold the address itself so we can pass it on; once the provider confirms, we delete the address. |
| Business records: invoices, credit notes, our books, payment, refund and dispute evidence, and the accepted Client Terms with their acceptance record (including the offer as it was shown to you, the renewal sentence you agreed to, and your agreement to any extra mailbox) | 7 years from the event each record relates to (for example the date of the invoice or payment), and longer while a tax audit or a dispute about it is open, or where we must keep it under a documented legal hold (UAE commercial and tax record-keeping rules: Federal Decree-Law 50/2022 Art. 29; Federal Decree-Law 47/2022 Art. 56; Cabinet Decision 74/2023). |
| Your website data: order, account membership, your details, website content, photos, design choices, starter logo files, brand-pack files, previews, publications (including earlier versions kept so that a change can be undone), change requests, quotes, urgent-removal reasons, your email-at-your-domain records (section 6.3) and your confirmations | Deleted 90 days after the service ends (at the latest 7 days later, so that an export asked for on the last day can still be recorded). If you asked for an export in time (Client Terms, section 13.6), what is needed for it is kept until we have delivered it and for 7 days after delivery, or longer if we agree an extension with you. An open refund or claim does not keep your website data: only the minimal record below. On a deletion request during the minimum term of a monthly plan: deleted within 2 days after the service ends (or, if you asked for a copy of your website, within 2 days after the 7 days that follow our sending it, or after a longer period we agree; section 12), not 90 days later. |
| Minimal record of what we still owe you | After the rest of your data is deleted, we keep only what an open obligation needs: for a refund, a domain handover or an unresolved ownership or rights claim, your contact name and email and, for a domain, the domain owner's name and email; while a domain registration we manage is still open, the domain owner's name and email. Each is deleted when that obligation or registration closes. |
| Domain records (the address, its state and dates) | Kept with our business records (above). The domain owner's details are deleted with your other data, except in the minimal record above, which goes when its obligation or registration closes. |
| Your agreement to the registrar's registration agreement | 3 years from when you gave it, as the registrar's agreement requires, even if your other data has been deleted. |
| Consent records (free-preview form, transfer box, confirmations about people shown or named) | Kept while the processing it covers continues; deleted with your website data. The acceptance record is also a business record (above). A domain owner's own agreement is kept for 3 years from when it was given (the owner's email only, as evidence), like your agreement to the registrar's agreement. |
| Replaced or unused versions of your design and starter logo, earlier published versions of your website, and photos you removed | Kept with your website data and deleted with it. |
| Email at your domain: the inbox you forward to | Deleted from our records when the forwarding is removed or closes (at the latest 30 days after the service ends), or, on a deletion request, as soon as the forwarding is removed at the provider (during the minimum term of a monthly plan, within 2 days after the service ends). |
| Email at your domain: the mail itself (held by Porkbun) | While the address is active; closed 30 days after the service ends, when the mail in a mailbox is deleted (Client Terms, section 10.4). If you remove a mailbox, its mail is deleted then. |
| Google Business Profile assessment (section 6.4) | Kept with the proposal or order it was made for. The listing link and the reason are blanked when the proposal is deleted without a sale, or on a deletion request. |
| Your saved card at Stripe | Detached from your Stripe customer record when your service ends. Stripe keeps its own records as described in the Stripe row below. |
| Exports | The export file is made when we prepare it and is not stored by us. What is needed to make it again is part of your website data and is kept as stated in the row above. The copy in our email to you is kept like our other emails (Emails, below). |
| Service-use counts (section 4-bis) | Not linked to you or your order (a coded reference against double counting is removed after 7 days). Kept for 24 months. |
