Privacy Policy
Effective Date: July 6, 2026
1. Overview
Geppetto (“Geppetto”, “we”, “us”) is a platform for building and hosting websites.
This Privacy Policy explains how we collect, use, and protect information when you use Geppetto or websites built using Geppetto.
By using Geppetto, you agree to this Privacy Policy.
2. Roles & Responsibilities
Geppetto acts as an infrastructure provider.
Depending on the type of data:
- For your account and website project data, Geppetto acts as the data controller or processor as required to operate the service.
- For websites you build using Geppetto, you are the data controller.
- For data collected through your websites (including form submissions), you are solely responsible for determining what data is collected, how it is used, and ensuring compliance with applicable laws.
Geppetto does not control or monitor data collected by websites created by users. You are responsible for providing appropriate privacy notices to your website visitors.
3. Information We Collect
3.1 Account Information
We collect:
- Email address (via Clerk)
- Authentication information managed by our authentication provider
- Account settings and preferences
3.2 Website Project Data
We store data needed to build and operate your websites, including:
- Prompts and instructions
- Website code and configuration
- Deployment settings
- Website metadata
- Files you upload (stored in Cloudflare R2)
3.3 Form Submission Data (Geppetto's Form Handling)
Websites built with Geppetto may collect form submissions from end users.
This data is controlled by the website owner.
On Team plans:
- Stored by Geppetto on behalf of the website owner
- Can be viewed, searched, exported, and deleted by the owner
- Deleted when the website is deleted (after a 30-day soft delete period)
On Solo plans:
- Delivered via email only
- No persistent storage
3.4 Payment Information
Payments are processed by Stripe.
We do not store full card details.
We may store limited billing metadata such as subscription status and Stripe identifiers.
3.5 Usage Analytics
We use Umami Cloud for privacy-friendly analytics, including:
- Page views
- Feature usage
- Device and browser information
- Approximate geographic information derived from IP address
3.6 Error and Diagnostic Data
We use Sentry to collect error and debugging information, such as:
- Error messages
- Stack traces
- Request metadata
4. How We Use Information
We use data to:
- Provide and operate Geppetto
- Generate and deploy websites
- Store and manage website projects
- Authenticate users
- Process payments
- Send transactional emails
- Monitor performance and reliability
- Debug and fix issues
- Improve the platform
We do not use your data to train AI models.
5. AI Processing
Geppetto uses Anthropic’s AI models to generate website code and configurations.
- Prompts and related project data may be sent to Anthropic solely to fulfill user requests.
- We do not use this data for model training.
6. How We Share Information
We do not sell personal data. We share data only with service providers necessary to operate Geppetto:
- Clerk: authentication
- Cloudflare: hosting, storage, and security
- Anthropic: AI generation
- Stripe: payments
- Resend: email delivery
- Umami Cloud: analytics
- Sentry: error monitoring
7. Data Retention
7.1 Soft Deletion
When an account or website is deleted:
- It enters a 30-day soft delete period
- It is not actively accessible during this time
- It can be restored via support
- After 30 days, it is permanently deleted from active systems
7.2 Backups
Some data may remain in encrypted backups for disaster recovery purposes for a limited period.
Backups are only accessed for system restoration.
8. Data Security
We use reasonable safeguards including:
- Access controls
- Encryption in transit
- Secure infrastructure
No system is fully secure.
9. Your Rights
You may have rights to:
- Access your data
- Correct inaccuracies
- Delete your data
- Export your data
- Object to processing
Contact: support@geppetto.build
10. Cookies
We use minimal cookies for authentication and session management (via Clerk).
Analytics is privacy-focused and does not rely on invasive tracking.
11. Children’s Privacy
Geppetto is not intended for children under 13.
We do not knowingly collect data from children.
12. International Data Transfers
Data may be processed in countries outside your own, including the United States.
13. Changes to This Policy
We may update this policy from time to time. Updates will be posted with a revised effective date.