Privacy Policy

We do not sell your personal data. We do not sell, rent, or trade your data to third parties for advertising. We process your data only to provide and improve the Service for you, as described below.

We process your information to:

• Provide and maintain the Service (account access, site generation, hosting, publishing).
• Improve and personalize the generation experience.
• Improve functionality, fix errors, and understand aggregate usage trends.
• Detect and prevent security threats, fraud, and abuse.
• Communicate with you (service notices, product updates, billing notices).
• Meet our legal obligations.

We may aggregate or anonymize data for analytics and research; such data can no longer identify you.

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): creating and maintaining your account, generating and hosting your sites, and providing support.
• Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing fraud and abuse, measuring and improving performance with privacy-friendly analytics, and understanding aggregate usage.
• Consent (Art. 6(1)(a)): where we ask for it, such as non-essential cookies (when offered) or optional marketing messages. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): meeting our legal, accounting, and tax duties and responding to lawful requests.

If you are in Türkiye, the corresponding KVKK bases are summarized in the Türkiye section below and set out in full in our KVKK Disclosure Notice.

We do not sell your personal data. We share it only as needed to run the Service, with the following providers and in the following cases:

• Anthropic (Claude API), United States — the brief and prompt text you write is sent here to generate your site's text content.
• OpenAI, United States — used to generate images and video for your site.
• fal.ai, United States — used to generate images and video for your site.
• Supabase, United States — authentication and database: stores your account, profile, and Service data.
• Vercel, United States — hosting and cookieless analytics: runs the Service and measures page performance without cookies and without profiling you.
• Cloudflare (global network) — storage (R2): holds the assets of the sites you generate; and bot protection (Turnstile): protects sign-up and login from automated abuse.
• Resend — transactional email: delivers account and notification emails, such as sign-up and waitlist confirmations.
• Payment provider — if and when you make a payment, a third-party payment provider processes it; we do not store card numbers.
• Legal and safety — competent authorities, where required by law or to protect rights and safety.
• Business transfer — in a merger, acquisition, or restructuring, with privacy obligations preserved.
• Content you publish — the sites and links you choose to publish are publicly accessible.

Image and video generation runs on our own infrastructure; the image and video generation prompts created during production are sent to OpenAI and fal.ai.

Web360 serves users worldwide, and our providers process data in countries other than your own, including outside the European Economic Area (EEA). Anthropic, OpenAI, fal.ai, Vercel, and Supabase process data in the United States, and Cloudflare operates a global network.

Where data is transferred out of the EEA, we rely on appropriate safeguards recognized under applicable law (such as an adequacy decision or Standard Contractual Clauses), together with reasonable security measures.

We keep personal information only for as long as necessary:

• Account data: kept until you delete your account. When you delete it, there is a short grace period (about 7 days) during which deletion can be reversed; after that, your data is permanently removed.
• Generated sites, prompts, and uploads: kept while your account is active; removed or anonymized when you delete them or close your account.
• Operational logs: kept for a limited period for security and troubleshooting (about 90 days).
• Product and usage insights: retained only in aggregated or anonymized form.
• Records we must keep by law (for example, accounting): kept for the legally required period.

Depending on where you live, you may have the right to access your data; to correct it; to delete it; to restrict or object to processing; to port it; and to withdraw consent you have given. If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority. To exercise a right, write to contact@web360.studio; we may ask for information to verify your identity. If you are in Türkiye, your KVKK rights are set out in our KVKK Disclosure Notice.

We apply reasonable, industry-standard technical and organizational measures to protect your data: encryption in transit (TLS), access restricted by authorization, and regular security reviews. No method of transmission or storage over the internet is 100% secure, so we also recommend that you use a strong password.

The Service is not directed to persons under the age of 18, and we do not knowingly collect their personal data. If you believe a child has provided us with data, contact contact@web360.studio and we will delete it.

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices; please review their own policies before using them.

We may update this Policy from time to time. We will post updates on this page and refresh the "Last updated" date, and we will reasonably notify you of significant changes.

For privacy questions and requests: contact@web360.studio

Web360 (360 Global Studio Yazılım ve Teknoloji A.Ş.) is the data controller. We process your personal data on the legal bases in Section 3, and you can exercise the rights in Section 7. You have the right to lodge a complaint with your national supervisory authority. Where your data is transferred outside the EEA, we apply the safeguards described in Section 5. For any privacy request, contact contact@web360.studio.

If you are in Türkiye, your personal data is processed by 360 Global Studio Yazılım ve Teknoloji A.Ş. as data controller under Law No. 6698 ("KVKK"). The categories of data we process, the legal bases under Article 5, transfers under Articles 8–9, and your rights under Article 11 are set out in full in our KVKK Disclosure Notice.