Privacy Policy

For personal information Pebblish collects for its own purposes—such as account administration, billing, security, support, and product analytics—Pebblish is the controller or business responsible for that information.

When a customer uses a Pebblish-hosted website to collect inquiries or other information from visitors, the customer ordinarily decides why and how that information is collected. In that context, the customer is ordinarily the controller or business, and Pebblish processes the information on the customer's behalf to provide hosting, forms, lead management, email, and notification functionality. Pebblish may independently process limited information for security, fraud prevention, legal compliance, and operation of the Service.

This Privacy Policy explains how we process personal information when you visit Pebblish, create or use an account, build or manage a website, communicate with us, purchase a subscription, or otherwise use our services (collectively, the "Service"). It also explains our role when people submit information through customer websites hosted by Pebblish.

The Service may be accessible internationally, but availability in a location does not mean every feature is offered or legally permitted there. Local privacy laws may provide additional rights.

Account, authentication, and profile information

We may collect your name, email address, phone number, profile image, account and workspace identifiers, account role and status, authentication method, verification status, session information, and account timestamps.

If you sign in using Google or another authentication provider, we may receive information that provider makes available, such as your name, email address, profile image, provider account identifier, and authentication data needed to maintain the connection. The provider separately processes information under its own privacy policy.

Business and website information

We process information you provide about your business and websites, including business name, description, industry, services, service areas or location, prices, opening hours, contact details, social links, customer journey preferences, branding preferences, themes, fonts, colours, images, logos, text, page content, metadata, navigation, domains, and other information used to generate, edit, publish, or operate a website.

We also store website configuration and operational records, which may include drafts, blocks, pages, assets, generated content, composition metadata, revision history, publication status, domain and DNS-verification information, cache-invalidation records, and timestamps.

When you publish a website, the content and business information you choose to publish become publicly available. Search engines, social networks, archives, and other third parties may index, copy, cache, or redistribute public content. Removing or unpublishing content through Pebblish may not immediately remove copies held by those third parties.

Content and files you provide

We process content you upload, enter, edit, generate, or publish, including text, images, logos, files, messages, instructions, and business facts. You retain ownership of your original content, subject to the limited license in our Terms of Service that allows us to operate and provide the Service.

Please do not submit sensitive personal information, confidential third-party information, health information, government identifiers, financial-account credentials, or other information that is not reasonably necessary to build or manage your website.

AI and Ruma information

When you use website generation, rewriting, image assistance, Ruma, or another AI-assisted feature, we may process your instructions, onboarding answers, relevant business context, website content, selected page or block context, conversation messages, proposals, approvals, generated output, change snapshots, model and provider information, token usage, latency, and outcome information.

Visitor inquiries and lead information

Pebblish websites may collect information submitted by visitors, including names, email addresses, phone numbers, messages, inquiry details, selected form options, and submission timestamps. Pebblish stores this information for the customer, makes it available through lead-management features, and may deliver notifications by email or browser push notification.

If you submitted an inquiry through a customer's website and want to exercise a privacy right concerning it, you should normally contact the business identified on that website. You may also contact Pebblish if you cannot identify or reach the relevant business.

Payment and subscription information

Payments and subscriptions are processed through Polar, which acts as Merchant of Record and authorized reseller for applicable purchases. Polar and its payment partners may collect payment-card details, billing and tax information, transaction information, and fraud-prevention information under their own terms and privacy policies.

Pebblish does not store full payment-card numbers. We may receive and store information needed to administer access and support, such as Polar customer, product, price, order, and subscription identifiers; plan and billing interval; subscription status and dates; card brand and last four digits; portal or payment-update links; and related transaction metadata.

Communications and email-delivery information

We may process support messages and other communications you send us. When Pebblish sends account, security, subscription, publishing, welcome, or lead-notification emails, we may store the recipient, email template, delivery status, attempt count, provider message identifier, error information, and timestamps needed to deliver, troubleshoot, and avoid duplicate messages.