| Records of what happened on an order (for example accepted, paid, live, cancelled), including our earlier emails to that business | Linked to the order while it runs and until its data is deleted; then made anonymous (no link to you) and kept as counts. |
| Our team's notes on actions taken for your order | Notes on billing, suspension, ending, export and claim actions (for example payments, refunds, invoices, disputes and cancellations) are business records, kept for 7 years (above). Other notes are deleted with your website data. |
| Deletion record | Only our internal reference numbers and times (no personal data), kept so that a deletion is applied again if a backup is ever restored. |
| Visit and button-tap counts | Daily counts per website (page loads, and taps on its contact buttons per kind of button), with nothing that identifies a visitor. Kept for 24 months, then the daily counts are deleted. |
| Your login at Clerk | Deleted automatically by our system with your other account data 90 days after the service ends, or earlier on a deletion request (section 12 says when). |
| Workflow records (n8n) | Not saved: every workflow is set to keep no run data, successful or failed. |
| Copies at Anthropic | Anthropic deletes what we send it within 30 days, except where its usage-policy checks or the law require it to keep data longer. |
| Internal Telegram alerts and commands | Alerts and commands hold only the data described in section 9. Kept until deleted by hand; deleted on request as part of a deletion request (section 12). |
| Emails (Zoho, Google, lemlist) | Emails directly about an order, a payment, a refund, a cancellation, or an invoice or credit-note dispute are part of our business records and kept for 7 years under the business-records rule above. Routine support emails, marketing emails and all other emails are deleted on request or when no longer needed. A rating you send us (getsuperweb.com/rate) is ordinary correspondence, not a business record, and is kept on the same terms; we publish nothing from it without your written permission. |
| Backups and recovery copies | Backups rotate within 35 days. The copies of your website's files in the second storage area (section 8) are deleted within 35 days after the file is deleted from our service. The encrypted copy we keep outside Cloudflare is replaced at least every 35 days, counted from when it was made, and the copy it replaces is deleted at that time. If a new copy cannot be made complete (for example after a fault in the backup), we keep the previous one until a complete copy replaces it, and files deleted in the meantime may stay in it until then. If a backup is restored, deletions made since it was taken are applied again. Once recovery copies are running (section 8), recovery copies of websites, of uploaded photos and of brand-pack files, and weekly recovery points, are deleted 35 days after they are made; the copy of a live website or of a photo still in use is renewed every 28 days, so a current copy always exists. Recovery copies never contain prospects' data; the backups our hosting provider keeps of our database include it and rotate in the same way. |
| Payment records at Stripe | Data Stripe processes for us: while we use Stripe; after our agreement with Stripe ends, deleted or returned under its data-processing terms, except where Stripe needs it to exercise its rights or meet its obligations, or where data-protection law requires or permits longer storage. Data Stripe uses for its own purposes (such as fraud prevention): under Stripe's own privacy policy. |
| Domain registration at our registrar | While the domain is registered, under the registrar's own rules (section 6.2). |
You can ask us to:
You can also withdraw any consent you gave us (sections 3-ter, 4 and 6) at any time. Withdrawal does not affect what we did before.
How: email hello@getsuperweb.com from the address we have for you, or tell us which address it is. We may ask you to confirm the request from that address. We respond within 30 days, and sooner where practical.
STOP: marketing emails and service emails are different. Reply STOP or unsubscribe to any of our emails and we stop sending you marketing and promotional emails. If you are a client, we keep sending the emails needed to deliver and run what you bought: your account invitation, reminders, previews, domain and go-live messages, receipts, invoices, payment, renewal and service notices, and your monthly website report (Client Terms, section 6.6). To end the service itself, see the Client Terms.