Push-notification information

If you enable browser push notifications, we may store a push endpoint, application origin, encryption keys, browser user agent, enabled status, delivery attempts, failure information, and related timestamps. You can disable notifications through Pebblish where available or through your browser or device settings.

Usage, analytics, and technical information

We may collect IP address, approximate location derived from IP, browser and device information, operating system, application origin, pages and features used, navigation events, timestamps, plan and feature context, diagnostic information, error and performance information, security events, and identifiers used to distinguish accounts or workspaces.

Where enabled and permitted, Pebblish may use PostHog for product analytics and Microsoft Clarity for interaction analytics such as session recordings, heatmaps, scroll behaviour, dead clicks, and rage clicks. We configure analytics to avoid intentionally sending obvious sensitive fields, and we mask designated form inputs where supported, but you should not enter sensitive information into fields that do not require it. PostHog session recording is disabled in Pebblish's current configuration. Microsoft and PostHog process analytics information under their own privacy terms.

Security and abuse-prevention information

We may process IP addresses, request headers, rate-limit counters, one-time authentication information, security tokens, Cloudflare Turnstile results, used-token records, login events, suspected abuse information, and related technical data to authenticate users and protect Pebblish and customer forms.

Information from third parties

We may receive information from authentication, payment, subscription, hosting, domain, analytics, email, and image providers; customers that use Pebblish; and people who communicate with us. We may combine it with information associated with the relevant account, website, subscription, request, or security event.

Where we rely on legitimate interests, we consider the necessity of processing and its effect on the people concerned. Where processing is based on consent, you may withdraw consent at any time without affecting processing that occurred before withdrawal.

We do not claim ownership of original business content merely because it is submitted to Pebblish.

Pebblish uses AI and automated systems to help generate or improve website copy, structure, pages, blocks, themes, presentation choices, and other website elements. Relevant instructions and website or business context may be transmitted to an AI provider, currently including OpenAI where configured, or to another provider identified by Pebblish if the provider changes.

We aim to transmit only information reasonably necessary for the requested feature. Do not include sensitive or confidential personal information in AI instructions unless it is necessary, lawful, and appropriate to do so.

AI providers process inputs and outputs under their applicable business terms, data-processing terms, and retention settings. Pebblish does not use customer content to train a Pebblish general-purpose AI model. We do not authorize an AI provider to train its general-purpose models on Pebblish API inputs or outputs unless we first provide appropriate notice and obtain any consent required by law.

AI output may be inaccurate, incomplete, inappropriate, non-unique, or potentially similar to third-party material. You are responsible for reviewing it before publishing or relying on it. AI does not make decisions that produce legal or similarly significant effects about Pebblish users.

Pebblish may provide access to third-party images from Unsplash and Pexels. Images remain subject to the applicable provider's license, terms, API requirements, and attribution requirements.

For Unsplash content, Pebblish may use provider-supplied image URLs, display attribution, link to Unsplash or the photographer, and notify Unsplash when an image is selected or used in a manner the provider treats as a download. For Pexels content, Pebblish may display links or attribution to Pexels and its contributors and may retrieve or store a selected image as permitted by the provider.

Technical information, search terms, provider asset identifiers, or selection information may be transmitted to these providers when their services or content are requested, displayed, or selected.

Pebblish uses cookies, browser storage, and similar technologies for:

• authentication and session security;
• abuse prevention and Cloudflare Turnstile;
• remembering interface preferences, such as sidebar state;
• remembering analytics choices; and
• analytics and service improvement where enabled.

Strictly necessary technologies may operate without optional consent where permitted by law. We request consent before enabling non-essential analytics technologies where applicable law requires it. Declining non-essential analytics does not prevent access to the core Service.

Where an analytics-preference control is available, you may use it to change your choice. You may also clear Pebblish cookies and local storage through your browser. Clearing storage may sign you out, reset preferences, or cause the consent prompt to appear again.

We disclose information only as reasonably necessary for the purposes described in this Policy, including to:

• hosting and application infrastructure providers, including Vercel;
• database, storage, and security providers, including the configured PostgreSQL provider and Cloudflare services such as R2 and Turnstile;
• authentication providers, including Google where selected by the user;
• AI providers, including OpenAI where configured;
• payment and subscription providers, including Polar and its payment partners;
• email-delivery and communications providers;
• analytics and monitoring providers, including PostHog and Microsoft Clarity where enabled;
• image providers, including Unsplash and Pexels;
• browser and device push-notification services when a user enables notifications;
• professional advisers, auditors, insurers, and authorities where reasonably necessary; and
• a buyer, investor, lender, successor, or adviser involved in a potential or completed merger, financing, acquisition, restructuring, or transfer of all or part of the business.

Providers may process information for independent purposes where their terms say they act independently, or on Pebblish's instructions where they act as service providers or processors.

We may also disclose information to comply with law or valid legal process; protect the rights, safety, and security of users, visitors, Pebblish, providers, or the public; investigate fraud, abuse, or security incidents; or enforce our agreements.

Pebblish does not sell personal information. Pebblish does not share personal information for cross-context behavioural advertising, as the terms "sell" and "share" are defined under applicable US state privacy laws. We do not use personal information to serve third-party targeted advertisements. If these practices change, we will update this Policy and provide legally required notice and choices before the change applies.

Pebblish uses providers that may process information in the United States, Europe, and other countries. Information may therefore be processed in countries whose data-protection laws differ from those where you live.

Where applicable law requires a transfer mechanism, we rely on measures appropriate to the provider and transfer, which may include adequacy decisions, approved contractual protections such as standard contractual clauses, provider data-processing terms, or another legally recognized safeguard. Contact us for information about safeguards relevant to your information.

We retain information only for as long as reasonably necessary for its purpose, including to provide the Service, maintain security and business records, resolve disputes, enforce agreements, and meet legal, tax, accounting, or regulatory obligations. Retention depends on the category and context:

• Account and profile information: while the account remains active and afterwards for the time reasonably needed to complete deletion, resolve disputes, prevent fraud, and meet legal obligations.
• Website drafts, published content, configuration, domains, and revision history: while the website or account remains active. Website deletion removes website-scoped database records through the normal deletion process, subject to shared assets, provider cleanup, backups, security records, and legal holds.
• Uploaded and stock assets: while linked to an active website, another website, or an active or historical published revision. Unreferenced, non-shared assets may be deleted when the related website or asset is deleted. Provider-side or cached copies may take additional time to disappear.
• Visitor leads: until the customer deletes the related website or account, asks Pebblish to delete applicable records, or another retention requirement applies. Customers remain responsible for setting and following an appropriate retention period for their leads.
• Ruma conversations, proposals, snapshots, and usage records: while needed to provide conversation history, proposal approval, apply and undo functionality, security, support, and usage controls, or until the related website or account is deleted, subject to legal and operational exceptions.
• AI-provider inputs and outputs: according to the provider's business terms and retention controls configured for Pebblish. Pebblish may separately retain prompts, conversations, generated website content, and usage metadata as part of the Service.
• Subscriptions, transactions, and tax or accounting records: for the period required by applicable tax, accounting, payment, fraud-prevention, and legal obligations.
• Email-delivery and support records: while reasonably needed to provide support, demonstrate delivery, prevent duplicates, troubleshoot failures, resolve disputes, and meet legal obligations.
• Analytics: according to Pebblish's configured analytics retention and provider settings, or until identifiers are deleted or anonymized.
• Push subscriptions: until disabled, removed, replaced, no longer usable, or the associated account is deleted, subject to short-lived delivery and failure records.
• Authentication, rate-limit, Turnstile, security, and diagnostic records: for the applicable session, token, or rate-limit period and afterwards where reasonably necessary to investigate abuse, protect the Service, or comply with law. Expired rate-limit and used-token records are eligible for routine cleanup.
• Backups: until they age out under the relevant infrastructure backup cycle. If deleted information is restored during disaster recovery, we will take reasonable steps to prevent it from returning to active use and to reapply applicable deletion requests.