What deletion removes. If your service is still running, we first close it at once, and then delete your data. The exception is the minimum term of a monthly plan (see below). That exception does not apply if we are closing the service (Client Terms section 13.7). Closing your service on a deletion request works like a cancellation: before your website goes live, you get the full refund in Client Terms section 13.1; after it goes live, you get any refund owed under section 13.3. During the 3-month minimum term of a monthly plan, a deletion request does not end the minimum. We stop automatic renewal at once, so your plan ends at the end of the third month and nothing is charged after it. Until then we keep what we need to run your website and charge the remaining monthly payments (your order, your website and what it runs on, email at your domain, your account, your billing records and your saved card; PDPL Art. 4(9) and 15). We delete your marketing and prospecting data now. The rest (your account and login, your website and its content, and email at your domain) stays until your plan ends and is then deleted within 2 days (if you asked for a copy of your website, within 2 days after the 7 days that follow our sending it, or after a longer period we agree); your saved card is detached when your plan ends. Your billing records are business records and are kept as the law requires (section 11). If you want a copy of your website (Client Terms section 13.6), ask for it before your plan ends. While your request is pending, automatic renewal cannot be resumed; to withdraw your request, write to hello@getsuperweb.com. We can remove personal details from your website at any time if you ask. If our service is defective, your rights in Client Terms section 13.2 apply. During the minimum term, the items in the list below that your running service needs are deleted within 2 days after it ends (as above). When you ask us to delete your data, we find it by the email address we wrote to, or the email you used to buy, and we delete or blank:
We then record a restricted-use matching fingerprint of your email address so that we never contact you again.
What deletion does not remove. We keep:
Our system deletes your login at Clerk automatically, and our team checks that it is gone. Copies held by our other providers are handled by hand: we delete our Telegram alerts and commands, and our emails (Zoho, Google, lemlist) about you as part of your request, except emails we must keep as business correspondence (section 11). Anthropic deletes its copies on its own schedule (section 11). Invoices in Zoho Invoice are kept as the law requires. For payment data Stripe processes for us, Stripe's data-processing terms oblige it to help us respond to your request; payment records that must be kept by law are kept. Records Stripe keeps for its own purposes stay under its own privacy policy. Our registrar keeps its own records under its own rules; a domain registered in your name stays registered until it expires or is moved.
If the email address bought more than one business, or the business has other people on its account, we handle the deletion by hand so that we do not remove another person's business.
If you are unhappy with how we handle your data, tell us first at hello@getsuperweb.com. You can also contact the UAE Data Office.
These are the measures we actually use:
No system is completely secure. If a breach affects your personal data, we act to contain it and we tell the UAE Data Office and the people affected.
Our public pages (our homepage, proposals, the request form, the offer page and this notice), previews and client websites set no cookies, store nothing in your browser, load no analytics, advertising or social media trackers, and load no content from other companies' servers: our fonts are served by us. Client websites count page loads and contact-button taps with our own server, without cookies and without third-party analytics (section 8.1).
Your GetSuperWeb account uses cookies from our sign-in provider, Clerk, only to keep you signed in: __session and __session_ followed by a short code (on app.getsuperweb.com; they expire after 60 seconds and are renewed while you use the account), clerk_active_context (on app.getsuperweb.com, until you close the browser), __client_uat and __client_uat_ followed by a short code (on getsuperweb.com, so both app.getsuperweb.com and clerk.getsuperweb.com read them), and __client (on clerk.getsuperweb.com). The sign-in service on clerk.getsuperweb.com also sets Cloudflare's security cookies __cf_bm (30 minutes) and _cfuvid. All of these are strictly necessary; none are used for advertising or analytics. Stripe's own payment and card-update pages set Stripe's cookies under Stripe's privacy policy. While you fill in the setup steps, your browser also keeps an unsent copy of your details in its session storage for up to 12 hours (section 6); it is deleted when you submit, sign out or close the tab. Clerk also keeps its sign-in settings (no personal data) in your browser's local storage (__clerk_environment). If your account gives you access to more than one business and you switch between them, your browser also remembers in its local storage which one you opened last (your sign-in user ID, an identifier that relates to you, and our internal reference for that business), so that the account opens it next time; this stays until you clear your browser's local storage. If your sign-in profile has a picture, your account page shows it from Clerk's image server (img.clerk.com).
We will update this notice when what we do changes. Each version has a number. When you accept an offer, send a free-preview request, or give any consent described here, we record which version was shown to you.