We may retain information for longer when subject to a legal hold, dispute, fraud investigation, or binding legal obligation. We may retain aggregated or de-identified information that no longer reasonably identifies an individual.

Customers may delete individual websites using Pebblish controls where available. Website deletion is separate from account deletion and may affect public availability, domains, leads, assets, revision history, and related records.

Customers may delete their account directly from Account Settings by confirming the request. An active subscription must be canceled first. If you cannot access your account, email support@pebblish.me from the address associated with the account and we may request information reasonably necessary to verify identity, authority, and the intended scope of deletion.

Before deleting an account, retain any information you need. Account deletion is immediate and permanent: it removes your websites, pages, content, assets, leads, bookings, and related records, unpublishes any live websites, and disconnects domains. Certain subscription, transaction, fraud-prevention, security, dispute, backup, and legal records may be retained where required or permitted by law.

Depending on your location and subject to legal exceptions, you may have rights to:

• know whether and how we process your personal information;
• request access to or a copy of personal information;
• correct inaccurate personal information;
• request deletion;
• restrict or object to certain processing;
• receive certain information in a portable format;
• withdraw consent at any time;
• opt out of a sale, targeted advertising, or legally defined sharing, although Pebblish does not currently engage in those practices;
• appeal certain decisions about a privacy request where applicable; and
• receive equal service and not be discriminated against for exercising a privacy right.

To make a request, email support@pebblish.me. Describe the request and identify the relevant account, website, or interaction. We may ask for information needed to verify your identity or authority. An authorized agent may submit a request where applicable law permits it, but we may require proof of authorization and identity.

If your request concerns information submitted to a customer's website, contact that customer first where practical. Pebblish will assist customers with applicable requests as required by our role and applicable law.

You may also have the right to complain to a privacy or data-protection authority in your country or region. We encourage you to contact us first so we can try to address the concern.

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including access controls, tenant-scoped authorization, encrypted network transport, provider security controls, abuse prevention, rate limiting, bot protection, and backup and recovery measures where configured.

No internet-based service or storage system can guarantee absolute security. You are responsible for protecting access to your email account, devices, authentication methods, and Pebblish sessions and for notifying us promptly if you suspect unauthorized access.

Pebblish is intended for business and professional use by adults. You must be at least 18 years old to create or control a Pebblish account.

Pebblish is not directed to children, and customers must not use the Service to unlawfully collect or process children's personal information. If we learn that personal information was collected from a child without required parental consent or other authorization, we may restrict or delete it as required by law.

Pebblish may integrate with or link to third-party services. A third party acting independently controls its own privacy practices, and its terms and privacy policy apply to its processing.

Pebblish customers operate their published websites and are responsible for their relationships with visitors, including business-specific privacy notices, cookie disclosures, consent mechanisms, marketing permissions, retention decisions, and responses to visitor requests. Pebblish's Privacy Policy does not replace a customer's own legally required website policy.

We may update this Policy as Pebblish evolves, providers or practices change, or legal requirements develop. We will update the "Last updated" date. If a change materially affects how we use personal information, we will provide additional notice or request consent where required by law.

If a separate legal entity becomes the operator, we will update this Policy and provide appropriate notice. Information may be transferred to that entity as part of the transition, subject to applicable law and continued protection under this Policy or a replacement policy communicated to affected users.

The current operator and privacy contact is:

Shoaib Khalid
Email: support@pebblish.me

Use the subject line "Privacy Request" for access, correction, deletion, objection, or other privacy-right requests. Formal correspondence may be sent by email until a separate public business address is designated.